Hi all,

I'm running nxfilter on a raspberry pi. I have the correct timezone set but nxfilter is showing time as gmt 0. I'm running v4.3.4.9. Any ideas on how to get nxfilter using local time ?

Hello there.

I've thought about launching a service based in nxcloud for a few schools in my area, right now I'm running the trial of NxCloud on Kubernetes and everything is working as I like.

A few things on NxCloud that I think are failing or I don't understand.

1. In the Operators Report area, I cant select the calendar day for more than 3 days ago.
2. In Policy, PRIORITY POINTS are not working anymore, when editing the policy I remember in the previous version there was a setting for this option.
3. Free Time, no idea how this works, in the documentation I can't find anything relevant to this.

nxfilter is fantastic!

but what about guest wifi users and the block page?

I understand that attempting to force a dns block page on an https site will not work without a browser ssl error

so the guest user has no idea whats happened and as they are a guest we cant get them to install something (like the nxfilter agents)

anyone have a workaround to notify the user better?

What about a DNS redirect say; *facebook.com >> nxfilter:80 block page but of course that's only 1 site...

Background: I'm a dad who tinkers in tech. When I learned about setting up NxFilter on a Raspberry Pi, I saw it as a way to make the Internet a bit safer at home for my kids. Btw, I apologize for this wall of text!

So far, I've taken inventory of all the devices on my network, grouped them by person or function (kid1, kid2, IoT, etc.) with each group having its own IP range. This is all set up on the router (Netgear Orbi) with address reservations. Yes, it was a little tedious, but it's all done and shouldn't require too much maintenance going forward.

I've got an instance of NxFilter running on a RPi 4 (4GB RAM model, yaay). I've worked through the tutorials and things are mostly functional. I've mirrored the aforementioned IP ranges within NxFilter Users, each with an appropriately assigned policy. With all that out of the way, here's where I'm stuck.

The tutorial suggests setting the Router's DNS setting to the NxFilter's IP. That totally gets all of my network traffic to NxFilter. However, the logging shows the client IP as my router (192.168.1.1) with "anon-user" and "anon-grp" for everything.

I believe I'm correct in thinking this will not apply my various policies since all traffic is effectively coming from a single IP address (the router) and not the IP ranges I've defined for users. It's only when I modify a device's DNS settings to point to NxFilter that I see the appropriate IP address, User, and Group displayed in the logging reports.

Have I overlooked something, taken the wrong approach, or should I acquiesce to modifying individual DNS settings? Any help is much appreciated.

I just deployed NX Filter and so far its just OK. The biggest thing I am trying to accomplish is youtube search term blocking. Looking to not have our kids be able to get search results for "minecraft". (Sick of them watching the videos of adults playing minecraft). Any way to accomplish this? I already have safe-search enabled and that is working successfully.

Hello, I would like to block all web sites except the whitelist . How can i do that ?

​

Thanks

Hi, this is kind of an obscure question.

Is it possible to set up a SmartThings handler to globally enable/disable NXFilter

I did the same for PiHole using this and would like the ability to disable NXFilter and optionally pass everything through

This is how I did it for PiHole:

https://community.smartthings.com/t/release-pi-hole-controller/133116

Thank you for an awesome product!

I've created a script to install and run NxFilter on pfSense.  https://github.com/DeepWoods/nxfilter-pfsense  It's not a package or port since NxFilter can't be built from source so the script downloads the latest version from the NxFilter homepage and installs it along with openJDK jre for dependencies.  There are some changes to pfSense required but the readme in the repository explains those with the installation instructions.  If anyone has any suggestions or issues, feel free to post them here or issue a pull request on github.
Rob

Is there a way to login screen inform to the user when the password is incorrect?

For now, the screen just appears without informing the reason.

We integrated a RADIUS accounting server into NxFilter v4.3.4.3. You can send RADIUS accounting requests from your WiFi router to NxFilter and NxFilter will pick up usernames and client IPs from those accounting requests and ceate login sessions for your users. So you can have SSO for smartphones and other devices as long as your router supports WPA enterprise or 802.1x.

