• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

Need help setting up proxy server

Started by icemantc6, 2007.07.03, 01:22:18

Previous topic - Next topic

icemantc6

I need a proxy server that simply records visited web pages and blocks ones I don't want accesed.  I can't find any sort of native firewall on the o/s so i downloaded a program called delgate i'm trying to work that, if anyone has already setup something that performs this function I'd love some tips

Andi

There's squid for OS/2 compiled by Paul Smedley I think. I should do all what you can imagin from a proxy. I don't know if there's a GUI frontend to configure or if you have to edit the config files manually.

Smartcache (java) is not supported any more, but did run on OS/2. No idea if it can do what you need.

Personally I use Injoy firewall which can block of course, account traffic for different IPs in your lan, show and log connections and much more. Squid runs on this machine too, as proxy for a few special computers in my lan.

There's also a built in firewall in the TCPIP4.3 stack which can be configured with Zampa. But never tried that.

RobertM

Hey TJTommy!

For the firewall (which is built into the eComStation build you are using), you need to activate the following files/drivers in the config.sys

DEVICE=C:\MPTN\PROTOCOL\IPSEC.SYS
DEVICE=C:\MPTN\PROTOCOL\FWIP.SYS
DEVICE=C:\MPTN\PROTOCOL\CDMF.SYS
DEVICE=C:\MPTN\PROTOCOL\MD5.SYS
DEVICE=c:\mptn\protocol\des.sys

Make sure that you arent adding an extra copy of the line... (one or more might already be installed).

I have a script that will activate and enable the Firewall, SYN Protect Support and read the FWFilters file and re-initialize the firewall...


Also, download FirewallConfig from hobbes... most recent version - same version we are using at the office. That will allow you to do lotsa things with the firewall pretty easily (once you get to understand it).

The help instructions tell you where files need to be placed. If you cant find the info, call me... or bring over the machine and we'll finish it.

-Rob


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


icemantc6

Thanks guys for the help I'm going to use squid and enable the native firewall.

mobybrick

Hi,

I am using Squid + SquidGuard for extensive web access, logging and filtering . I am using http://hobbes.nmsu.edu/pub/os2/apps/internet/www/server/squid-2.6.stable9-os2.zip which works well as unfortunately the builds that Paul kindly built seem to have a few problems.

If you need any help then please post your questions here!

Regards,
Moby.

RobertM

Quote from: mobybrick on 2007.07.04, 10:57:18
Hi,

I am using Squid + SquidGuard for extensive web access, logging and filtering . I am using http://hobbes.nmsu.edu/pub/os2/apps/internet/www/server/squid-2.6.stable9-os2.zip which works well as unfortunately the builds that Paul kindly built seem to have a few problems.

If you need any help then please post your questions here!

Regards,
Moby.

Hey Moby,

Do you by any chance know where we can find a (printable) manual for it? Or, is there a .man viewer for OS/2? (Tom searched Hobbes for one with no luck). We did find a site with an online manual for v2.4 (would it suit our needs for 2.6?) - but nothing easily printable for reference.

Thanks,
Rob


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


mobybrick

Most settings between 2.4 and 2.6 are similar. Only advanced things like transparent mode have changed.

Read the SQUID.CONF file - it will give you an idea of the settings to be changed. To be honest, the most important settings are the location of your cache directory (and run SQUID -z once to build your cache directory) and your bind address (HTTP port).

You can then slowly build up your configuration (such as putting in access controls etc) and test as you go.

I haven't seen a MAN viewer, but there probably is one somewhere. But, as I say, the 2.4 guides are pretty good and most settings have not changed.

Regards,
Moby.

RobertM

Thanks again Moby! Your help, as always, is very much appreciated!

