In-addr; how I can unblock

kristian1369 · February 28, 2018, 10:46pm

How I can unblock this category in-addr, whe I put a IP address I can not go…

thanx.

dnutan · February 28, 2018, 11:12pm

It’s the option “Block access to web sites using ip address”

filippo_carletti · March 1, 2018, 9:34am

@dnutan what do you think about removing that “Block access to web sites using ip address” option completely?
It was born as a way to stop malware that connected using ip addresses, but malware evolves rapidly and, while I don’t have actual stats, I think that it is no longer effective.
On the other side, transparent ssl proxy uses connect to ip addresses and can be affected if this option is on.
Finally, it “confuses” the sysadmin like @kristian1369

We could leave the feature in the code, making it possible to enable it from the command line, removing only the checkbox from the interface.

m.traeumner · March 1, 2018, 10:59am

What do you think about to set the checkbox as unselected after installation? So the administrator definitely knows about it, if he has activated it. But please don’t change the status of it for already installed versions, or give a hint with a banner after update.

dnutan · March 1, 2018, 11:59am

I’m not using proxy/webfilter but agree on not removing this feature as then proxy could be bypassed using ip addresses. I’d keep the checkbox.

Would make any sense to allow local networks IPs but block public IPs?

giacomo · March 1, 2018, 12:04pm

I agree with this approach: do not remove the option, only change the default inside the UI.

AFAIK is not possible with ufdbguard unless you write down very complex rules. IMHO it doesn’t worth it.

cswain · March 1, 2018, 10:55pm

Content filters shouldn’t ever be filtering internal addresses. Usually adds overhead to the content filter that isn’t needed.

I don’t know much about the squid to ufdbguard communication, but would it be possible to just not have squid send over the redirect?

giacomo · March 2, 2018, 8:15am

You’re right it’s already implemented like you said, but only for well-kown networks:

github.com

NethServer/nethserver-squid/blob/master/root/etc/e-smith/templates/etc/squid/squid.conf/30http_access_40_self

#
# Skip URL rewriter for local addresses
#
{
    use esmith::NetworksDB;
    my $ndb = esmith::NetworksDB->open_ro();
    my $blue = '';
    foreach ($ndb->green()) {
        my $ip = $_->prop('ipaddr') || next;
        $OUT .= "acl self dst $ip\n";
    }
    foreach ($ndb->blue()) {
        my $ip = $_->prop('ipaddr') || next;
        $OUT .= "acl self dst $ip\n";
        $blue = ' blue ';
    }

    $OUT .= "acl self_port port 80\n";
    $OUT .= "acl self_port port 443\n";
    $OUT .= "url_rewrite_access deny self localnet $blue self_port\n";

This file has been truncated. show original

m.traeumner · March 2, 2018, 9:53am

@kristian1369 Did you solve your problem?

cswain · March 2, 2018, 2:20pm

By that script @kristian1369 shouldn’t be seeing a block if the 192.168.1.0 is in the green or blue networks.

thedigu · April 30, 2019, 12:31pm

I have the same problem! I added port 90 in squid.conf and made the release via the web filter content> General> Whitelist> and the site opens up totally unconfigured!