Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed dansguardian in my Linux server. Everything works well except one thing: if a user sets a different proxy (outside my LAN) in his browser, he'll be able to bypass dansguardian. Can anybody help me on how to prevent this?

EDIT: I have on my server an access controller - ChilliSpot - that listens to all requests did on port 80. And that controller redirects all requests did to it towards dansguardian. So, I think that should be enough, but it isn't. Any thoughts on what should I do more.

N.B. I'm more like a 'Linux' newbie (even if I'm not just a newbie to 'Linux') than like a Linux guru.

share|improve this question
3  
Do you allow outbound connections from your network ? You shouldn't if you want to enforce using the content filter. –  drcelus Aug 24 '12 at 9:48
1  
As mentioned below, you should block connections from your LAN to the WAN. Chillispot will not deny these connections it just acts as an access control, but you should make sure (using IPTABLES) that direct connections from inside your network to the internet are not allowed. –  drcelus Aug 24 '12 at 10:07
    
@drcelus You're right, but if you consider that I set ChilliSpot to proxy all traffic to dansguardian (from chilli.conf), then I consider that direct connections to internet are not allowed. I think that I have a hole in my judgment, but where is it? –  artaxerxe Aug 24 '12 at 10:21
    
Just try to telnet to the outside from one of your clients, if it succeeds, then you should check your firewall. Try port 8080, it is widely used by proxies. –  drcelus Aug 25 '12 at 20:00
    
@drcelus I resolved it. There was a rule in my firewall in additon to Chilli's rules. I only removed it and now everithing works great! –  artaxerxe Aug 27 '12 at 5:16
add comment

1 Answer

up vote 2 down vote accepted

You should setup your firewall to block ports 80 and 443 so he is forced to use your proxy to get to the internet

share|improve this answer
1  
While that is a good starting point there are plenty of proxies running on other ports, specifically to get around such restrictions. –  John Gardeniers Aug 24 '12 at 9:50
2  
Ok. Perhaps my answer should be to block all outbound traffic –  Lock Aug 24 '12 at 9:52
    
@Lock see my edit –  artaxerxe Aug 24 '12 at 10:01
    
@Lock yes, drop all TCP/UDP connections except for the proxy server. –  gravyface Aug 24 '12 at 11:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.