This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Web Filtering]-help needed in setting up multiple filtering profiles for one network

Question concering web filtering.

I have a home license and set up a box with 5 nics: 1 wan and 4 lans for four seperate networks: [wired], [wireless], [voip] and [dmz].

I am trying to set up web filtering for the [wired] network with multiple filtering profiles - three profiles for different sets of users.  I have not been able to get it to work correctly and in searching the forum have not found a solution

The wired network (192.168.100.x) contains both windows domain users and non-domain users. Astaro authenticates domain users with AD SSO authentication.  I am trying to set up three seperate filtering profiles to apply on the wired network for two seperate AD user groups [Domain User Group 1] and [Domain User Group 2] as well as non-AD users (with filtering applied to specific machines for which there are Network definitions).

Web filtering profiles are set up as follows:

(1)  Filter Profile 1
[Domain User Group 1]
[wired network]
[AD SSO authentication]
[Filter action 1]
Fallback filter action is [Filter action 3]

(2) Filter Profile 2
[Domain User Group 2]
[wired network]
[AD SSO authentication]
[Filter action 2]
Fallback filter action is [Filter action 3]

Default Filtering Profile
[wired network]
[transparent proxy]
BLOCK ALL ACCESS (whitelist only)

If Filter Profile (1) and (2) both active:
Domain User Group 1 - filtering using [Filter Action 1] works fine.
Domain User Group 2 - applies fallback profile of (1) Filter Profile 1 - [Filter action 3] rather than using seperate filtering profile which contains those users [Filter Profile 2]
Non-AD users have net access.  (I am not sure if no filtering is done or if [Filter Profile 1] is applied).  The [Default Filter Profile] BLOCK ALL is not applied.

If Filter Profile 1 is inactive and Filter Profile 2 is active, then:
Domain User Group 2 - applies [Filter Profile 2] as expected
Domain User Group 1 - applies default Filter Profile of (2) Filter Profile 2
Non-AD users have net access.  (I am not sure if no filtering is done or if  or [Filter Profile 2] is applied).  The [Default Filter Profile] BLOCK ALL is not applied.

In searching the forum, I have found references which state only 1 filtering profile will work on a single network.  The filtering profile that will work is the first profile invoked.

Is this correct?  Is there a way to have three seperate filtering profiles on a single network; one each for [Domain User Group 1], [Domain User Group 2] and [non-AD users]?

I wish to set up seperate Filter Profiles for [Domain User Group 1] and [Domain User Group 2] as well as block certain non-AD users (blocked by network definition for specific machines) and allow other non-AD users (again by network definition for specific machines)  If only one Filtering Profile is allowed per network, then I would be limited to 2 filter actions (the Profile rule action and default action) rather than the 3 or 4 actions sought.

[I note if I set up a seperate filtering profile for a different network [i.e, wireless] that seperate filtering profile works as expected.]

This thread was automatically locked due to age.

Parents

0 Hallowach2 over 13 years ago

Hi Rayik,

that sounds strange. Can you determine on which way that xx.100.31 machine accesses the internet? (packetfilter, dnat should be found in paketfilter log or via webproxy in contentfilter log - in some logfile there must be a hint...or can that machine bypass the asg on a way?)

Regards
Manfred
Cancel
Vote Up 0 Vote Down

Cancel
0 rayik over 13 years ago in reply to Hallowach2

Hi Rayik,

that sounds strange. Can you determine on which way that xx.100.31 machine accesses the internet? (packetfilter, dnat should be found in paketfilter log or via webproxy in contentfilter log - in some logfile there must be a hint...or can that machine bypass the asg on a way?)

Regards
Manfred

Thank you Manfred for the ideas.

The x.x.100.31 machine does not bypass the asg.  The asg has five (5) physical nics.  Connections are:

wired --------------->|
Wireless------------->|
VOIP---------------->|     ASG------->| Modem
Server DMZ---------->|

While accessing the internet on the [192.168.100.31] machine, there are no entries in either the web filtering (with all x.x.100.x rules set to logging) or firewall logs.

With more tinkering I think I see a pattern.  The [192.168.100.31] machine is a windows hyper-v vm.  All x.x.100.x hyper-v vms are connecting to the internet even with a default filtering profile of BLOCK ALL for that network.

I set up two Web Filtering profiles:

(1) Wired network allowed
Source networks: [Wired]
Filter assignments:
1 - [Profile 1]
2 - [Profile 2]
Fallback action:  [Profile 3]  --> which is BLOCK ALL profile
Operation mode:  [Standard]
Authentication: [Active Directory SSO]

(2) Block wired network AD users
Source networks: [Wired]
Filter Assignments: [Profile 3]  --> which is BLOCK ALL profile
Fallback Action: [Profile 3]  --> which is BLOCK ALL profile
Operation mode: [Transparent]

With (1) only active, AD users are filtered according to either Profile 1 or Profile 2.  Non-AD users on either physical or hyper-v vm machines connect to the internet

With (1) and (2) active, AD users are filtered according to either Profile 1 or Profile 2.  Non-AD users on REAL PHYSICAL machines have internet access blocked.  Non-AD users on hyper-v virtual machines are not blocked and have full internet access.  The REAL PHYSICAL HYPER-V HOST is blocked.

