In this page you find:
The HTTP proxy employed in the Endian Hotspot Appliance is squid, whose primary ability is to cache web requests to speed up future requests of the same page, though it has many more functionalities that allows its seamless integration with the other services described in the remainder of this section. The HTTP proxy settings page is composed of six tabs that organise a myriad of options: Configuration, Access Policy, Authentication, Web Filter, AD join, and HTTPS Proxy.
A click on the Enable HTTP Proxy grey switch 
starts
the HTTP proxy. After some seconds, necessary to start all required
services, a number of controls appear in the Configuration tab,
grouped into six panels: Each panel has a title, followed by a
? that shows a tooltip, and can be expanded or collapsed by
clicking on the 
or 
icons located on the left of
the labels.
In the Proxy settings panel there are some global configuration options for the proxy services:
The TCP port on which the proxy server is listening for connections, which defaults to 8080.
The language in which error messages are displayed, which defaults to the one chosen in .
The hostname assumed by the proxy server, also reported at the bottom of error messages.
The email address shown by the proxy server in error messages.
Note
The cache admin e-mail address is not present in the Mini appliances, since cache management is not available there.
The limit for HTTP file downloads. 0 means unlimited.
The limit for HTTP file uploads (e.g., those used by HTML forms with file uploads). 0 means unlimited.
Configuration option for the ports the clients are allowed to use when browsing:
The TCP destination ports to which the proxy server will accept connections when using HTTP. One port or one port range per line are accepted, comments are allowed and start with a #, ending at the end of the line.
The TCP destination ports to which the proxy server will accept connections when using HTTPS. One port or port range per line are accepted, comments are allowed and start with a #, ending at the end of the line.
Configuration option to enable the logging facility and choosing what to log.
Log all the URLs being accessed through the proxy. It is a master switch, hence the following four options are enabled and can be configured only if logging is enabled, which is not by default (recall that the more is logged, the more space on the Endian Hotspot Appliance‘s hard disk is needed).
Log the parameters in the URL (such as ?id=123).
Log the user agent sent by each browser.
Log when the content of web pages is filtered.
Let the firewall log the outgoing web accesses, i.e., those directed through the RED interface to the Internet. This options only works for transparent proxies.
In this panel some exception to the transparent proxy can be defined: which sources (i.e., clients) and destinations (i.e., remote servers) should be ignored by the proxy, even if it is enabled in that zone.
The sources that should not be subject to the transparent proxy. Entries can be single IP addresses, subnets, or MAC Addresses.
The destinations that are not subject to the transparent proxy. Entries can be single IP addresses or subnets.
Hint
Use CIDR notation to enter subnets.
Configuration options for the space occupied on disk by the cache and the size of the objects stored.
The amount in megabytes that the proxy should allocate for caching web sites on the hard disk.
Click on the clear cache button to immediately erase the cache on disk.
The amount in megabytes of memory that the proxy should allocate for caching web sites in the system memory.
The resources downloaded from these sites will never be stored in the cache. Entries can be domain names or single IP addresses (without subnet).
The upper size limit in megabytes of a single object that should be cached.
The lower size limit in megabytes of a single object that should be cached.
Note
Objects whose size does not fall within the above defined ranges will never be stored in the cache on disk, but downloaded each time they are requested by a client.
When this option is enabled, the proxy will never try to update cached objects from the remote web server, therefore clients will be able to browse cached, static websites even after the uplink went down.
Warning
This option proves useful to surf the Internet while the uplink is down, if the page requested has been cached before. However, this option may cause some trouble when trying to refresh a page, even with a working uplink, since the HTTP proxy would always serve the cached page. The only possibility to have a refreshed copy of a web page is in this case to clear the cache of the proxy server.
If there is another proxy server in the LAN, it can be contacted before actually requesting the original resource. This panel contains configuration options for the connection between the Endian Hotspot Appliance and the upstream proxy.
Tick this checkbox to enable an upstream proxy and show more options. When enabled, before retrieving a remote web page that is not already in its cache, the Endian Hotspot Appliance‘s proxy contacts the upstream proxy to ask for that page.
The IP address of the upstream proxy server.
The port on which the proxy service runs on the server.