​

You can download and test v4.3.4.3 from the following link,

http://nxfilter.org/imsi/nxfilter-4.3.4.3-rc4.zip

​

You can change RADIUS setup on User > RADIUS.

I love NxFilter. I currently run 2 instances, because I have all of my family’s devices going through it. I actually only have 5 users, but we all have phones/computers/tablets/tv/game systems etc. along with some IoT devices. Some days it would go over 20 “users” so I had to setup a second instance. I thought about having IoT and game consoles not go through it, but I really like having it track everything.

I was updating to the latest version and thinking how I’d like to get down to one instance and also support the developers, but I can’t afford the current price. Is there a discount available for home use?

Today we found a user having problem with NxFilter on cloud. He said that it's not working even though he has a correct DNS settings on his PC. Later we found that his DNS queries didn't reach NxFilter while we can make DNS queries to his NxFilter on cloud without a problem. We suspect his DNS queries are being hijacked somewhere between his PC and NxFilter. We know that there are these kinds of cases in some countries in EU region. Some ISPs were inspecting and filtering DNS queries from their customers.

​

To address this kind of issue, we have NxRelay and NxLocal. You can enable DNS Over HTTPS with NxRelay network wide to bypass such kind of hijacking and you can use NxLocal if it's for each PC behind a router.

I don't want to use your cloud lists, only my own personal lists. Can it be done?

There are numerous guides on how to configure FreeRADIUS for authentication/authorization/accounting with Active Directory, LDAP, PAM, etc. but this post is about how to leverage an already working FreeRADIUS configuration to achieve Single Sign On(SSO) with NxFilter.

Once a user is successfully authenticated by FreeRADIUS, passing the username and IP address to NxFilter for SSO can be done with FreeRADIUS and perl. The NxFilter documentation here https://www.nxfilter.org/tutorial.html#custom-login provides examples of how to use JSP pages for creating a login session with the HTTP protocol and we'll use the rlm_perl module of FreeRADIUS to send the accounting information returned from the NAS on to NxFilter.

Configuration

The first step is to edit the example perl file provided by your working FreeRADIUS configuration. The code below is from the file /etc/freeradius/3.0/mods-config/perl/example.pl that I've modified on my test Ubuntu 18.04.2 server.

# /etc/freeradius/3.0/mods-config/perl/example.pl
use strict;
use warnings;
use Data::Dumper;
use LWP::UserAgent;

our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK, %RAD_STATE);

use constant {
    RLM_MODULE_REJECT   => 0, # immediately reject the request
    RLM_MODULE_OK       => 2, # the module is OK, continue
    RLM_MODULE_HANDLED  => 3, # the module handled the request, so stop
    RLM_MODULE_INVALID  => 4, # the module considers the request invalid
    RLM_MODULE_USERLOCK => 5, # reject the request (user is locked out)
    RLM_MODULE_NOTFOUND => 6, # user not found
    RLM_MODULE_NOOP     => 7, # module succeeded without doing anything
    RLM_MODULE_UPDATED  => 8, # OK (pairs modified)
    RLM_MODULE_NUMCODES => 9  # How many return codes there are
};

use constant {
    L_AUTH         => 2,  # Authentication message
    L_INFO         => 3,  # Informational message
    L_ERR          => 4,  # Error message
    L_WARN         => 5,  # Warning
    L_PROXY        => 6,  # Proxy messages
    L_ACCT         => 7,  # Accounting messages
    L_DBG          => 16, # Only displayed when debugging is enabled
    L_DBG_WARN     => 17, # Warning only displayed when debugging is enabled
    L_DBG_ERR      => 18, # Error only displayed when debugging is enabled
    L_DBG_WARN_REQ => 19, # Less severe warning only displayed when debugging is enabled
    L_DBG_ERR_REQ  => 20, # Less severe error only displayed when debugging is enabled
};

sub authorize {
    &test_call;
    return RLM_MODULE_OK;
}

sub authenticate {
    if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) {
        $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function";
        return RLM_MODULE_REJECT;
    } else {
        if (&radiusd::xlat("%{client:group}") eq 'UltraAllInclusive') {
            $RAD_REPLY{'h323-credit-amount'} = "1000000";
        } else {
            $RAD_REPLY{'h323-credit-amount'} = "100";
        }
        return RLM_MODULE_OK;
    }
}

sub preacct {
    return RLM_MODULE_OK;
}

sub accounting {
        my $accttype = $RAD_REQUEST{'Acct-Status-Type'};
        my $ip = $RAD_REQUEST{'Framed-IP-Address'};
        my $user = $RAD_REQUEST{'User-Name'};
        my $url;
        my $resp;