-Rob

:D


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


icemantc6

well here's where my project is now i have static ip's working correctly for 2 nic cards on the os2 comp one card ends in 1.5 the other is 5.1 which is going to be connected to my network which as of now is one windows machine, in the routing table i enabled ip fowarding and made a default route to my router ip which ends in 1.1, then i clicked on the "create default net route for given host" button and assigned 5.1 as destination and my sub mask filled in, now the windows machine is set up with static ip that ends in 5.2 with 5.1 as its gateway, the windows machine can ping 5.1 and 1.5 fine and they can ping it but it cannot ping 1.1 and thus get on the internet as the server can HELP!!!!!!!!!!!!!!!!!!!!!!! ???

mobybrick

Hi,

A few things:

1. The OS/2 firewall stack only does port forwarding, NOT network address translation (NAT). This means that you cannot use the OS/2 firewall/IP stack to share the internet amongst multiple workstations (although you could use it to provide internet access to ONE client).

2. SQUID needs to be seen as a logically separate component to the OS/2 native services.

3. SQUID provides HTTP (and tunnelled SSL and FTP over HTTP) web access to multiple clients, running as an application-layer service. As it runs at the application layer, it is of course in a straight-line test slower than a NAT. However, because SQUID is far more efficient than NAT (due to caching of HTTP traffic, DNS lookups and error responses, and also due to pipelined fetching and ICMP round-robin testing) - it more than beats the pants off plain NAT.

4. SQUID allows precise access control - and because it won't forward anything else except HTTP, FTP and HTTPS, there is a lot less security exposure.

5. SQUID's FTP support is NOT a true FTP proxy. You cannot use an FTP client through SQUID. You can, however, use FTP from a web browser (as this is FTP over HTTP).

6. There are some weird work-arounds for bypassing SQUID's protocol limitations by tunnelling other protocols over SSL. These are mainly used as security/anonymization subtefuge, such as in the TOR network.

Here's what I would do in your situation:

a. Research exactly the theories behind SQUID
b. Disable IP forwarding on your OS/2 box. It's a security risk, more than anything else.
c. Install SQUID and configure path locations in SQUID.CONF. Make sure that you then initialize the cache directories by running SQUID -z from the command line. It is far better if this directory is on an HPFS386 or JFS volume.
d. Set SQUID to listen on your internal interface (i.e. the one that is on your Windows clients side, not on the router interface).
e. Make sure that your default route on the OS/2 box is to the router. You should not need to configure the outgoing address of SQUID, but can do if you run into problems.
f. In Incontinent Exploiter on the Windows box, go to Tools -> Internet Options - > Connections -> LAN Settings and configure your Windows machine to use the IP address of your OS/2 machine as its internet proxy. Don't forget to add the correct port number of the SQUID process selected in your SQUID.CONF. You should also disable 'Automatically Detect Settings' in IE unless you have a proxy.pac file around. It is better, if you wish to automatically configure IE, to use Group Policy anyway.
g. Test that you can now access the internet, run Windows update on the Windows machines etc...
h. I would also disable completely access to the default gateway on your Windows machines, and turn off any ability to reach the outside DNS. This will prevent viruses, worms, trojans etc phoning home, unless they use an IP address and HTTP proxy (less likely). SQUID will handle DNS lookups for your IE/Firefox clients.

Hope this helps,
Moby.

obiwan

This is very good information mobybrick, interesting and useful. I have a minor correction for you though.

Quote from: mobybrick on 2007.07.20, 11:38:41
5. SQUID's FTP support is NOT a true FTP proxy. You cannot use an FTP client through SQUID. You can, however, use FTP from a web browser (as this is FTP over HTTP).

This is not strictly true, at least of the version of Squid I use. While it may have some problems or limitations with FTP, I am using it as an FTP proxy with the NFTP client. Then again, this is the only client (besides wget and web browsers) that works with it, so it could be that NFTP supports this "FTP over HTTP" for compatibility with Squid; although I have not found any other client which claims to support even a "true FTP proxy" either, so I really don't know what that would look like. For both wget and web browser, I specify my squid proxy as an ftp proxy, not as an http proxy. For NFTP iirc it is just set as a proxy, of type Squid.

mobybrick

Quote from: obiwan on 2007.07.20, 20:30:04
This is very good information mobybrick, interesting and useful. I have a minor correction for you though.