The username to connect to the proxy server, if needed.
The password to connect to the proxy server, if needed.
Tick the checkbox to forward the username to the upstream proxy.
Tick the checkbox to forward the client IP address to the upstream proxy.
The accesses policies are applied to every client that is connecting through the proxy, regardless of its authentication. An access policy rule is a time-based scheme that permits or prohibits accesses depending on diverse parameters about the user (e.g., the source or destination of the traffic), and the client used or the content downloaded (e.g., the user agent, the mime types, virus scanning, and content filtering).
A list of the already defined rules is displayed on the page. Any rule can specify if the web access is blocked or allowed, and in the latter case a filter type can be activated and selected. The table carries the following information for each rule listed therein: The progressive identification number (#), the name (Policy), the source and destination interested, the authentication type, if required, the periods in which is active, the user agents matched, and the available actions.
Note
The policies are evaluated from top to bottom, therefore their order is important.
To add a new access policy rule, simply click on Add Access policy: A form will open, in which to configure all the parameters:
The sources of the traffic to which this rule applies. It can be <ANY>, a zone, a list of networks, IP addresses or MAC addresses.
The destinations of the traffic to which this rule will be applied. This can be either <ANY>, a zone, or a list of networks, IP addresses, or domains.
Decide whether the rule has effect on specific days and/or a time period. By default a rule is always active, but its validity can be limited to either an interval or to some days of the week.
By ticking the checkbox, the following options become available:
Select one ore more days of the week.
Hint
To select two or more days, hold the CTRL keys and click the mouse button on the name of the day.
To fine-tune the interval of the day during which the access policy is active, select the start and end times from these drop-down menus.
The allowed clients and browsers, as identified by their user agent, i.e., their identification string.
A list of the MIME types of incoming files that should be blocked, one per line. MIME types can only be blocked (i.e., blacklisted) but not allowed (i.e., whitelisted), therefore this option is only available in Deny access policies. This option allows to block any files not corresponding to the company policy (e.g., multimedia files).
Select whether the rule should allow or deny the web access from the drop-down menu . When set to Deny access, the Mimetypes option above is activated.
Whether the rule is enabled or disabled. Disabled rules will not be applied, the default is to enable the rule.
This drop-down menu, available when the Access policy has been set to Allow access, allows to select what type of check should the rule perform. Available options are: none for no check and virus detection only to scan only for viruses. Moreover, if any content filter profile has been created (see below), it appears as an option and can be applied to the rule.
The place where the new rule should be inserted: Lower positions have higher priority.
The Endian Hotspot Appliance's content filter abilities are based on the Cyren URL filtering solution, that uses two filtering techniques which can be customised for each filter profile.
The first one consists of an advanced method of web pages categorisation, based on their content, while the second method uses a combination of white- and blacklists URLs and domains: All the URLs requested by a client are looked up in this list and are only served if they are found in the whitelist.
Note
If the system has not yet been registered to Endian Network, the URL filter lists can not be downloaded. In this case, an informative message appears: By clicking on it, the registration form will open.
A profile is needed to be able to use the content filter. There is a Default profile available, which allows access to every web page and should never be deleted. Additional profiles, that are needed when defining new access policies, can easily be created.
On the page, there is a list of the existing profiles, accompanied by a remark and by the available actions.
Above the table, there is a Add new profile link: When clicked, the link is replaced by the Profile Editor, that is used to configure a new profile, with the list of existing profiles shifting to the bottom of the page. The following settings can be defined:
The name given to the profile.
Enable the antivirus in the content filter.
In this multiselect box it is possible to enable the SafeSearch Enforcement functionality for the supported search engines, which currently are:
Bing
DuckDuckGo
Yahoo
Yandex
SafeSearch Enforcement
With the use of the standard web filtering functionality it is already possible to filter inappropriate web sites for children or students. However, this does not affect results such as the preview images from the search engines.
These images are indeed cached and it is impossible to know from which website they have been retrieved; therefore the category-based filter cannot blocked them. To still be able to block inappropriate or offensive content many search engines include a SafeSearch functionality that, when enabled, will simply not include these results.
Since most search engines today are automatically using HTTPS, to it is necessary to enable the HTTPS Proxy.