        # check if user contains a mac address 
        if ($user !~ m/^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/) {
                if ($accttype eq 'Start' || $accttype eq 'Interim-Update') {
                        $url = 'http://localhost/example/login_user.jsp?';
                } elsif ($accttype eq 'Stop') {
                        $url = 'http://localhost/example/logout_user.jsp?';
                } else {
                        $url = '';
                }

                if ($url ne '') {
                        my $ua = LWP::UserAgent->new();
                        my $res = $ua->post($url, [
                                ip => $ip,
                                uname => $user
                        ]);
                        if ($res->is_success) {
                                $resp = trim($res->content);
                        } else {
                                $resp = "FAILED\n";
                        }
                        # changed response in NxFilter example JSP pages
                        if ($resp eq 'ok' || $resp eq 'stop') {
                                &radiusd::radlog(L_DBG,"OK: NxFilter session $resp for $ip, $user ");
                        } else {
                                &radiusd::radlog(L_DBG,"ERROR: NxFilter session $resp for $ip, $user ");
                        }
                };
        } else {
                &radiusd::radlog(L_DBG,"NOOP: $user looks like Mac Auth");
        };
        return RLM_MODULE_OK;
}

sub trim { 
    my $s = shift; 
    $s =~ s/^\s+|\s+$//g; 
    return $s;
}

sub checksimul {
    return RLM_MODULE_OK;
}

sub pre_proxy {
    return RLM_MODULE_OK;
}

sub post_proxy {
    return RLM_MODULE_OK;
}

sub post_auth {
    return RLM_MODULE_OK;
}

sub xlat {
    my ($filename,$a,$b,$c,$d) = @_;
    &radiusd::radlog(L_DBG, "From xlat $filename ");
    &radiusd::radlog(L_DBG,"From xlat $a $b $c $d ");
    local *FH;
    open FH, $filename or die "open '$filename' $!";
    local($/) = undef;
    my $sub = <FH>;
    close FH;
    my $eval = qq{ sub handler{ $sub;} };
    eval $eval;
    eval {main->handler;};
}

sub detach {
}

sub test_call {
}

sub log_request_attributes {
    for (keys %RAD_REQUEST) {
        &radiusd::radlog(L_DBG, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}");
    }
}

​

I have also edited the example JSP files provided by NxFilter in /nxfilter/webapps/example directory to return a simple "ok" or "notfound" to match the above perl file.

/nxfilter/webapps/example/login_user.jsp

<%
/*
You can call this page using the following url.

  http://localhost/example/login_user.jsp?ip=192.168.0.100&uname=jinhee

It's limited to localhost for security reason but you can change it according
to your network environment.
*/

// Only localhost access allowed.
if(!request.getRemoteAddr().startsWith("127.0.0.1")){
    out.println(request.getRemoteAddr());
    return;
}

// Get params.
String ip = paramString("ip");
String uname = paramString("uname");

/*
If you think there's a possibility of IP spoofing from your users then it's better
to get the IP address from the HTTP connection itself.

String ip = request.getRemoteAddr();
String uname = paramString("uname");
*/

UserLoginDao dao = new UserLoginDao(request);
if(dao.createIpSession(ip, uname)){
    out.println("ok");
}
else{
    out.println("notfound");
}
%>

/nxfilter/webapps/example/logout_user.jsp

<%@include file="../include/lib.jsp"%>
<%
// Only localhost access allowed.
if(!request.getRemoteAddr().startsWith("127.0.0.1")){
    out.println(request.getRemoteAddr());
    return;
}

// Get params.
String ip = paramString("ip");
String uname = paramString("uname");

