Monthly Archives: September 2019

How to monitor network activities on your openwrt/lede WiFi router?

WFilter internet content filter software can monitor internet activities of network clients. However, the deployment requires you to setup port mirroring in your switch to mirror all internet packets to WFilter for monitoring. Below is a typical network diagram of WFilter deployment:

In many soho networks, there is no manageable switch for port mirroring. In this guide, I will demonstrate a light solution to setup port mirroring directly in your WiFi router. First, you need to get an openwrt/lede WiFi router(or you can reflash your router with openwrt/lede firmware)
Let’s check the network topology first:

openwrt_diagram

The main router is a WiFi router(192.168.1.1) running openwrt system. A PC with WFilter installed is connected to this WiFi router using a cable, with IP address 192.168.1.2. Other network clients are all wireless.  Packet port-mirroring is also installed in this openwrt system.

You need to enable port-mirroring service in openwrt to mirror network packets to the WFilter pc, syntax:

portmirror03

Settings:

1) target: the target pc ip address,  or interface

2) source_ports: wlan0(the wireless adapter)

Then you shall be able to monitor all clients internet activities in WFilter UI. Screenshots:

portmirror01

portmirror02

You also can setup internet filtering policies to block websites or applications.

portmirror04

Software to monitor and track emails of network clients.

Emails sent or received through a company email account are generally not considered private.  As an internet filtering and monitoring software program, WFilter is able to monitor and archieve network emails.

This guide will demonstrate you how to track and monitor emails of network clients with WFilter NG firewall. Please note that we’re talking about emails sent/received via email clients, not web-based emails. Email clients in computer/laptop/smart phones can all be monitored.

1. Plain text pop3/smtp/imap can be directly recorded.

When WFilter NG firewall is deployed, plain text text pop3/smtp/imap can be directly archieved.

Wfrecorder sermail en.jpg

Wfrecorder query1.png

Wfrecorder query3.png

2. “SSL Inspection” shall be enabled to monitor SSL protected emails.

ssl01

If email connections are “SSL enabled”, you need to enable “SSL Inspection” to decode and parse SSL protected emails.

ssl02

ssl03

SSL protected emails can also be recorded.

Web filtering software solution for network.

To filter websites of local network clients, you can have several options.

  1. First check the features of your internet router/gateway. If you have a powerful router/gateway, you can directly do monitoring/filtering in the router itself.
  2. You also can try pass-by filtering software solutions. For example, WFilter internet content filter, by setting up a mirroring port in your switch, you can get powerful internet monitoring and filtering with the WFilter program.

Network diagram:

WFilter is a windows software program. You can install it in any windows pc, when the wfilter pc is connected to the mirroring port of your switch, you will be able to monitor/filter all network clients.

In WFilter, you can setup internet filtering(application control) and website filtering policies.

webfilter01

webfilter02

You also can block websites by categories, for examples, porn/malicius/streaming sites can all be blocked by one click.

webfilter03