Select Proxy from the menu bar at the top of the screen.
A proxy is a service on your Endian UTM Appliance that can act as a gatekeeper between clients (e.g. a web browser) and network services (e.g. a web server on the internet). Clients connect to the proxy which in turn can retrieve, cache, filter and potentially block the information from the original server. A proxy is called transparent if all traffic goes through it, of the client’s configuration. Non-transparent proxies hence rely on the collaboration of the client (e.g. the proxy settings of your web browser).
Following is a list of proxies that are available on Endian Firewall. Each proxy can be configured via the links that are in the submenu on the left side of the screen:
Each section will be explained individually below.
Select Proxy from the menu bar at the top of the screen, then select HTTP from the submenu on the left side of the screen.
Click on the Enable HTTP Proxy toggle to enable the HTTP proxy (Endian UTM Appliance uses the Squid caching proxy). Once the proxy is up and running, a number of controls appear.
First of all, you can define the way users in each zone (GREEN and, if enabled also ORANGE, BLUE) can access the proxy. Per zone choices are:
Note
If you want to disable the proxy for a certain zone you must set it to transparent in this zone and add the zone’s subnet to the Bypass transparent proxy from SUBNET/IP/MAC field in the Bypass transparent proxy section.
Some browsers, including Internet Explorer and Firefox, are able to automatically detect proxy servers by using the Web Proxy Autodiscovery Protocol (WPAD). Most browsers also support proxy auto-configuration (PAC) through a special URL. When using an Endian UTM Appliance the URL looks like this: http://<IP OF YOUR FIREWALL>/proxy.pac.
Next, comes a section with global configuration options:
Then you will find a number of additional options, each in its own panel that can be expanded by clicking on the + icon:
Allowed Ports and SSL Ports
Log settings
Bypass transparent proxy
Cache management
Upstream proxy
Click the Save button to confirm and save the configuration changes. Do not forget to click the Apply button to restart the proxy for the changes to become active.
Endian UTM Appliance‘s proxy supports four different authentication types: Local Authentication (NCSA), LDAP (v2, v3, Novell eDirectory, AD), Windows Active Directory (NTLM) and Radius. Each of these types needs different configuration parameters and is described below. However, the global configuration parameters are:
The following parameters are available for local authentication.
The following parameters are available for LDAP authentication.
The following parameters are available for Windows authentication.
In order to be able to use Windows’ native authentication with active directory (NTLM) you have to make sure that a few conditions are met: - The authentication settings need to be saved and applied before trying to join the domain. - The firewall must join the domain. - The system clocks on the firewall and on the active directory server have to be in sync. - The realm must be a fully qualified domain name. - The PDC hostname has to be set to the netbios name of the Active Directory server.
Since version 2.3 of Endian UTM Appliance it is not necessary to create Host and DNS proxy entries anymore. They will be auto-generated when the authentication settings are applied.
The following parameters are available for Radius authentication.
The access policy is applied to every client that is going through the proxy, regardless of its authentication. Access policy rules are time-based access policies based on source, destination, authentication, useragents, mimetypes and virus scanning / content filtering.
You can view your own rules in the Rule list. Any rule can specify if web access is blocked or allowed, in this last case you can activate and select a filter type. To add a new rule just click on Create a rule and the following settings can be performed:
Since version 2.3 of Endian UTM Appliance it is possible to create multiple Contentfilter profiles with different filter and antivirus settings. Since this release it is also possible to whitelist e.g. a domain just for a certain user/source by creating an access policy rule.
You can then change priority, edit, enable/disable or delete each rule from the list of rules by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom).
To be able to use the content filter, you have to use a Contentfilter profile in an access policy rule. Endian UTM Appliance‘s Content Filter (DansGuardian) uses three filtering techniques which can be defined per filter profile.
The first is called PICS (Platform for Internet Content Selection). It is a specification created by W3C that uses metadata to label webpages to help parental control. The second is based on an advanced phrase weighting system, it analyzes the text of web pages and calculates a score for each page. The last method uses a huge blacklist of categorized URLs and domains. All requested URLs are looked up in this list and are only served if they are not found.
The screen is divided into a general configuration section and a section where the specific filtering policy can be chosen.
Phrase analysis requires much more computing power than other technologies (PICS and URL blacklist). If you wish to disable this filtering technique you can mark all categories as allowed in the Content Filter section.
When whitelisting a domain always make sure to whitelist all necessary domains for that site to work as well. An example:
Click on Save to save the settings of a content filter profile.