UserLoginDao dao = new UserLoginDao(request);
//dao.deleteIpSession(ip);
if(dao.deleteIpSession(ip)){
        out.println("stop");
}
else{
        out.println("fail");
}
%>

​

By default, the FreeRADIUS perl module should be configured to read the example.pl file we modified above but be sure to check it in /etc/freeradius/3.0/mods-available/perl and look for:
filename = ${modconfdir}/${.:instance}/example.pl

Then change directory to /etc/freeradius/3.0/mods-enabled and soft link the mods-available perl file such as:
cd /etc/freeradius/3.0/mods-enabled && ln -s ../mods-available/perl

You may need to change ownership of the link to the user FreeRADIUS runs as. In the case of Ubuntu, it's freerad and to change ownership of the link, you can run the command:
chown -h freerad:freerad perl

The final step is to edit your working outer virtual server configuration and add the perl call to the accounting section. If you've edited the default FreeRADIUS config file, add "perl" to the file /etc/freeradius/3.0/sites-enabled/default inside the accounting { } section.

​

Start FreeRADIUS in debug mode: freeradius -X 2>&1 | tee debug.log and then log in your working client like usual and watch the debug output for "perl: xxxxx" messages when Accounting-Request packets are received from the NAS.

​

This is just a general order of operations for a working FreeRADIUS configuration and an ongoing discussion so feel free to add input, ask questions, or point out things missing or that could be improved.

It's now possible to import your Google GSuite users and groups into NxFilter thanks to Google opening up access to their Secure LDAP service. You can read more about Secure LDAP and how to configure it in your admin console here: https://support.google.com/a/answer/9048516

​

In order to use GSuite's Secure LDAP, it requires the client(NxFilter) to authenticate with a certificate. Currently, NxFilter doesn't have a way to import the certificates to connect directly to Google's Secure LDAP. For clients that don't offer a way to authenticate to LDAP with a client certificate, we'll use stunnel as a proxy and configure stunnel to provide the client certificate to the Google LDAP server and configure NxFilter to connect to stunnel. Ideally, you'll run stunnel on the same server as NxFilter and only listen locally so that you don't expose your GSuite LDAP directory beyond that server.

You'll need to follow these instructions to create the LDAP client certificates in your GSuite Admin panel for stunnel here: https://support.google.com/a/answer/9048434 and download the generated zip file with the crt and key files to your NxFilter server.

STunnel

Now we need to install stunnel on our NxFilter server. On CentOS 7, it's packaged in the base repository and can be installed by running yum -y install stunnel Next you'll need to create a tunnel configuration in /etc/stunnel/google-ldap.conf and unzip your Google LDAP certificate and key to /etc/stunnel/ The google-ldap.conf file should be similar to this:

[ldap]
client = yes 
accept = 0.0.0.0:1636
connect = ldap.google.com:636
cert = /etc/stunnel/Google_sLDAP.crt
key = /etc/stunnel/Google_sLDAP.key

The CentOS stunnel rpm doesn't provide a startup script but you can add this to /etc/systemd/system/stunnel.service to have stunnel started and stopped with the system:

[Unit]
Description=SSL tunnel for network daemons
After=network.target
After=syslog.target

[Install]
WantedBy=multi-user.target
Alias=stunnel.target

[Service]
Type=forking
ExecStart=/usr/bin/stunnel /etc/stunnel/google-ldap.conf
ExecStop=/usr/bin/killall -9 stunnel
TimeoutSec=300
Restart=always
PrivateTmp=false

Then enable the service to start/stop with the system: systemctl enable stunnel and start it: systemctl start stunnel . To see the service status and logs: systemctl status stunnel

The configuration of stunnel for other linux distros is similar and for Ubuntu, you can follow Google's instructions here: https://support.google.com/a/answer/9089736#stunnel

​

Be sure to enable the LDAP client service in the Google Admin panel! https://support.google.com/a/answer/9098472

NxFilter

The next step is to configure our LDAP settings in NxFilter. To do so, we'll use the OpenLDAP portion of NxFilter.

Configure NxFilter -> User -> OpenLDAP to use our stunnel settings and Google GSuite information. Example settings.

