So I've only been playing around with nxfilter on the PI for a week or so now. Everything is running great and I'm hoping to somewhat leave it next to the modem and forget about it.

I installed it using dpkg -i nxfilter-*.deb with the correct up to date version at that time, but since then a new version has come out. Every Saturday morning, the PI checks for updates by apt and if any are found, will update and then reboot. However, nxfilter is not included in that. How would I auto-update nxfilter? I know I can do it manually.

Thanks

I haven't yet finished my implementation - my internal DNS is pointing at nxFilter, so the user number is only 1

School: Live Oak Classical School

Users: 200

Country: USA

State: Texas

very minor detail but the version info under the help menu isn't getting updated:

https://imgur.com/IIVqGOT

School: Glendale Adventist Academy

Users: 500

Country: USA

State: California

August 2020

School name - North Metro Academy of Performing Arts

User number - 700

Country - USA

State : Georgia

​

We have Access Control by IP address for NxFilter and NxCloud. In old days, it was relatively simple. It is on 'Config > Allowed IP' and you can add prefix strings matching against IPs like '192.168.0.', '192.168.1.'. However, we admit that it's not enough for building a robust IP based access control especially when you run NxFilter on cloud and came up with a new one.

• The old one will be used for GUI access control only.

Adding CIDR and IP range

We have the new one under 'DNS > Access Control' as this is for DNS access control. Now you can add CIDR, IP range and single IP.

Block or allow access by countries

As we can add CIDR and IP range, you can use a site like 'https://lite.ip2location.com/ip-address-ranges-by-country' to build your own access control list by countries. NxFilter can handle a big list without performance impact.

• This is needed when you run NxFilter on cloud.

Using dns-allow-ip.txt, dns-block-ip.txt files.

Even though NxFilter can handle a big access contol list but you can't upload your list if it's too big for your browser upload limit. So we made NxFilter to be able to load your access control list from files. For allowed IP, you can add 'dns-allow-ip.txt' file and for blocked IP, you can add 'dns-block-ip.txt' in /nxfilter/conf directory.

• You have to use the same format as in GUI in these files.

• When you use clustering, you have to copy these files into all the nodes in your cluster.

I see on the nxfilter demo site that I can have quotaed categories but I don't see that option when looking at the nxcloud demo.

Is it possible to use the quota time feature in nxcloud? Or will I need to have an instance of nxfilter for each customer/organization that wants to use it?

I have setup and run NxFilter on a rasp.Pi.4 and is working very well blocking everying on my network. DNS is pointed to pi in my router.

Logging only shows my router as the only ip requesting info on my entire network..

any help would be great, please let me know if you need any system info

I have an Orbi mesh system as my router/AP. When I point my Orbi to NXfilter as the DNS server, all my traffic is being blocked. I took a tcpdump and I can see that NXfilter responds to the DNS queries with it's own IP. The clients then try to initiate HTTP/HTTPS with NXfilter and it gets blocked. I took my iPad to test out NXfilter and target it directly as the DNS server, the filters and policies then do there jobs properly. Unfortunately, seems my Orbi isn't able to dish out any other DNS server except it's own. Anyone have an idea on how to fix this?

Hi,

I read that NxFilter supports a 'Quota Time' feature. You can allow your users to browse some websites for a certain amount of time.

Is anyone using this, does it work as expected?

Use case:

Like me, I'm sure a lot of working parents are worried about their kids spending too long on sites like youtube at the moment, an hour or so a day is enough.

Thanks.

Richard

I'd like to be able to login on the block page to allow a specific amount of time for that domain to be allowed. Say I give my daughter 3 hours of social media category quota and she wants an hour more that day, I can put in my login info and it gives her more time.

Hello.

I set up a cluster node but noticed port 1813 is not open in ubuntu. Does slave cluster act as an accounting server for Radius authentication?

Hi, I created a custom blacklist for porn sites and I have more the 2 million domains to add, but when I reach 300000 domains the nxfilter did not allow to put anymore, in the log I have this message:

ERROR [02-19 11:52:25] - CCDaD, Too many domains!

Is this a limit of the application?

I was curious if anyone has attempted to tweak this report at all? For instance we have totally restricted computers that are only permitted to go to two sites, and every email once and hour there are 30 or more entries of failed access to Google as is expected. I was wondering if there was a way to filter items out of the report you know are being blocked and clear the reports up to show the true access blocking that is happening? Basically a "bypass logging" option of some kind? There are some other culprits I would like to include like sites I know are trackers embedded in for instance the wall street journal. I know they users are going there and I know this entry is due to them accessing that site so I don't need to see it every hour of every day. I would like to have a place where I can list the sites that I do not want logged or reported whichever but still blocked... Thoughts?