You can then edit or delete each rule from the list by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom).
In this section you can configure the virus scanner engine (ClamAV, since version 2.3 Sophos Antivirus is also available) used by the HTTP proxy.
Click on Save to save the settings of the virus scanner engine.
In this section you can join the Active Directory Server. This is only possible when Authentication is set to Windows Active Directory (NTLM).
Select Proxy from the menu bar at the top of the screen, then select POP3 from the submenu on the left side of the screen. In this section you can configure the POP3 (incoming mail) proxy.
On this page you can configure the global configuration settings of the POP3 proxy. You can enable or disable the POP3 proxy for every zone. It is also possible to enable the Virus scanner and the Spam filter for incoming emails. If you want to log every outgoing POP3 connection you can enable the Firewall logs outgoing connections checkbox.
On this page you can configure how the POP3 proxy should react once it finds a spam email.
Select Proxy from the menu bar at the top of the screen, then select FTP from the submenu on the left side of the screen.
The FTP (File Transfer Protocol) proxy is available only as transparent proxy, this allows scanning for viruses on FTP downloads.
Note
Only connections to the standard FTP port (21) are redirected to the proxy. This means that if you configure your clients to use the HTTP proxy also for the FTP protocol, this FTP proxy will be bypassed!
You can enable the transparent FTP proxy on the GREEN zone and on the other enabled zones (ORANGE, BLUE).The following options can be configured (confirm the settings by clicking Save).
If you have another NATing firewall or router between Endian UTM Appliance and the internet, frox does not work because it uses an active FTP upstream.
Select Proxy from the menu bar at the top of the screen, then select SMTP from the submenu on the left side of the screen.
The SMTP (simple mail transfer protocol) proxy can relay and filter email traffic as it is being sent towards email servers.
The scope of the SMTP proxy is to control and optimize SMTP traffic in general and to protect your network from threats when using the SMTP protocol. The SMTP (Simple Mail Transport Protocol) protocol is used whenever an email is sent by your mail client to a remote mail server (outgoing mail). It will also be used if you have your own mail server running on your LAN (GREEN interface) or your DMZ (ORANGE interface) and are allowing mails to be sent from the outside of your network (incoming requests) through your mail server. The SMTP proxy configuration is split into several subsections.
Warning
In order to download mail from a remote mailserver with your local mail clients, the POP3 or IMAP protocol will be used. If you want to protect that traffic too, you have to enable the POP3 proxy in Proxy, POP3. Scanning of IMAP traffic is currently not supported. With the mail proxy functionality, both sorts of traffic (incoming and outgoing mail) can be scanned for viruses, spam and other threats. Mail will be blocked if necessary and notices will be sent to both the receiving user and the administrator. With the possibility to scan incoming mail, the mail proxy can handle incoming connections and pass the mail to one or more internal mail servers. This allows you to have your own mail servers running behind the firewall without the need of port forwards.
The is the main configuration section for the SMTP proxy. It contains the following options:
Then you will find a number of additional options, each in its own panel that can be expanded by clicking on the + icon:
In general the Spam settings section gives you the ability to configure spamassassin and amavisd-new which are used to filter out spam. SpamAssassin provides several means of detecting spam. It has a score tally system where large numbers of inter-related rules fire off and total up a score to determine whether a message is spam or not.
Choose between:
Note
While most simple spam mails such as well known spam messages and mail sent by known spam hosts are blocked, spammers always adapt their messages in order to circumvent spam filters. Therefore it is absolutely necessary to always train the spam filter in order to reach a personalized and stronger filter (bayes).
Virus settings is one of the main sections of the SMTP proxy module. Four different actions can be performed when a mail that contains a virus is received. It is also possible to configure an email address for notifications.
Choose between:
In the File settings section the SMTP proxy also allows you to block files with certain file extensions which may be attached to mails. Mails which contain such attachments will be recognized and the selected action will be performed for the respective mail.
Choose between:
You need to configure the email domains for which the server should be responsible. You can add the list of domains in the Proxy, SMTP, Incoming domains section.
Bypass transparent proxy
To save and apply the settings you must click on the Save button.
You can create custom black- and whitelists by adding entries to the fields in the Accepted mail (Black- & Whitelists) section to explicitely block (blacklist) or allow (whitelist) certain senders, recipients, IP addresses or networks.