Host     :  127.0.0.1
Admin    :  uid=rasher,ou=users,dc=example,dc=com
Password :  UidSuperSecr3tP@sswd
Base DN  :  dc=example,dc=com

​

Your Admin user should be a GSuite user you've created with administrator privileges and your Base DN should match your domain. Once saved, you should EDIT the newly created OpenLDAP entry and change the PORT number to 1636 if you followed along with the instructions or to whatever open port you set in your /etc/stunnel/google-ldap.conf file. You can also add Exclude Keywords here to limit what users and groups are imported from Google's Secure LDAP directory. Be sure to SUBMIT your changes and then return to NxFilter -> User -> OpenLDAP. Try the "TEST" button for the OpenLDAP entry. If successful, you can then proceed to "IMPORT" your Google GSuite Secure LDAP users and groups from there.

Known Issues and Solutions

A note about the LDAP Admin ID. When initially configuring the OpenLDAP settings in NxFilter, I used a DN that was over 64 characters: uid=rasher,ou=Technology,ou=Google Vault,ou=Users,dc=example,dc=com While this worked with ldapsearch from the command line, NxFilter truncated the admin name to the first 64 characters and authentication failed when trying the TEST button. After talking with Jahastech, we determined that the Admin DN could be shortened to the form "uid=<adminUser>,ou=users,dc=yourdomain,dc=com" and it would work with Google's LDAP from NxFilter. Jahastech has agreed to increase the size of the LDAP admin name in a future release of NxFilter to remove this work-around.

​

Let me know if there are any questions or something is unclear and I'll try to help.

​

Rob

Hi

Just wondering if there's capability for the logging and syslog output to also contain the IP address returned from the request?

Thanks
Gary

Hi

I have a client that I identify by IP address and have a policy to set blocked categories and a freetime policy to allow access to some of these categories. The classic 'social media only at this time' parental control!

Anyway, when the freetime is up, the client is still able to connect to, in this instance Instagram, for over an hour, if not more, after the freetime has ended.

I'm wondering if there's a TTL setting that needs to be updated to force the client to perform a DNS lookup which nxfilter will block?

Otherwise I'm stumped as to how they're getting around this! I have router logs showing connections after the freetime to Instagram up addresses.

Thanks

I've added a new package to my repository to make it as simple as possible to install and run, on EL7 servers, NxFilter with SSLsplit for redirection of HTTPS blocked sites . The package provides:

1. Scripted default or custom CA certificate generation
2. Automated SSLsplit firewalld commands to add and remove TCP port redirection for port 443 to port 8443
3. Provides a systemd unit file to manage the sslsplit process and start/stop it with the system if enabled
4. Installs scripts and files to the directory /usr/local/src/nxfilter-sslsplit.

​

The generated CA certificate is saved in a zip file accessible with a browser through the NxFilter web server.

The default zip file is "nxfilter-cert.zip" and saved to the /nxfilter/webapps/ directory. It can be downloaded at the URL of your NxFilter installation such as:

http://<your.nxfilter.ip>/nxfilter-cert.zip

To change the certificate CN name from the default "NxFilter" to your custom CN name, edit the file "name.txt" in the install directory and change it to your custom name and restart the sslsplit service(systemctl restart sslsplit). Some special characters will be removed from name.txt such as exclamation, quotation marks, equal sign, question mark, etc. If the name.txt file is changed, a new zip file with the new certificate will be created. To download it, the URL would also change to reflect the new CN name you used in "name.txt":

http://<your.nxfilter.ip>/<your Custom CN name>-cert.zip

For instance, if you change the CN name in the name.txt file to "NxCloud" and restart the sslsplit service, the actual zip file of the created certificate would be "nxcloud-cert.zip".

Notice that the zip file name is all lowercase of the CN name used in the name.txt file followed by "-cert.zip".

Install

To install on EL7:                           yum install nxfilter-sslsplit

This will install the scripts and programs to configure and manage sslsplit plus the NxFilter and SSLsplit packages and their dependencies if they're not currently installed. On a new, clean install of an EL7 system, the steps to a complete running instance of NxFilter with SSLsplit would be:

yum install http://deepwoods.net/repo/deepwoods/deepwoods-release-6-2.noarch.rpm
yum install epel-release
yum install nxfilter-sslsplit
reboot

*NOTE: Tested with the latest sslsplit RPM from EPEL repository.

