Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had this conversation with a colleague about preventing viruses/trojans from accessing the internet from within a corporate network. He says that a proxy server for http traffic with an unusual port would be an effective barrier. In my opinion, the viruses now are smart enough to figure the way out by using browser settings or in a similar fashion. Now we use NAT, so we are trying to figure out whether it is worthwhile to implement a proxy. Cons are that notebook user would have to change their browser settings every time they are connecting from anywhere beyond the corporate network.

So the questions are:
1) how effective would be a proxy server with an unusual port compared to NAT to disallow viruses/worms access the internet
2) if we do implement the proxy solution, what is a convenient way to switch browser settings for notebook users?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

You can setup a proxy server with virus/malware scanning. Here is an small howto, using squid (proxy server), clamav (antivirus), and HAVP, and small proxy used to detect malware. You can do this just with squid + clamav, but whit HAVP you can obtain better results.

http://www.opensourcehowto.org/how-to/squid/squid-clamav--havp.html

About users, you can setup the proxy as transparent, so no need to reconfigure anything on clients:

http://tldp.org/HOWTO/TransparentProxy-5.html

share|improve this answer
    
Thanks, I guess I will try this approach. Somehow before I was thinking of a proxy server as of a caching proxy only and nothing more, forgetting that such functions as content filter, antivirus, etc. can and should be added. Making it a transparent proxy is also what I need. –  kdl Jan 21 '10 at 9:13

i agree with you, that worms or other malware nowadays are smart enough to get the right proxy settings to connect to the internet. but anyway it could be a good idea to use a proxy when you deny all other internet connections. this way you have a central access point to the internet which could be combined with anti virus software, intrusion detection or other security software. all of them seem to be for incoming traffic but can also be used for outgoing traffic. this would give you two points to fight the malware, first incoming traffic (prevent worms from being installed) and outgoing traffic (prevent worms from spreading). you should also improve security on the laptops, to prevent that the laptops get infected on other networks.

there are different opportunities for your users:

  • use a proxy switcher like foxy proxy for firefox.
  • configure the clients in such a way, that the proxy is only used when inside the corporate network
share|improve this answer
    
there is a central access point to internet in any case, since we use a gateway and the question is whether to add proxy functions to it. filtering outgoing traffic is a good idea.<br>and browser proxy settings allow using proxy for LAN, but it cannot tell corporate network from a home or hotel network. –  kdl Jan 19 '10 at 12:32
    
as i understand Jasons and sntgs answers, you could add their solutions to your gateway. this way there should be no problem with home or hotel network. –  Christian Jan 19 '10 at 16:26

Untangle is another open source option and it doesn't require any client side changes. http://www.untangle.com/web-filter for example.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.