1. Check the blocking events

Click bandwidth number of the client device in “Realtime bandwidth”, you will be able to see the live connections and blocking events.

When an internet activity is blocked, a new blocking event will be added. So, if there is no blocking event, it means no internet access policy is applied.

“Rule” indicates the violated internet access policy rule. “Remarks” has the blocking reason.

2.  Check the policy testing

In “Utils”->”Policy Testing”, you can test internet access of a certain IP. So you can disgnose the blocking reason.

3. Check “Security” history

“IPS(intrusion prevention system)”, “AI Defense” also can block internet access in some circumstances. So please also check history of “IPS”, “IOCs” and “AI Defense” to see whether the client is blocked.

1. Passby monitoring on a mirroring port.

“Port mirror” is a feature of manageable switches or routers. With “port mirroring”, you can get a copy of packets from other ports. So you can setup a software program in the target port pc to monitor all network traffic. This is called as “passby monitoring”. The network diagram:

With WFilter internet content filter installed, you will be able to monitor bandwidth, internet activities and deploy internet access policies. Screenshots:

2. SNMP-based monitoring

Comparing to “port mirroring”, SNMP-based monitoring is easier to setup with less features. However, it’s also very convenient to monitor bandwidth with SNMP. Below are screenshots from PRTG.

3. Linux network bridge

Network bridge is more powerful,  with the ability to monitor traffic, allocate bandwidth, filter internet activities… A network bridge shall be deployed between your router/firewall and switch.

To setup a network bridge, you need a pc with two network cards(wired adapters only). I would recommend you to use WFilter NG firewall as the operation system. It’s a dedicated linux distribution for internet content filtering and firewall. Below are screenshots from WFilter NGF:

Usually, you have below options:

1. Set WiFi users in a separator VLAN, which shall only have limited access to enterprise resources. This is the first door to keep intruders out.
2. Enable user authentication for WiFi users.
3. Enable ip-mac binding for WiFi users.
4. Record internet usage history for WiFi users, including IP, MAC, visited websites.

In this post, I will introduce the “Web Auth” feature of WFilter NG firewall. For WiFi clients, the most widely used authentication is “Web Authentication”(Portal Authentication). Clients won’t have internet access until authenticated in a web portal. For IOS and windows, the web portal will show up automatically.

1. User & Pass Authentication

When enabled, WiFi clients will be required for username and password.

Various authentication method are supported, including “Local Auth”, “Email Auth”, “Ldap Auth” and “Radius Auth”.

• If you have an existing ldap domain, you can authenticate with domain users.
• Users also can authenticate with email accounts.
• You also can define local users in WFilter for authentication.
• Remote radius server is also supported.

You can set internet access policy, query history and reports based on usernames.

2. Third Party Auth

“Third party authentication” is designed for marketing purpose. You have “wechat WiFi” and “facebook WiFi” in default. When enabled, users shall checkin in your facebook page to access internet.

Download WFilter NG firewall now!

In this post, I will introduce the steps to setup port-based IP-MAC binding in your switch.

1. Cisco 2950

Syntax of cisco 2950 port-based IP-MAC binding.
Switch#config terminal
Switch(config)#Interface fastethernet 0/1
Switch(config-if)#switchport port-security mac-address xxxx.xxxx.xxxx ip-address 192.168.x.x

2. Huawei S5700

Syntax of Huawei S5700 port-based IP-MAC binding.
#interface GigabitEthernet 1/0/1
#user-bind mac-addr xxxx-xxxx-xxxx ip-addr 10.100.11.2

Other models have similar syntax. Port-based binding in switch is powerful, but it’s rather complicated to setup and maintaince, especially when you have a lot clients.

However, IP-MAC binding in gateway is easier to setup, also with powerful features, please check below screenshots in WFilter NG firewall.

3. WFilter NGF

When configured, DHCP clients will be assigned with static ip addresses; clients not matching the ip-mac binding relationship will be blocked.

When successfully configure, A,B,C will have full access of each other. Please check below steps:

Suppose you have 3 networks:

• Headquarter A, static public ip address, LAN subnet is 192.168.10.0/24.
• Branch B, PPPoE internet access, LAN subnet is 192.168.30.0/24.
• Branch C, PPPoE internet access, LAN subnet is 172.16.1.0/24.

Now let me guide you to build a virtual private network(VPN) for these three locations.

1 Settings for Headquarter A

• Setup the IPSec tunnel

• Enable forwarding of branches

Without this setting, branches can access headquarter, but no access between branches. 

2 Branch B

• Setup the IPSec tunnel

3 Branch C

• Setup the IPSec tunnel

By above steps, AB and AC are now connected. If you also want B and C to communicate with each other, you need to add B&C subnets in headquartor’s local subnet.

In this post, I will guide you certain steps to build a firewall appliance.