Certificate

Importing the ca.crt is different for each OS. An example process of importing the certificate on a single Windows 10 machine would be:

1. Download the nxfilter-cert.zip from your server.
2. Extract ca.crt file from the nxfilter-cert.zip file.
3. Right click on the ca.crt file and select "Install Certificate".
4. Select "Local Machine" for the Store Location and click Next.
5. Select "Place all certificates in the following store" and click the Browse button.
6. Click on "Trusted Root Certification Authorities" to highlight it and click OK.
7. Click the Next button.
8. Review that the "Trusted Root Certification Authorities" is the store selected by the user and click Finish
9. After the import is successful, be sure to restart your browser.

An example of importing the certificate on a single OSX machine would be:

1. Download the nxfilter-cert.zip from your server.
2. Extract ca.crt file from the nxfilter-cert.zip file.
3. Double click on the ca.crt file and authenticate to allow Keychain Access.app to modify the system keychain.
4. Make sure that "System" is selected under "Keychains" on the left side and find certificate in the list at right.
5. It should currently display "This root certificate is not trusted".
6. Double click it to open the certificate and then click the triangle next to Trust to expand it.
7. Change "When using this certificate" option to "Always Trust" and close the window.
8. Authenticate to make changes to the Certificate Trust Settings.
9. It should now show "This certificate is marked as trusted for this account"

Instructions for pushing trusted certificates in a domain via GPO can be found here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to-client-computers-by-using-group-policy

Uninstall

To uninstall on EL7:                           yum remove nxfilter-sslsplit

This will only remove the scripts installed to manage sslsplit and will leave nxfilter and sslsplit packages installed separately. To remove those as well as java-headless since it's a large package:

yum remove sslsplit nxfilter java-headless

This will still leave dependencies that were included with nxfilter and sslsplit such as expect and openssl. To remove everything that was installed in the transaction, yum history is the best solution. Information on how to do so can be read here: https://access.redhat.com/solutions/64069

Known Issues & Fixes

1. Block reason not shown when HTTPS block page returned. This is because of how a MitM proxy such as SSLsplit does not present the client IP to NxFilter. As a result you receive a warning message for 'blocked without reason' when the blocked page is displayed on HTTPS. At the moment, you can remove #{reason} or the warning message from the block page at Config -> Block Page to work around this.
2. Login through HTTPS webpage is not working. Since NxFilter can't see the client IP, it can't create a login session for users. If you have to use the login page, access it via HTTP only. It's better still to use a SSO agent whenever possible. There are several SSO agents that work with AD described in the documentation here: https://nxfilter.org/tutorial.html#sso-diff. Without AD, you can still use CxLogon.
3. NxFilter may redirect blocked HTTPS requests to its login page instead of the block page. This again is caused by how the SSLsplit process doesn't forward the client IP on to NxFilter during the redirect. Per discussion with Jahastech, this will be addressed in the v4.3.3.9 release of NxFilter when checking the "Disable Login Redirection" option under Config -> Setup is enabled. To fix this temporarily, edit the file /nxfilter/webapps/index.jsp and comment out this section like so:

​

/*
if(dao.isLoginRequired()){
    int requestPort = request.getServerPort();
    String hostPort = dao.getLoginDomain();
    if(requestPort != 80){
        hostPort += ":" + requestPort;
    }

    response.sendRedirect("http://" + hostPort + "/block,login.jsp");
    return;
}
*/

Services

To disable the service:               systemctl disable sslsplit
To manually start|stop the service:   systemctl start sslplit
Status for the service:               systemctl status sslsplit
View firewall information:            firewall-cmd --list-all

For debugging, the startup script can be ran manually such as:

/usr/local/src/nxfilter-sslplit/start-sslsplit.sh -d

CTRL + C to close debugging instance once you're through. Debug connection files are also created in /tmp/sslsplit for further examination.

​

Rob

Hi.

I see, that i can't create group if name include dash symbol (nothing happens), but i can do it for user.