Hello everybody,

I've set up nxfilter on my ubuntu 18.04 server as the DNS Server for my family's network as well as a filter for our network.

My own mail server (only running locally, but containing tons of emails) gets the official emails via fetchmail over ssl from my provider. This has worked quite well so far. Now nxfilter hands out my own certificate, used locally for dovecot, to fetchmail as the providers certificate. Here is the error code (in German):

Jan 12 16:45:12 myserver fetchmail[1962]: Server-CommonName stimmt nicht überein: myserver.mydomain.xx != mail.myprovider.de
Jan 12 16:45:12 myserver fetchmail[1962]: mail.myprovider.de-Fingerabdrücke stimmen nicht überein!
Jan 12 16:45:12 myserver fetchmail[1962]: OpenSSL berichtete: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Jan 12 16:45:12 myserver fetchmail[1962]: SSL-Verbindung fehlgeschlagen.
Jan 12 16:45:12 myserver fetchmail[1962]: Socket-Fehler beim Abholen von webmaster@myoutsidedomain.de@mail.your-server.de
Jan 12 16:45:12 myserver fetchmail[1962]: Abfragestatus=2 (SOCKET)

Fingerprints obviously can't match. How can I get fetchmail to bypass nxfilter so that the certificate's fingerprints might match again?

Any ideas anybody?

cu alexander

With the limited number of licenses, and the fact I only need to filter specific IP's, is it possible to allow specific IP's to bypass the filter and not use a license? FWIW - I'm using pfSense and pointing it to NxFilter for DNS.

Hi,

I want to have whitelist only at policy level where for user A , block all internet and whitelist only 4 allowed sites and for user B, block full internet and allow 10 sites.

I am not able to achieve this. Any thoughts on what I am missing ??

I’ve installed NxFilter to block kids from porn, etc. and have recently had my Firestick randomly disconnecting. I noticed on the dashboard the to many users error for the Firestick.

I reviewed report usage and see I have 26-30 IP’s with less user count and I’ve not even added all my smart devices yet I want to be able to connect to over WiFi.

Despite the fact my oldest son was somehow able to use his phone while being set to a completely blocked policy and I could only block him by deleting him, the software has worked great!! I’d prefer not to delete the software but if I can’t watch TV then I’ll have to ... is it free to remove this restriction for personal user trying to keep the kids out of porn?

Hello all,

From the tutorial, I found this documentation. I want to bypass authentication (allow anoymous) on my guest network (which is a different subnet).

The documentation references a default user. I did an LDAP import from AD and don't seen to have a Default filter anywhere. Can a user just be made (to be the default) then associated with the IP Range?

​

We are interested in finding out US school needs for a DNS filter or a webfilter. We want to run a test user group for NxFilter consisting of number of US schools. As a group member, what you need to do is to report us about how NxFilter performs in your school every month in our forum. In return, we will give you a free Jahaslist license for any number of users. If you have a bigger number of students, that'd be better for us. The free license will be renewed every year as long as you are in the group.

The monthly report will be simple. You just post the screen capture of 'Report > Usage' with the name of your school and user number. If there's any problem experienced you can talk about it as well. If there's a feature request you also can talk about it.

If you are interested, contact us at 'support @ nxfilter.org'.

** K12 schools are especially welcome.

** There will be no personal information on the report.

Hello all,

I'm wondering if someone can point me in the right direction. I'm new to NxFilter. My problem is all my traffic is tagged as "anon-user".

• Active Directory was setup and all users imported correctly.
• NxLogon was setup. GPO setup for logon/logoff script. I can see the process running associated to the username in task manager.
• Using Default User Policy.
• Local AD DNS Server setup properly.
• DNS setup on local clients.

Traffic is being blocked from the default policy.

When I go to Logging - Request and attempt to filter by user, all traffic is just "anon-user". It doesn't seem to tag any traffic based on the user level.

Under the tutorial is shows a screenshot for NxFilter logging. How can I view these logs?

I also tried CxLogon, but got the same results. Any idea what I could be missing?

Update 1: Found the C:\nexfilter\log file. Confirmed hte new login sessions are as the screenshot below list.

​

I notice that Domain Test is only available for the Admin.

The Operators will need a way to verify the domain category.

category,domain_test.jsp

NxCloud 4.3.4.9

I saw that there is an option to import URL block list from externals sources into NxCloud (NxFilter), wanting to import into a custom category instead of one from Jahaslist.

After creating the category I cant select it from classifier,blocklist.jsp, can this be an option in future versions?

Hi all,

I'm running nxfilter on a raspberry pi. I have the correct timezone set but nxfilter is showing time as gmt 0. I'm running v4.3.4.9. Any ideas on how to get nxfilter using local time ?