0

I have a home network behind a router (model fritzbox 7490), which currently serves as gateway and DHCP server for all wired and wireless devices. Furthermore, I have a home server within the network with one physical network card and which is running debian jessie and a DNS-server (bind9).

Is there any way (e.g. including additional configuration of the router) to setup my home server with squid to act as a transparent proxy for all network devices in order to monitor and possibly block outgoing internet traffic?

closed as too broad by Ƭᴇcʜιᴇ007, DavidPostill, BlueBerry - Vignesh4303, galacticninja, mdpc Jul 5 '16 at 23:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Depending on how you define monitoring, you can monitor and block with iptables alone, but ipset is a nice companion to it. iptables -A OUTPUT -j LOG --log-prefix "red alert something bad " --log-tcp-options --log-ip-options Obviously you would need to add conditions like protocol,source,destination, and etc to make it a meaningful rule. – cybernard Jul 3 '16 at 19:31
  • squid is a proxy cache which hold all of the most commonly downloaded web sites on your hard drive for faster access. I am not familiar enough with it to know how well it monitors/blocks traffic, but these are secondary functions. – cybernard Jul 3 '16 at 19:35
  • @cybernard: ideally, I would like to have a website running on my home server, which lists all visited websites sorted by client IP (the solution doesn't have to be squid or even a proxy). Moreover, remember that currently my home server is not my gateway! So I propably first have to find a way to route all traffic from the router back to the home server!? I don't need the caching function. – Thassilo Jul 3 '16 at 19:39
  • iptables -I OUTPUT 1 -p tcp -m tcp -m multiport --dports 80,443 -J LOG --log-prefix "I visited a website " Then type dmesg and at the end of the log you will start seeing your new log entry after visiting a website. However, you will need to modify this if you want long term storage of the logs, and how long term. The standard dmesg log may rotate more than once a day depending on how many sites visited. – cybernard Jul 3 '16 at 19:47
  • If you want long term logging setup a mysql server and install ulog2, not the old version. You will find a sql file you need to import from ulog2 before the database is configured. Then replace -J LOG etc with -J NFLOG --nflog-group 1 --nflog-prefix leftover_udp "I visited a website " – cybernard Jul 3 '16 at 20:12
3

If you can get in via telnet with the described methods you can try my iptables rule. Alternatively you can install Freetz, and then my rule should work. They say some of the documentation is in German so use google translate.

This is an excerpt from Linux Voice

FRITZ!Box 7490 - Linux Voice

There’s a surprising amount you can do with the FRITZ!box if you’re willing to hack around a little. Telnet can be enabled, for instance, by pressing ‘#’ on a connected phone, and dialling 96*7*. You’ll even see a message to tell you it’s enabled (switch the 7 to an 8 to disable it). You can now connect to your router from the command line by typing telnet ip_address, and entering your web admin password. You’ll now find yourself in a fairly recognisable Linux command line environment. You can ls or type top and take a look around the filesystem. wget is also available and there are ways of installing user-compiled packages like ‘DropBear’, but we wouldn’t suggest doing this. Instead, we’d recommend taking a look at the Freetz. This is a collection of open source modifications that can be made to your router’s default firmware, turning it into a much more flexible and hackable device (and likely voiding the warranty at the same time). You need to create a virtual machine with a specific build environment and then pull the latest files from a GitHub account before building it all from a basic menu system. Nearly all the important and relevant information is in German, making the task that much harder if you don’t speak the language. But if you want greater control over your If the default firmware doesn’t give you enough control, you can access the OS with Telnet or install an open source update called Freetz. hardware, and the ability to make your own firmware changes, it’s worth the effort. We found it particularly useful to add wider VPN functionality, including OpenVPN, as well as easily adding SSH and other applications.


Short term logging:

iptables -I OUTPUT 1 -p tcp -m tcp -m multiport --dports 80,443 -J LOG --log-prefix "I visited a website "

Longterm:

  1. install mysql and ulogd2

    mysql -u root -p < /src/ulogd2/doc/mysql-ulogd2.sql

This file may not be in the same place on your computer

find / -iname "mysql-ulogd2.sql"

if it says file not found

change this part of ulogd.conf

[log1]
# netlink multicast group (the same as the iptables --nflog-group param)
# Group O is used by the kernel to log connection tracking invalid message
nlgroup=1
group=1

[global]
stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2bin1:IP2BIN,mac2str1:HWHDR,mysql1:MYSQL
[mysql1]
db="ulog2"
host="192.168.1.1"
user="username"
table="ulog"
pass="password"
procedure="INSERT_PACKET_FULL"

iptables -I OUTPUT 1 -p tcp -m tcp -m multiport --dports 80,443 -J NFLOG --nflog-group 1 --nflog-prefix "I visited a website " 

ONLY iptables and ulogd2 NEED to be on your fritzbox, and the rest can be put anywhere on your network.

  • Thank you very much for your answer. It is not exactly what I was looking for, but maybe it is the only way to go. So, thanks again! – Thassilo Jul 3 '16 at 20:07
  • @Thassilo This should get you in the front door, and my other info should get you a list of visited website by ip address. – cybernard Jul 3 '16 at 20:14
  • My actual intension was to find a configurable software with a web interface that offers a more convinient visual way to monitor the traffic. Also I want use my linux home server to do this job, while being only a client in the network. My thinking was: My home server also works as a DNS server - and translates addresses for all devices in my home network without being the actual gateway. However, firstly - I don't know if this is even possible with my current setup and secondly - I don't know how. – Thassilo Jul 3 '16 at 20:24
  • If you want a web interface, after configuring ulogd2 you can setup apache with php support. Download and place adminer.php into root folder, and you have a database GUI. Visit ipaddress/adminer.php – cybernard Jul 3 '16 at 20:29
  • @Thassilo The only problem with asking the DNS server is caching. You won't know exactly how many times a website is visited. First, windows adds a dns cache, and the your web browser adds a second layer of caching, and only if both of those are misses will you dns server be contacted. – cybernard Jul 3 '16 at 20:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.