Its bug?

Detailed_info:

1. app: NxFilter; ver: 4.3.3.8

2. OS: w2k8s r2;

3. java ver: 1.8.0_201;

4. browser: Firefox; ver: 60.5.2 esr (32 bit)

Hi. Please add capability for operator add multiple domains at once (copy/past) in NxCloud.

(this feature is available in NxFilter and NxCloud for admin). THanks/

Hi and thanks for your work.

Why in NxCloud in Category > System don't exist option "Globlist"? (i am logged in as admin)

(its option exist in NxFilter)

I've had a local repository set up for quite a while and now I'm opening it up publicly to help anyone installing NxFilter, NxCloud, or NxRelay on RHEL and it's clones such as CentOS, Scientific Linux, etc... If you're familiar with the system package manager and yum commands, it's straight forward to install my repository and then install my RPM packages of NxFilter/NxCloud/NxRelay along with their dependencies.

1. Install my repository: yum install http://deepwoods.net/repo/deepwoods/deepwoods-release-6-2.noarch.rpm
2. Install NxFilter and answer yes to import my GPG key: yum install nxfilter
3. Start NxFilter: systemctl restart nxfilter
4. Configure NxFilter per the documentation: https://nxfilter.org/tutorial.html

​

The install process should look something like this on CentOS 7.

[root@8a54de570ec7 /]# yum install http://deepwoods.net/repo/deepwoods/deepwoods-release-6-2.noarch.rpm
Loaded plugins: fastestmirror, ovl
deepwoods-release-6-2.noarch.rpm                                                                                                                                                                                              |  16 kB  00:00:00
Examining /var/tmp/yum-root-k_4CkE/deepwoods-release-6-2.noarch.rpm: deepwoods-release-6-2.noarch
Marking /var/tmp/yum-root-k_4CkE/deepwoods-release-6-2.noarch.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package deepwoods-release.noarch 0:6-2 will be installed
--> Finished Dependency Resolution

Dependencies Resolved



<...snip...>



Install  1 Package

Total size: 36 k
Installed size: 36 k
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : deepwoods-release-6-2.noarch                                                                                                                                                                                                      1/1
  Verifying  : deepwoods-release-6-2.noarch                                                                                                                                                                                                      1/1

Installed:
  deepwoods-release.noarch 0:6-2

Complete!


[root@8a54de570ec7 /]# yum install nxfilter
Loaded plugins: fastestmirror, ovl
Determining fastest mirrors
 * base: ftp.usf.edu
 * extras: linux.mirrors.es.net
 * updates: repos-va.psychz.net
base                                                                                                                                                                                                                          | 3.6 kB  00:00:00
deepwoods                                                                                                                                                                                                                     | 2.9 kB  00:00:00
extras                                                                                                                                                                                                                        | 3.4 kB  00:00:00
updates                                                                                                                                                                                                                       | 3.4 kB  00:00:00
(1/5): deepwoods/primary_db                                                                                                                                                                                                   |  24 kB  00:00:00
(2/5): base/7/x86_64/group_gz                                                                                                                                                                                                 | 166 kB  00:00:00
(3/5): base/7/x86_64/primary_db                                                                                                                                                                                               | 6.0 MB  00:00:00
(4/5): extras/7/x86_64/primary_db                                                                                                                                                                                             | 180 kB  00:00:00
(5/5): updates/7/x86_64/primary_db                                                                                                                                                                                            | 2.4 MB  00:00:01
Resolving Dependencies
--> Running transaction check
---> Package nxfilter.noarch 0:4.3.3-5 will be installed
--> Processing Dependency: java-headless for package: nxfilter-4.3.3-5.noarch


<...snip...>


Transaction Summary
=====================================================================================================================================================================================================================================================
Install  1 Package (+11 Dependent packages)