The next settings come in form of panels, that can be expanded or
collapsed by clicking on the or icons to the left
of their title.
Choose the categories to activate for applying the content filter. On
the far right of the category’s name, icons show if the contained
items are being considered 
or not 
for content
filtering, or partially allowed 
. Those arrows can be clicked
to quickly toggle the status of all the items.
Each category contains additional sub-categories, accessible by clicking on the category’s name,that can be individually selected.
The description of the sub-categories can be found on Cyren’s website.
In these textfields, personalised lists of web pages can be added.
Web pages that are whitelisted, i.e., always served to the client.
Web pages that are blacklisted, i.e., never served to the client.
Content filtering may cause both false positives and false negatives, hence list domains that should always be blocked or allowed can be entered here. This policy will be applied regardless of the results of the content filter’s analysis.
New in version 5.0.5: URL Filtering option.
In this page it is possible to configure the HTTPS proxy server and the way it intercepts and applies content filtering to SSL-encrypted traffic, i.e., traffic through the 443 port.
The page is initially divided in three panels, the first one to choose the operating mode of the HTTPS proxy, the other related to the certificate needed in the Decrypt and scan mode.
Choose form the drop-down menu how the proxy should analyse the HTTPS encrypted traffic. The following options are available:
Disabled. The HTTPS proxy will not analyse the traffic.
URL filtering only. In this modality, described below, the HTTP proxy will only apply content filtering to the pages, but not decrypt them.
Decrypt and scan. The HTTPS proxy will decrypt and fully inspect the pages.
Once the modality has been chosen, click on Save, then on the Apply button in the green callout.
The URL Filtering mode
The URL Filtering mode allows to apply content filtering to HTTPS pages in a less invasive way compared to the Decrypt and scan mode; it is also easier to deploy, but it can be less effective. In details, this are the differences from the Decrypt and scan mode:
No need to install certificates on the clients. This means that the traffic will not be decrypted.
As a consequence, there will be no antivirus check on the HTTPS pages.
When a page is blocked by the proxy, the browser will receive a Connection refused error message.
Whitelists and Blacklists for both the HTTPS and HTTP Proxies are defined in the Access policy and Web Filter tabs.
To correctly allow the URL Filtering mode to operate, the clients using the proxy must be configured to use the Endian Hotspot Appliance as their DNS server. If they do not, then the DNS Proxy must be enabled on the Endian Hotspot Appliance for all the zones that use the HTTP(S) Proxy.
When enabled as Decrypt and scan mode, squid will intercept all clients’ requests and forward them to the remote server, like in the case of HTTP requests. The only difference is that for HTTPS requests, an intermediate certificate is needed for the client to connect via HTTPS to the Endian Hotspot Appliance, which then can deliver the request, retrieve the remote resource, control it, and then send it to the client who requested it.
The following additional options are available for this mode:
This option allows the Endian Hotspot Appliance to automatically accept all the certificates from the remote server, even those that are not valid or outdated.
When this option is used, the HTTPS traffic will be managed directly by the upstream proxy, otherwise it is managed by the Endian Hotspot Appliance.
Note
This option only works if an upstream proxy has been defined in the upstream proxy (See ).
Write in the textfield the IP address or domain names of remote web sites that should be not be checked by the HTTPS proxy, one per line.
The two panels at the bottom are used only for the Decrypt and scan mode and allow to manage the certificate that will be used by the Endian Hotspot Appliance.
Warning
The upload or the creation of a new certificate implies to invalidate any previously uploaded or created certificate. It will also be necessary to deploy the new certificate to all the clients.
To use an existent certificate, click on Browse…, choose the certificate on the local hard disk, then click on Upload to copy the certificate to the Endian Hotspot Appliance.
To create a new certificate from scratch, click on this button. A confirmation dialog box appears, requiring a confirmation. Click on OK to proceed or on Cancel to close the dialog box and go back.
After the certificate has been uploaded or created, a new option in the form of a hyperlink will appear next to the Upload proxy certificate label:
Click this hyperlink to download the certificate, which will be needed by the the clients.
See also
In the knowledge base these tutorials are available:
How to set up the HTTPS proxy (only decrypt and scan mode),