The hyper-v host has 3 physical nics.  Configuration is as follows:

[GREEN] - virtual machine host and several hyper-v guests including [192.168.100.31]
[PURPLE] - virtual machine hosts in [SERVER-DMZ] network.  Web filtering works fine for this network.
[RED] - nothing hooked up to it.  (Used to be for hyper-v asg)

It is strange that the hyper-v guests using the [GREEN] nic (with seperate ip addresses for each guest) are not blocked by web filtering while the actual hyper-v HOST which uses the [GREEN] nic is blocked.

Later I'll try running the [192.168.100.31] hyper-v machine through the [RED] nic - which will make it the only machine on that nic, and see if that makes a difference.

Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rayik over 13 years ago in reply to Hallowach2

Hi Rayik,

that sounds strange. Can you determine on which way that xx.100.31 machine accesses the internet? (packetfilter, dnat should be found in paketfilter log or via webproxy in contentfilter log - in some logfile there must be a hint...or can that machine bypass the asg on a way?)

Regards
Manfred

Thank you Manfred for the ideas.

The x.x.100.31 machine does not bypass the asg.  The asg has five (5) physical nics.  Connections are:

wired --------------->|
Wireless------------->|
VOIP---------------->|     ASG------->| Modem
Server DMZ---------->|

While accessing the internet on the [192.168.100.31] machine, there are no entries in either the web filtering (with all x.x.100.x rules set to logging) or firewall logs.

With more tinkering I think I see a pattern.  The [192.168.100.31] machine is a windows hyper-v vm.  All x.x.100.x hyper-v vms are connecting to the internet even with a default filtering profile of BLOCK ALL for that network.

I set up two Web Filtering profiles:

(1) Wired network allowed
Source networks: [Wired]
Filter assignments:
1 - [Profile 1]
2 - [Profile 2]
Fallback action:  [Profile 3]  --> which is BLOCK ALL profile
Operation mode:  [Standard]
Authentication: [Active Directory SSO]

(2) Block wired network AD users
Source networks: [Wired]
Filter Assignments: [Profile 3]  --> which is BLOCK ALL profile
Fallback Action: [Profile 3]  --> which is BLOCK ALL profile
Operation mode: [Transparent]

With (1) only active, AD users are filtered according to either Profile 1 or Profile 2.  Non-AD users on either physical or hyper-v vm machines connect to the internet

With (1) and (2) active, AD users are filtered according to either Profile 1 or Profile 2.  Non-AD users on REAL PHYSICAL machines have internet access blocked.  Non-AD users on hyper-v virtual machines are not blocked and have full internet access.  The REAL PHYSICAL HYPER-V HOST is blocked.

The hyper-v host has 3 physical nics.  Configuration is as follows:

[GREEN] - virtual machine host and several hyper-v guests including [192.168.100.31]
[PURPLE] - virtual machine hosts in [SERVER-DMZ] network.  Web filtering works fine for this network.
[RED] - nothing hooked up to it.  (Used to be for hyper-v asg)

It is strange that the hyper-v guests using the [GREEN] nic (with seperate ip addresses for each guest) are not blocked by web filtering while the actual hyper-v HOST which uses the [GREEN] nic is blocked.

Later I'll try running the [192.168.100.31] hyper-v machine through the [RED] nic - which will make it the only machine on that nic, and see if that makes a difference.

Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 rayik over 13 years ago in reply to rayik

Placing [192.168.100.31] hyper-v guest on it's own host nic did not change results.    [192.168.100.31] hyper-v guest was still to connect to internet regardless of web filtering settings (or even firewall settings).

Three behaviors were seen:

(1)  The hyper-v host (actual physical machine) is blocked by either web filtering or firewall settings.

(2)  Any hyper-v guest vm on the same network as the hyper-v host is able to connect to the internet regardless of web filtering or firewall settings in asg.   (Regardless if the hyper-v guest vm using the same or different physica hyper-v hostl nic as the hyper-v host did to communicate with the network.)

(3)  Hyper-v guests on a different network than the host are blocked by either web filtering or firewall settings in asg.  (Those guests are on a different physical nic than that used by the hyper-v host.)

Hyper-v host nic assignment for the latest test were:

GREEN - hyper-v host and hyper-v guests all in the [wired] network
PURPLE - hyper-v guests vm in SERVER-DMZ network
RED - [192.168.100.31] guest which is in the [wired]

Both the PURPLE and RED nic did not have either ip4 or ip6 selected in properties.

Lastly - I rebuilt the asg using the "latest download" from astaro.com (which is 8.300).  I imported the configuration file to the new asg build.  Same results as above.

********EDIT

I apologize for failing to note that the [192.168.100.31] machine was a hyper-v guest.  I have been using hyper-v for years and up to this point, have not noticed any difference in how they appear to a system as compared to an actual physical machine.
Cancel
Vote Up 0 Vote Down

Cancel