Need help improving network, web filter and security. 30+ Users(~50 clients), IP based web filtering required

[Anthony Accetturo III]

Hello, I am new to this forum but it seems like it has a great community. Each networking scenario is unique and I was hoping to get some ideas and inspiration from this vibrant community.

I am not a network engineer by any specs, but I have put in my hours and got my scars enough to tackle this issue. I will attach a current network diagram for you to view and get some insight into the situation and list the requirements as followed.

We are looking to reduce the amount of hardware and improve security, while still being able to block websites by category and static IP or user. This network has been added on to several times as the company has expanded and everything about this setup is really incorrect. Since I am on a tight budget, I need to replace as little as possible. The network needs user specific website blocking. Right now they are using the netgear as it has a included openDNS membership. The netgear router is also the point of failure and it goes down nearly every two days, but if it goes I need to replace the website blocking mechanism. Controlling the network web filtering is important. I was thinking a UTM or NGFW would be good, So right now I was thinking of either replacing the netgear with one of these options

- Mikrotik CRS125-24G-1S-2HnD-IN (24 ports to maybe get rid of some of the lower switches, lacks a good content filtering solution)

- Mikrotik Routerboard RB2011UiAS-2HnD-IN (10 port, same as above but less ports, less power overall)

- ZyXEL ZyWALL USG20W 802.11n Wireless Internet Security Firewall with 4 Gigabit LAN/DMZ Ports, 2 IPSec VPN, SSL VPN , and 3G WAN Support ( Has cloud firewall, website filtering, and more. It seems to be recommended for a 5 user network, which seems very underpowered for the traffic we will pass through)

I have been searching for solutions to replace the netgears web filtering at a reasonable price for the budget im in. OpenDNS Umbrella will want like 25 a user, which is outrageous for DNS filtering. Cloud solutions look good on the $200-$300 UTM / NGFW solutions but they all seem to be light throughout unless u go into $600+ range. Client doesnt mind paying 100-200 a year for web filtering but we don't have active domain configured. Its def an option though.

Those were the options I found before I found out we dont need wireless anymore. Now I know I can use a swtch, but I need some suggestions and help. Its really important we can filter the internet by static IP as well.

NETWORK DIAGRAM

 

[hang-the-9]

For a larger group like yours, you need to use a heavier duty setup, not home based or even SOHO stuff.

Setting up a Proxy Server may be a good idea for you, that can be configured to restrict access by user and by system, and can be cheap to setup money wise but a bit heavier in the knowledge and learning side. You can setup a Linux one basically for free if you have a spare system with maybe a bit extra RAM. For your use, a quad core system with 16 gig RAM will be good, I suggest a fast drive, maybe an SSD also for faster caching to and from the drive.

 

[Anthony Accetturo III]

For a larger group like yours, you need to use a heavier duty setup, not home based or even SOHO stuff.

Setting up a Proxy Server may be a good idea for you, that can be configured to restrict access by user and by system, and can be cheap to setup money wise but a bit heavier in the knowledge and learning side. You can setup a Linux one basically for free if you have a spare system with maybe a bit extra RAM. For your use, a quad core system with 16 gig RAM will be good, I suggest a fast drive, maybe an SSD also for faster caching to and from the drive.

We are looking at the watchguard xtm 26 or M200, but setting up a linux box with squid and a filtering solution isnt out of the question or my expertise. The only issue is I am having trouble with how to block HTTPS traffic effectively. Any recommendations?

 

[hang-the-9]

For a larger group like yours, you need to use a heavier duty setup, not home based or even SOHO stuff.

Setting up a Proxy Server may be a good idea for you, that can be configured to restrict access by user and by system, and can be cheap to setup money wise but a bit heavier in the knowledge and learning side. You can setup a Linux one basically for free if you have a spare system with maybe a bit extra RAM. For your use, a quad core system with 16 gig RAM will be good, I suggest a fast drive, maybe an SSD also for faster caching to and from the drive.

We are looking at the watchguard xtm 26 or M200, but setting up a linux box with squid and a filtering solution isnt out of the question or my expertise. The only issue is I am having trouble with how to block HTTPS traffic effectively. Any recommendations?

Why would you want to block https traffic? Many web sites use that instead of HTTP for security. The firewall will have plenty of options to filter by type of traffic, I've never looked at the full options for them but there are more options that just about anyone would ever want to use in those things.

 

[Anthony Accetturo III]

well, if u dont have a router that can inspect SSL, even if it blocks facebook.com it wont block the https version

 

[bill001g]

That is the issue with HTTPS it makes it very hard to filter on anything other than IP. The method very large companies use is to intentionally do a man in the middle attack on their employes. What you do is get your own certificate server and then add it to the list of trusted servers in the browser. This only works when you have full control over the end pc where you can force this in. You also turn off the warning in the browsers that say the certificate is bad. At this point you can intercept the traffic.

It generally is one of those things that is considered legal because you tell all employees all traffic is subject to monitoring and non business use of computers is discouraged.



Still many firewall can see enough of the https headers to guess what you are up to. I know the palo alto ones seem to be able to watch https session negotiation and determine which sites are being accessed. The firewalls are not hugely expensive but the yearly license for the filters is.