1. First, you need to buy an appliance box and a harddisk.

1). A 4/6 interfaces atom D525 networking appliance. (Less than $200)

2). A Seagate 1TB disk.

3). One usb stick.

2. Mount the disk.

3. Get a display monitor, and burn WFilter ISO into the usb stick.

Here is a guide for installation: http://wiki.wfilterngf.com/Installation_of_WFilter_ROS

Console terminal after installation:

4. Now connect your laptop to LAN interface and setup basic networking parameters.

Set laptop to “obtain ip address automatically”, then open http://192.168.10.1 in your browser.

Choose the free license:

5. Connect all the cables.

6. Done, now you can setup more policies to speed up your internet access.

Isn’t it exciting? You won’t be able to find any better solution for small networks.

Download WFilter NG firewall now!

Now let’s see what we can do with this free license.

1. Choose “free license” on first time login.

2. Powerful reports and statistics.

3. Archive web browsing and email history.

Web activity recording

Email activity recording

SSL inspector

4. Deploy internet content filtering policies

With the free license, you also can get “website black&white list”, “website category filtering”, “application control”, “IP-mac binding”, “Web content pushing”…

5. Bandwidth optimization and rate limit

Free solutions for bandwidth priority optimization, bandwidth rate limiter and multiple WAN load-balancing and WAN fail-over.

6. Various user authentication.

Local accounts, active directory integration, PPPoE, web authentication(facebook WiFi).

And the “ISP management” module, a total solution for users/bandwidth management.

7. VPN tunnels

8. Extensions

9. License

Now let’s check the license: life-time free for 50 users.

Isn’t it exciting? You won’t be able to find any better solution for small networks.

Download WFilter NG firewall now!

In this post, I would introduce the important tips to block WannaCry attack.

1. Install Security Patches. Microsoft has released security patches that fix SMB flaw currently being exploited by the WannaCry ransomware, with most version of Windows supported — including Windows XP, Vista, Windows 8, Server 2003 and 2008.
2. Block incoming connections on TCP port 445 in your router/firewall. This rule blocks attacks from internet.
3. For windows DMZ hosts, you also need to block TCP port 445 in firewall settings.
4. To protect VLANs being attacked by an infected VLAN, you can block TCP port 445 in VLAN ACL rules of your core switch.

Using the “network health checker” extension of WFilter, you also can check whether there are “Suspicious Hosts ” in your LAN network. Hosts with massive connections will be identified as “Suspicious”.

At a first galance

All WFilter systems have an “extension” library, which contains a powerful free tool sets for IT administrators. Most extensions are free. Even supported in WFilter free, a freeware for network internet filtering and monitoring.

Now let’s see what we can do with WFilter extensions:

1. Scan client devices in network

With “network scan” extension, you can get a complete list of network clients, including IP, MAC, manufactor and open ports…

2. Discover and scan DHCP services in network

The “Network DHCP discover plugin” of WFilter can scan DHCP services in your network by a single click. It will list all dhcp servers ip addresses, MAC addresses and MAC manufactures.

3. Detect NAT sharing services in network

Detect illegal NAT sharing in network.

4. Check network health of availability, IP conflict, ARP spoof and broadcast storm

This extension can:

1. check availability and ping performance of dns servers.
2. check availability and ping performance of internet sites.
3. check availability and ping performance of local network hosts.
4. check whether there is ip conflict in local network.
5. check whether there is arp spoof running in local network.
6. check whether there is broadcast storm in local network.

5. Scan proxy servers in network

6. Graph ping performance of multiple hosts

With this plugin, you can get ping performance and graph reports for multiple hosts in a period of time.

A complete extesions list can be found at here: WFilter extensions. And more will come. The most important thing is that most extension are free, supported in “WFilter internet content filter(commercial)”, “WFilter NG firewall” and “WFilter Free”.

Isn’t it exicting? Download WFilter Now!

In this post, I will demonstrate the “IP-MAC binding” feature in WFilter NG firewall. For IP-MAC binding in “WFilter internet content filter”, please check: “WFilter IP-MAC binding solution“.

1. IP-MAC Binding List

You can define the IP-MAC binding list in “Modules”->”Access Policy”->”IP-MAC Binding”. When listed, these devices will always be assigned with static IP addresses when using dynamic IP address.

2. Settings

Below options are available in the “IP-MAC binding” module:
1. For unlisted IP addresses, you can choose “Allow all”, “Block all” or “Block below IP ranges”.
2. For unlisted MAC addresses(devices), you can configure whether to assign IP address or not.

3. Multi-subnet IP-MAC binding solution

Your network is multi-subnet? No worry. With “MAC address detector”, WFilter NGF is able to retrieve MAC addresses from your core switch. So you can bind IP address with MAC address, even in a multi-subnet network.

A guide of “IP-MAC binding” in WFilter NGF can be found at: IP-MAC binding.