0

I am trying to get example 2 on this page: http://www.squidguard.org/Doc/examples.html working thru the IPFire interface, with the addition that the rule is applied only during a time constraint period. In English: I want a "whitelist-only" access policy within a time contraint.

It's easy to get the desired policy working as the default (simply check "Block all URLs not explicitly allowed:" under Advanced Settings on the "url filter settings" page), but this makes the whitelist-only config permanent, i.e., regardless of time contraints.

The closest I've gotten is using "blocked expressions", and putting in an expression that catches anything that might go into the URL line. But the resultant behavior is unacceptable: instead of getting the default "Access Denied" page almost instantly, the page just spins until finally it times out and I get an error from the browser (i.e., NOT from the IPFire server) that it can't load the page.

I have also tried writing directly to the squidGuard.conf file, but that gets overwritten every time I save my settings thru the IPFire web interface.

1 Answer 1

1

I think I may have figured out how to do this through the GUI although it is somewhat convoluted. Here's what I did: In the main Content Filter page under custom blacklist enter: com (new line), net (new line), edu (new line), gov (new line), org (new line), xxx (new line), uk (new line), (etc) to blacklist everysite (if you know a better way say block . I would love to know!) DO NOT ENABLE the "Enable custom blacklist:" box

Right below under white list enter the sites you want to allow. Click ENABLE CUSTOM WHITELIST. Save and restart here.

Then go under "Set Time Constraints" and enter at which times you want to allow the whitelist, the subnet you want to filter but under constraints select only custom-blocked and access: block

This will block everything except what is on the 'whitelist' during the hours you want. Only problem is that it will white list your sites for everyone but it won't blacklist everything for everyone else. If you can live with that, then this just might work for you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .