2

At my company, we are currently using TradeShield / iShield as our gateway to the internet. It is also our DHCP server, content filter, and internet usage monitor. However, I find that the software really sucks. I doesn't doesn't meet our needs, and I would like to replace it.

What I require in a replacement software package or hardware appliance, are the following features:

  • an HTTP proxy, for caching of HTTP traffic, to reduce bandwidth costs, and improve speeds for commonly accessed sites.
  • a DHCP server which allows fixing of IP addresses to specific MAC addresses
  • assigning of friendly names to MAC addresses (e.g. : SalesPrinter, CCTV-PC, PastelServer) which will be used throughout the software.
  • ability to setup "accounts", where an account is simply a list of MAC addresses linked to a user. The idea is to link a user and all his devices (i.e. MAC addresses) to an single account - this will allow him to connect to the network through his desktop, laptop, mobile phone, etc
  • a monitoring tool, to monitor bandwidth usage by MAC address, or by "account"
  • the ability to set usage limits per MAC address, or "account".
  • a website/content filter, to filter out porn sites, warez/crack sites, etc.
  • firewall (SPI, intrusion detection, etc...)
  • VPN

The main point is that we need to be able control internet usage on our local network, as well as act as our Gateway/Firewall to the internet. The network has about 30-40 users/machines, with some people working from home.

Problems I am having with my current solution: once TradeShield "sees" a new device on the network, it will pick up its name, and that name will remain forever linked to the MAC address of the Device. So for e.g. if I install a new PC, but don't change the default computer name assigned to it by Windows, and then connect this machine to the network, TradeShield will pick up the default name, e.g. Acer-User322304, and remember it forever. Now in the usage reports, I have several machines called Acer-2390..., or other weird names that make no sense, and I can't change this. So it's very difficult to figure out who the culprits are, without maintaining my own list of MAC address to User mappings.

Also, I am unable to allow usage of certain ports to only specific people. For e.g. some people have access to IM, but not email. I need to be able to configure such rules on a per-MAC address basis.

I believe what I am looking for is called a "Network Security Appliance" - this is a dedicated hardware device. However, I am also interested in Software Solutions. Currently, TradeShield runs on a Linux box, and I it would be nice if I could find a software solution that will also run on Linux.

Please help.

3 Answers 3

1

PFSense

Depending on your needs but my first pick would probably be PFSense.

http://www.pfsense.com

You can read the feature list here:

http://www.pfsense.org/index.php?option=com_content&task=view&id=40&Itemid=43

IPCop

My second pick would be IPCop. I've used it in a lot of installations and its always proven to be rock solid for me. Easy to set up and configure and has been around long enough with a big enough community that I can find a plugin for pretty much everything I need.

http://www.ipcop.org

You can find some screenshots of the base IPCop product here:

http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots

Keep in mind, there are PLENTY of add-ons... simple to install... that add some very good functionality. Once again, depending on your needs, I recommend taking a look at URLFilter.


Side Story:

Not that this is YOUR problem but I've installed both of the above in work environments where there was a massive problem with employees and social networking sites. By blocking about 5-6 main URLS during working hours and opening it up during the lunch hour there was a DRAMATIC increase in productivity.

You can read more about one example in my post here:

Blocking Facebook and Myspace by IP address

2

I do not know will PF Sense fit to yours needs, but a lot of people talking a best about this distribution of FreeBSD. Anyway you can try it on Vrital Box and without chance to lose anything beside few hours and some of bandwidth of internet connection for downloading it

0
1

I use e-box platform for a similar solution and it's running ok, give it a try.

2
  • @Herson: Thnx for respoding. Do you know if e-box platform offers all the features I require, as described in the question? Aug 23, 2009 at 22:40
  • Yes, you can take a look at: ebox-technologies.com/products
    – Herson
    Aug 25, 2009 at 15:51

Not the answer you're looking for? Browse other questions tagged .