Examples for recipient/sender black- and whitelists:
example.com
.example.com
info@example.com
admin@example.com
Examples for client black- and whitelists:
example.com
192.168.100.0/24
An often used method to block spam e-mails are so called Realtime Blacklists (RBL). These lists are created, managed and updated by different organisations. If a domain or a sender IP address is listed in one of the blacklists, emails from it will be refused without further notice. This saves more bandwith than the RBL of the antispam module, since here mails will not be accepted and then handled, but dismissed as soon as a listed IP address is found.
Warning
Sometimes it can happen that IP addresses have been wrongly listed by an RBL operator. If this should happen, it may negatively impact on your communication to the extent that mail will be refused without the possibility to recover it. You also have no direct influence on the RBLs.
Note
Advanced users can modify the list by editing the file /var/efw/smtpscan/RBL (use /var/efw/smtpscan/default/RBL as draft).
You can create greylisting whitelists by adding entries for every recipient, IP address or network.
You can create black- and whitelists for the spam filter by adding entries here.
Save the settings and restart the SMTP Proxy by clicking the Save button.
If you have enabled incoming mail and would like to forward that mail to a mail server behind your Endian UTM Appliance - usually set up in the GREEN or ORANGE zone - you need to declare the domains which will be accepted by the SMTP proxy and to which of your mail servers the incoming mail should be forwarded. It is possible to specify multiple mail servers behind Endian UTM Appliance for different domains. It is also easily possible to use Endian UTM Appliance as a backup MX.
To add a domain click the Add button. To apply the changes the SMTP proxy has to be restarted by clicking on the Save changes and restart button. Existing entries can be edited and deleted by clicking on the respective icon (as described in the legend at the bottom of the page).
This option allows you to send a blind carbon copy (BCC) to a specified email address. This option will be applied to all emailsthat are sent to the specified recipient address or are sent from the specified sender address.
The mail route is saved by clicking on the Add mail route button. Existing entries can be changed or deleted by clicking on the respective icons which are explained in the legend at the bottom of the page.
Warning
Neither the sender nor the recipient will be notified of the copy. In most countries of this planet it is highly illegal to read other people’s private messages. Do not abuse this feature.
On this page you can configure the advanced settings of the SMTP proxy. In the Smarthost section the following options can be configured:
Note
If you have a dynamic IP address because you are using an ISDN or an ADSL dialup internet connection you might get problems sending mails to other mail servers. More and more mail servers check whether your IP address is listed as a dynamic IP address and therefore might refuse your emails. Hence it could be necessary to use a smarthost for sending emails.
Note
A smarthost is a mail server which your SMTP proxy will use as outgoing SMTP server. The smarthost needs to accept your emails and relays them for you. Normally you may use your provider’s SMTP server as smarthost, since it will accept to relay your emails while other mail servers may not.
In the IMAP Server for SMTP authentication section you can configure which IMAP server should be used for authentication when sending emails. Most of all this is important for SMTP connections that are opened from the RED zone. The following settings can be configured:
In the Mail server settings section additional parameters of the SMTP server can be defined. The options are:
In the Spam prevention section additional parameters of the SMTP server can be defined. The options are:
The settings are saved and applied by clicking on the Save button.
New in version 2.3.
On this page you can configure the settings of the Commtouch anti-spam engine. The following options can be configured:
In the SPAM tag level section the following options can be configured:
The settings are saved and applied by clicking on the Save button.
Select Proxy from the menu bar at the top of the screen, then select DNS from the submenu on the left side of the screen.
In this section you can change the settings for the DNS proxy. It is divided into three subpages.
On this page you can enable the transparent DNS proxy for the GREEN, ORANGE and BLUE zones (if they are active). You can also define for which source addresses the proxy will be bypassed in the lower left textarea. These sources can be IP addresses, addresses of subnets and MAC addresses (one per line). In the lower right textarea you can enter destinations for which the proxy is bypassed. In this textarea IP addresses and addresses of subnets can be entered. To save the settings you must click on the Save button.
On this page you can add custom nameservers for specific domains. You can add a new custom nameserver by clicking on the Add new custom name server for a domain link. To change an existing entry you have to click on the pencil icon in its row. Clicking on a trash can icon will delete the custom nameserver in that row. The following details can be saved for custom nameservers:
On this page you can configure how your Endian UTM Appliance should react if a domain name has to be resolved that is known to be used by spyware. The options that can be set are:
The settings are saved and applied by clicking on the Save button.
Enter search terms or a module, class or function name.