Transcription
In this video, I'm going to show you how to configure the transparent proxy and web filter features on your OpenSense firewall. Let's jump straight in.
[Music]
[Music]
Hey guys, I'm Lal and welcome back to my channel. So, if you've been following my virtual layer building series, you'll be aware that we're currently building a lab around the fictional company Morgan Maxwell Real Estate. And in the previous videos that I've done in this series, I've showed you how to set up OpenSense as well as configure the IDS and IPS features on OpenSense. And today, we're going to continue with setting up the transparent proxy features as well as web filtering features.
So, in this scenario, Morgan Maxwell, the principal agent of Morgan Maxwell Real Estate, has approached us with a problem where he's noticed that many of his staff members are wasting time during the day when they're supposed to be working on social networking and social media pages. So, knowing that we've put a firewall in for him, he's asked if it's possible, if there's a way that we can put some sort of restriction in place to limit the usage or the access to those sort of websites.
So, this is where the transparent proxy features on OpenSense comes into play. So, for those of you that don't know what a proxy is, in the case of OpenSense, the proxy features are based on a very well-known and well-established proxy called Squid Cache. And basically, the features that Squid offers us is the ability to have a local proxy cache on-site. What this means is that all the web traffic that goes through our proxy will be stored. Portions of it will be stored, like the images and things that would generally be static. And if these websites are frequently accessed, instead of the client web browser having to query the server directly every time where that web page is hosted, it'll pull some of that content directly out of the proxy cache stored on-site. So, this gives us the benefit of having quicker page load times.
Another great feature of Squid is called SquidGuard. And this is a web filtering feature that allows us to control and filter what our end users are able to see when they surf the web. Overall, the main benefits of using this proxy is then so we can have some sort of traffic optimization on our network.
So, to start with the installation, the first step is that we're going to have to create a trusted Certificate Authority on our OpenSense firewall. This Certificate Authority is needed for when we are doing the SSL transparent proxy setup. So, to start with this, we will go through to System and we'll go to Trust and we'll go to Authorities. And in here, we will click Add. And then we're going to give our certificate a descriptive name. So, we will call it something like OpenSense Web CA. And we're going to create an internal Certificate Authority. We'll leave all these key types, key lengths, digest algorithm, and lifetime all as normal, or as default, rather. And then we're going to choose our country. So, we'll just say we'll scroll down to the US and we'll give it some basic information. So, we'll just use State, New York, City, New York, Organization, we'll call it IT, and we'll just include the email as its morganmaxwell.com. And the Common Name, we will just use the same as what we did above, just we'll change it to all lowercase. And we'll click Save.
So, you'll see that the certificate has now been created and it's a self-signed certificate. Then, what we need to do is we need to install the certificate on our Windows computer or on our client machines, then, so it can trust our OpenSense firewall as the proxy. So, there's a couple of ways that we can do this. We can do a manual deployment like we're doing now, where we will download the CA and then install it manually. You can also install it if you're in a Windows environment using a Group Policy Object or GPO. And other ways you could do this, you could use the Active Directory Certificate Services to deploy these sort of certificates as well.
So, what we're going to do first is, because this is just a lab, we're going to export the CA. And it will download it. And we'll just say Keep. And you can see that we've downloaded the certificate. And then we're going to go to where it was saved in the downloads. We're going to right-click on it and we're going to say Install Certificate. You're then going to click on Open and you're going to install it on the local machine. And you're going to click Next and you're going to say Yes. And it's going to bring the Certificate Import Wizard up. And then we're going to choose where we want to place that certificate. So, we'll say Place all certificates in the following store. And we'll click Browse. And we'll include it in the Trusted Root Certificate Authorities folder. And we'll click OK. Once that's done, we'll click Next. And it just gives us a summary of the completed settings. And we'll say Finish. And then the certificate has been successfully installed on our system. We'll click OK and we're done with that.
So, the next part of the installation is we need to enable the web proxy. So, we're going to head over to Services, we're going to go to Web Proxy, and Administration. And over here, we're just going to simply click on Enable proxy. And we can just leave the error pages squared or OpenSense. I'm just going to put in OpenSense. And we're going to click Apply. Now, you'll see that we have those very familiar control icons in the top right corner where you can start the service, restart it, or stop it.
