1. Check the blocking events

Click bandwidth number of the client device in “Realtime bandwidth”, you will be able to see the live connections and blocking events.

When an internet activity is blocked, a new blocking event will be added. So, if there is no blocking event, it means no internet access policy is applied.

“Rule” indicates the violated internet access policy rule. “Remarks” has the blocking reason.

2.  Check the policy testing

In “Utils”->”Policy Testing”, you can test internet access of a certain IP. So you can disgnose the blocking reason.

3. Check “Security” history

“IPS(intrusion prevention system)”, “AI Defense” also can block internet access in some circumstances. So please also check history of “IPS”, “IOCs” and “AI Defense” to see whether the client is blocked.

1. Network topology

As shown in the above topology diagram, headquarter and two branches all use WFilter NGF as gateway. By adding each gateway into the SD-WAN network, you will be able to setup secure site-to-site VPN tunnels.

2. SD-WAN subnet settings

First setup a SD-WAN network in the WFilter cloud service.

3. Join every WFilter into the SD-WAN network

4. Assign SD-WAN ip and setup routing

Assign static SD-WAN ip addresses to every WFilter, for example: WFilter A(10.200.188.1), WFilter B(10.200.188.2), WFilter C(10.200.188.3). Then you can setup SD-WAN routing policy to forward LAN traffic.

After the above setups, each local area network can directly access each other. To restrict access, you also can setup firewall rules in WFilter’s firewall->Rules.

1. Register on the Wfilter cloud service

2. Configure the endpoint WFilter to join the cloud service

As shown in the figure below, record the cloud service network ID, and setup SD-WAN to join this network in the SD-WAN of the WFilter. In the Wfilter cloud service, copy sdwan network ID.

In Wfilter web-UI, join cloud network.

3. Add WFilter client in the cloud platform

The third step is to add the Wfilter client device in the cloud platform. As shown in the figure below, add client’s SD-WAN secret in “Devices” in the cloud platform.

After the above steps, you are able to manage the added Wfilter clients in the Wfilter cloud service, including:

• View device address, system version, IP address, and alert information
• Synchronize configurations in different Wfilter devices
• Access the management interface via Internet

 

In this guide, I will demonstrate you how to setup and use the WebVPN service of WFilter NG firewall.

First, you need a domain.

Domain shall be mapped to your network public ip address.

Enable the “WebVPN” service, setup domain name, port and authentication.

Add local web services.

Edit the webvpn portal.

Setup “port forwarding” to forward internet access to webvpn port.

Now, let’s check how WebVPN works from client side.

You need to authenticate yourself.

After successful authentication, the web portal shows up. Then you can click a link to visit internal web service.

However, real world webpages can be complicated. For example, webpage A also includes resources from website B. So webpage A can not display correctly unless website B is also whitelisted.

To find out the domains of website B, you have to solutions:

Solution one: check the blocking events in WFilter.

In “realtime bandwidth”, click the bandwidth number of the testing client. You will be able to check the “blocking events”. All recent blocked domains/IP will be listed. So, you can find out the external domains.

Solution two: check network activites in browser.

By press F12, you will be able to check network activites of your browser. So you know which resources/urls are not loaded.

With the above two solutions, you can find the extra domains to be whitelisted. You need to add these domains to the allowed list in web filter.

In “App Control” of WFilter NG firewall, you can enable “block sessions when outgoing traffic exceeds N” option. This option will check the outgoing traffic of every connection. If outgoing traffic exceeds the choosen limit, this connection will be terminated.

Now let’s check the blocking effects.

“Email attachments” will be blocked(https).

“Blog and forum attachments” will also be blocked(http).

And you also be able to see the “uploading detected” blocking events in WFilter.

Please also note: this option blocks uploading according to outgoing traffic checking, so there will be false positives. For example, a video conference will also be blocked due to high outgoing traffic. In this case, you may add “Exceptions” to avoid over-blocking.

In many soho networks, there is no manageable switch for port mirroring. In this guide, I will demonstrate a light solution to setup port mirroring directly in your WiFi router. First, you need to get an openwrt/lede WiFi router(or you can reflash your router with openwrt/lede firmware)
Let’s check the network topology first:

The main router is a WiFi router(192.168.1.1) running openwrt system. A PC with WFilter installed is connected to this WiFi router using a cable, with IP address 192.168.1.2. Other network clients are all wireless.  Packet port-mirroring is also installed in this openwrt system.

You need to enable port-mirroring service in openwrt to mirror network packets to the WFilter pc, syntax:

Settings:

1) target: the target pc ip address,  or interface

2) source_ports: wlan0(the wireless adapter)

Then you shall be able to monitor all clients internet activities in WFilter UI. Screenshots:

You also can setup internet filtering policies to block websites or applications.

This guide will demonstrate you how to track and monitor emails of network clients with WFilter NG firewall. Please note that we’re talking about emails sent/received via email clients, not web-based emails. Email clients in computer/laptop/smart phones can all be monitored.

1. Plain text pop3/smtp/imap can be directly recorded.

When WFilter NG firewall is deployed, plain text text pop3/smtp/imap can be directly archieved.

2. “SSL Inspection” shall be enabled to monitor SSL protected emails.

If email connections are “SSL enabled”, you need to enable “SSL Inspection” to decode and parse SSL protected emails.

SSL protected emails can also be recorded.

1. First check the features of your internet router/gateway. If you have a powerful router/gateway, you can directly do monitoring/filtering in the router itself.
2. You also can try pass-by filtering software solutions. For example, WFilter internet content filter, by setting up a mirroring port in your switch, you can get powerful internet monitoring and filtering with the WFilter program.

Network diagram:

WFilter is a windows software program. You can install it in any windows pc, when the wfilter pc is connected to the mirroring port of your switch, you will be able to monitor/filter all network clients.

In WFilter, you can setup internet filtering(application control) and website filtering policies.

You also can block websites by categories, for examples, porn/malicius/streaming sites can all be blocked by one click.

In this guide, I will demonstrator you how to check the blocking reason and add exceptions.

First, check the blocking events

In “Realtime bandwidth”, click bandwidth number of the blocked clients.

You will be able to see the “blocking events”. In “blocking events”, you will get the “blocking reason”, “protocol” and “content”. The “content” shows the domain/IP address being blocked.

Second, add sites to “exception” list

To whitelist the blocked sites/ip addresses, you can add an “exception” policy. Excepted targets won’t be blocked by any other policies.

Third, test and check

Now make some tests to make sure your sites not blocked. If still blocked, you need to redo 1-2 steps until success.