Quote from: mobybrick on 2007.07.20, 11:38:41
5. SQUID's FTP support is NOT a true FTP proxy. You cannot use an FTP client through SQUID. You can, however, use FTP from a web browser (as this is FTP over HTTP).

Seeing as you won't take my word for it:

http://linuxsecurity.com/resource_files/firewalls/Bandwidth-Limiting-HOWTO/install.html

Specifically: "Squid is a http proxy with ftp support, not a real ftp proxy. It can download from ftp, it can also upload to some ftp, but it can't delete/change name of files on remote ftp servers."

Quote from: obiwan on 2007.07.20, 20:30:04
This is not strictly true, at least of the version of Squid I use. While it may have some problems or limitations with FTP, I am using it as an FTP proxy with the NFTP client. Then again, this is the only client (besides wget and web browsers) that works with it, so it could be that NFTP supports this "FTP over HTTP" for compatibility with Squid; although I have not found any other client which claims to support even a "true FTP proxy" either, so I really don't know what that would look like. For both wget and web browser, I specify my squid proxy as an ftp proxy, not as an http proxy. For NFTP iirc it is just set as a proxy, of type Squid.

No, sorry, you are mistaken. SQUID only supports FTP over HTTP. All traffic between SQUID and clients is either HTTP or HTTP over SSL. The HTTP streams can be real HTTP, or piggybacked GOPHER, WAIS or FTP. Many other applications now also tunnel lots of other traffic over SSL, to hide their real identity (i.e. TOR).

For a real FTP proxy, see http://www.ftpproxy.org/

Regards,
Moby.
P.S. I have spent 1000's of hours using, debugging and compiling SQUID...

icemantc6

how about other protocols or ports like if my windows machine wants to play starcraft or something will it tunnel the proper port

mobybrick

No, SQUID will not do raw TCP/UDP packet forwarding. Unless your application specifically supports HTTP proxy it will not work.

Unless you can afford the FX Injoy firewall, your only other alternatively is the LinkGuard Solutions firewall. Their website seems to have gone, but I can send you their free firewall if you want (I've never tried it, mind...)

Regards,
Moby

obiwan

Quote from: mobybrick on 2007.07.21, 13:48:02
Seeing as you won't take my word for it:

http://linuxsecurity.com/resource_files/firewalls/Bandwidth-Limiting-HOWTO/install.html

Specifically: "Squid is a http proxy with ftp support, not a real ftp proxy. It can download from ftp, it can also upload to some ftp, but it can't delete/change name of files on remote ftp servers."

That seems consistent with my experience. A more careful reading of my previous post would find no indication that I actually disbelieve the technicalities of your word on the matter.

QuoteNo, sorry, you are mistaken. SQUID only supports FTP over HTTP.

I do not read in my post where I said this is not the case. I said, in answer to your statement that an FTP client cannot be used with Squid, that I use it with 3 different clients. On my network, Squid connects to FTP, not HTTP, servers, from clients set to use proxies for FTP, not HTTP. In Firefox this is the "FTP Proxy" line of the Network Settings configuration. For wget this is the "ftp_proxy" variable, and for NFTP this is "firewall-host" setting, in combination with the "firewall-type" setting of 5, for Squid. This is not something I can be mistaken about because it is my first-hand personal user experience. Whatever the technical way it works, it is how I use it. So while most FTP clients do not seem to support using it this way, or, put another way, Squid does not technically do what would be required to use them as such, I do use some FTP clients with Squid as a proxy, therefore the statement "You cannot use an FTP client through SQUID" is not strictly true, from a user standpoint.

QuoteFor a real FTP proxy, see http://www.ftpproxy.org/

Ah, thanks. I could see how that might be useful. Not as conveniently transparent as Squid, but would let you do things Squid can't, without requiring any special support in the clients. For most of what I do, Squid seems a better choice, and my advice that it can work well for others as I described, holds true.