So, the next part of the installation is we need to configure the transparent proxy features. So, in order to do this, we're going to go to the Proxy Forward tab and we are going to start our configuration here. So, the proxy interface that we're going to be using is the LAN. We'll leave that as default. Then, the proxy port is going to be 3128. We'll also leave that one as default. And in this case, we're going to, if you click on the little 'i', it'll give you a bit of information about the transparent proxy mode. So, this is what we want. We're going to enable the transparent proxy for HTTP traffic. And then, what we need to do is, if you read this little bit of information, and it says "Enable transparent proxy mode, you will need a firewall rule to forward traffic from the firewall to the proxy service." So, in order to do this, they've given us a little quick button here to click. We just click on that. And then they pre-populate a rule first. So, this just creates a port forwarding rule that basically says any HTTP traffic needs to be forwarded through to our proxy server, which is running on this local machine, which is 127.0.0.1 on port 3128. And its destination port range is HTTP. It gives us a description already, which is "Redirect proxy traffic." Everything else, we're just going to leave as default. This will work in most cases. And we're going to click Save. And you'll see the rule has been added. And we're going to click Apply Changes.
Then, we're going to head back to our Services and to our Web Proxy Administration and to the Proxy Cache Forward Proxy. And we're going to enable the proxy. We're going to enable SSH inspection. The SSH inspection is basically just the HTTPS proxy or transparent proxy service. And we're not going to log anything. This SSL port or proxy port is 3129. And because we're doing this SSL proxy, we need to tell it which certificate we're going to be using. So, we'll click on the OpenSense Web CA certificate that we created earlier. And then the SSL bump sites. Now, this is quite an important feature. Basically, what happens is when you set up an SSL proxy, OpenSense acts as like a man-in-the-middle between the client and the destination where it's trying to get to. So, you have to be very careful when you configure this particular feature. Because, let's just look at like a banking website, for instance. A banking website might consider you standing in between the connection as being malicious. Technically, it could be considered a man-in-the-middle type attack. So, you have to be very cautious when using this SSL proxy. So, this is where the bump sites come in with SSL. When you have a no-bump site, you can include URLs and all their subdomains that you don't want to allow to be proxied through your SSL proxy. So, it'll bypass the proxy and then it keeps the communication untouched, essentially. In this case, it's recommended that we exclude anything bank-related and so forth. So, just do keep that in mind.
What I will do is put in the description below a bit of information on the OpenSense website that explains how these SSL bump sites work in a little bit more detail. Some other warnings here, which OpenSense has put out, is that you need to make sure that your keys that you've created, your certificate keys that you've created on OpenSense, never get into the hands of the wrong people. Because what will happen is, if they have access to these keys and they can intercept this connection, they will be able to decrypt the traffic between the OpenSense firewall and its destination, which then actually renders this insecure. So, it's very important to be very cautious when using this feature.
So, once all those configurations have been made, we're going to then click Apply. And you're going to have to give it a few minutes just so it can configure itself. It usually takes about 30 seconds to a minute to configure. So, once it's finished applying, you'll see that you'll be ready and the service will have started.
So, the next part of the installation, we're going to be moving to setting up the web filtering part of this proxy setup. So, before we do anything, we need to make sure that any authentication has been disabled on our proxy. So, we're going to click on this little dropdown on the forward proxy section and we're going to go to Authentication settings. Here, you need to make sure that nothing has been selected. In this case, by default, it doesn't have any of those things configured. But just double-check on your installation that that is the case. If you're curious to know what these sort of settings do, in some cases, you may want to set up your proxy that every time somebody goes on to the internet or opens their browser, that they have to type in a username and password in order to access the browser or to access be able to go into the web. So, this is where this authentication comes into play. In some companies, they request that you do this in order to access the internet, like an enhanced security feature. However, because we're going with a transparent proxy feature, we don't need this.
Next step is, we're going to head over to the Remote Access Control Lists and we're going to hit the little Add or plus button. And it's going to bring us a dialog box where we can input some information about a blacklist. So, in this case, we're going to enable it. We're going to give it the file name as UT1. The URL that we're going to be using is from the University of Toulouse. And they have a department and people there that are updating this list that we use. This blacklist is available. I'll put the link in the description below. And it's one of them that were recommended by OpenSense in the documentation. There are also various commercial and paid options that you can include depending on your requirements. So, in this case, we're just going to put in that URL, which is this FTP, which points to their blacklist. It's also a free one to use. We're going to leave the username and the password as optional. And because we haven't downloaded it yet, there's going to be no categories available for us to use. And everything else here, we're just going to include just a brief description. We'll say UT1 Web Filter. And we'll leave the SSL ignore cert as is. And we'll click Save.
So, once that's done, we will then click on Download ACLs. This is about a 20 meg file, so it'll take a few seconds to download. And also, what will happen is the system has to convert all these blacklist rules into ones that Squid can understand. So, there'll be a little bit of a delay while it does this configuration initially.