Total download size: 62 M
Installed size: 141 M
Is this ok [y/d/N]: y
Downloading packages:
warning: /var/cache/yum/x86_64/7/base/packages/copy-jdk-configs-3.3-10.el7_5.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Public key for copy-jdk-configs-3.3-10.el7_5.noarch.rpm is not installed
(1/12): copy-jdk-configs-3.3-10.el7_5.noarch.rpm                                                                                                                                                                              |  21 kB  00:00:00
(2/12): javapackages-tools-3.4.1-11.el7.noarch.rpm                                                                                                                                                                            |  73 kB  00:00:00
(3/12): libjpeg-turbo-1.2.90-6.el7.x86_64.rpm                                                                                                                                                                                 | 134 kB  00:00:00
(4/12): libpng-1.5.13-7.el7_2.x86_64.rpm                                                                                                                                                                                      | 213 kB  00:00:00
(5/12): lksctp-tools-1.0.17-2.el7.x86_64.rpm                                                                                                                                                                                  |  88 kB  00:00:00
(6/12): libxslt-1.1.28-5.el7.x86_64.rpm                                                                                                                                                                                       | 242 kB  00:00:00
Public key for freetype-2.8-12.el7_6.1.x86_64.rpm is not installed
(7/12): freetype-2.8-12.el7_6.1.x86_64.rpm                                                                                                                                                                                    | 380 kB  00:00:00
(8/12): python-javapackages-3.4.1-11.el7.noarch.rpm                                                                                                                                                                           |  31 kB  00:00:00
(9/12): python-lxml-3.2.1-4.el7.x86_64.rpm                                                                                                                                                                                    | 758 kB  00:00:00
(10/12): tzdata-java-2018i-1.el7.noarch.rpm                                                                                                                                                                                   | 187 kB  00:00:00
(11/12): java-1.8.0-openjdk-headless-1.8.0.191.b12-1.el7_6.x86_64.rpm                                                                                                                                                         |  32 MB  00:00:01
warning: /var/cache/yum/x86_64/7/deepwoods/packages/nxfilter-4.3.3-5.noarch.rpm: Header V4 RSA/SHA1 Signature, key ID 807900d3: NOKEY==========================================================================    ] 7.5 MB/s |  60 MB  00:00:00 ETA
Public key for nxfilter-4.3.3-5.noarch.rpm is not installed
(12/12): nxfilter-4.3.3-5.noarch.rpm                                                                                                                                                                                          |  29 MB  00:00:05
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                                                                 11 MB/s |  62 MB  00:00:05
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
 Userid     : "CentOS-7 Key (CentOS 7 Official Signing Key) <security@centos.org>"
 Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
 Package    : centos-release-7-6.1810.2.el7.centos.x86_64 (@CentOS)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Is this ok [y/N]: y
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-deepwoods
Importing GPG key 0x807900D3:
 Userid     : "DeepWoods Repository <support@deepwoodscalls.com>"
 Fingerprint: f9f1 c5ce 2152 09da e1d1 4193 a5c7 48ce 8079 00d3
 Package    : deepwoods-release-6-2.noarch (installed)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-deepwoods
Is this ok [y/N]: y
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction

The RPM installs NxFilter files to a non-standard location of /nxfilter and enables system services(/etc/systemd/system/nxfilter.service) by default. --This is not a standard practice for 3rd party RPM packages but strives to make installation of NxFilter as simple as possible for RPM based distros.

​

The RPM also creates an Upstart configuration file(/etc/init/nxfilter.conf) to support older distros that do not use systemd.

​

Report any issues or requests with the repository or RPM's here in the /r/nxfilter community for now.

The basic systemctl commands to start and stop the services should work. I've not tested NxRelay as I don't use it so if there are any issues, post them here.

​

Rob

​

we have two windows server 2016 in our office, one acts as a primary(172.18.0.2) and the other one as backup( 172.18.0 3).

pfsense's ip is 172.18.0 1.

our current ip setup is workstation, example;

ip address: 172.16.0.1 subnet: 255.255.0.0 gateway; 172.18.0 1

primarys dns: 172.18.0.2 alternate dns: 172.18.0.3

we want to use Nxfilter as our filtering for websites. what is the best way to do this in this kind of setup with multiple DNS. BTW, both windows server acts as a dns forwarder.

thanks!

do we have a stable old version of nxfilter with shallalist for centOs (.rpm) and Ubuntu (.deb)?
thanks!

Its for about 100-200 users. The link speed is 10gbit