So, once it's downloaded all the ACLs, the Access Control Lists, and categories, we're going to head back to the Edit button. And you'll now see that if we go to the Categories list, we have a whole lot of categories available to us, ranging from Adults to Chat, Cooking, Crypto Jacking, etc. I'll put the list of all of the blacklists into the description. You can go and check those out. So, in our case, because our directive was just to block social media, we're going to then click on Clear All. And we're going to say Deselect Removal Items. And it will unselect all the categories. And we're just going to scroll down to Social Media or Social Networks. We're going to click on that one. And then we're going to click Save. And in order to apply this, we need to then click Download ACLs again. And then you'll just let it run its course. And then once it's done, we're just going to click on Apply. And it will immediately apply the rules.
So, the final stage of the setup is we need to set up the firewall to prevent people from potentially bypassing the proxy. So, to do this, we're going to head over to the Firewall rules. So, we'll click on Firewall and we'll go to Rules. And because we need to apply it on our LAN, we're going to go to the LAN rules. And then we are going to click on the little Add button. And we're going to set up our rule. So, our action is to Block. The interface is our LAN. It's coming into our LAN. We are going to then select our protocol to be TCP and UDP. The source can be, the source needs to be the LAN net, so that's where it's coming from, our LAN network. And the destination, we can leave as anything. And then the port range we're going to be looking at is just HTTP. So, we can just type in HTTP. And then the category for this one, we're just going to call it, um, Block Proxy Bypass. And the description, we'll call it Block Block HTTPS.
We're going to leave everything else as default. And we're going to click Save. Then, what we're going to do is we're going to select this rule that we've just created. And we're going to click on the little Clone button. And then the only changes we're going to make over here is to the destination port range. We're going to set this to HTTPS. And we're just going to name it HTTPS. And we're going to click Save.
So, you can see we have these two rules that have been created, one to block port 80 or HTTP, and one to block HTTPS or port 443. So, the way that firewall rules work on OpenSense, it always works on like a first-match basis. So, these rules will need repositioning. Because if you look at how it's set up at the moment, if it's a first-match basis, it means that these rules above it, these allow rules, will always take preference before the block rules. So, to reposition it, what we will do is, we're going to select the rule that we want to move up. And then we're going to go above this IPv6 rule over here. And if you hover over this little arrow, it says "Move selected rule before this rule." So, we'll click that. And you'll see there, it then moves up the rule above that rule. We're going to repeat the same for this HTTPS rule. We're going to click on that. And we're just going to say Move rule above. And then they are all above. And they will be actioned first before any of the rules below them.
Just something that's hidden here, if you click on this little dropdown, you'll see that there is this Anti-lockout rule. Just make sure that you never put anything above your Anti-lockout rule that potentially can block those ports. So, if we had to take HTTP and put it above this Anti-lockout rule, that means we wouldn't be able to access our web GUI. And it would then lock us out of the system. So, just be aware of that. Best to just keep that minimized. And then you won't have any issues overwriting that rule.
So, we're going to head back to our Services and to our Web Proxy and Administration. Now that everything is set up, we're going to then just do a restart the service. So, once the service has been restarted, then we have a fully configured web proxy that is running in the transparent mode. So, our browsers don't need any configuration in order for this proxy to work correctly.
So, what we'll do is, we're going to open up another fresh tab. And you can see our general Google and those things would work correctly. So, for instance, if you went through to say, my website, you'd see that that website works. There's no issues there whatsoever. So, let's say the user wants to go on to Facebook. Go type in www.facebook.com. And you'll see immediately that OpenSense has returned an error saying "Access Denied" and that it's part of the access control configurations that prevents them from accessing this particular website.
So, just to do a quick recap of this video, we've set up a transparent proxy and web filtering features on OpenSense. We've configured CA in order to make this work, a Certificate Authority. We have created some firewall rules to prevent people from bypassing the proxy, as well as some port forward rules to make sure that machines always go through the proxy. We discussed a few other alternatives such as authentication instead of using a transparent proxy mode. And we have applied a blacklist filter that was provided to us by the University of Toulouse. We then demoed and checked to see if we could access any of these websites. And we saw that they were blocked immediately. And we've completed all objectives of this lab that were put out to us by our client, Morgan Maxwell Real Estate.
I hope you are all enjoying the series that I'm doing so far. And if that's the case, please do give me a thumbs up. And don't forget to subscribe to my channel. It would be greatly appreciated. As always, if you have any comments or any questions about the labs, please feel free to put it in the comment section below. And I'll answer any of those questions to the best of my ability. Also, don't forget to check back soon. I'm going to be posting more videos into this series in the coming weeks. So, you guys don't want to miss out on any of those. Thanks again for watching. I'll see you guys soon. Cheers for now.
[Music]