HTTP Proxy

8.1. General configuration

Through HTTP Proxy → General you can access into the eBox's proxy HTTP general configuration.

At the configuration window these options are detailed:

Transparent proxy

If transparent proxy is enabled, every eBox user will use the transparent proxy without noticing it. If it is disabled, you should configure each browser to work through the proxy.

Warning

Transparent proxy feature is only working when eBox has at least an internal and an external interface

Port

You can assign a proxy port. It will be used by the browsers, inside the network, to connect to Internet.

Default policy

It is the default policy for the proxy users. Free (allow all) access, filter contents or always deny access can be selected. Later, this policy can be modified for each network object where you need an specific behaviour, as it is explained below

Warning

If you establish a configuration which denies access to administration interface from the machines connected to eBox, you should allow the host where you want to connect from, or you could lose the connection with the web interface.

8.2. Filter settings

At HTTP Proxy → Filter settings, you can select the filter settings to those elements of this network which set their policy to filter.

Warning

The filter needs a 'filter' policy to be in effect

You may set the content filter threshold which establishes a restriction level to web contents with explicit sex and violence items to be filtered by the proxy.

To perform a more detailed filter policy. A tab menu is shown with the following elements:

File extensions filtering

You may choose which file extensions are allowed to be downloaded through the HTTP proxy. To allow extensions you must edit the row and check the box in the Allow element. A special "All extensions" form exists to apply the same policy to all extensions at once. You may add as many extensions you require by adding new ones. Several ones are set by eBox.

Any extension not listed here is, by default, allowed. In future releases, this behaviour may change.

MIME type filtering

You may select which file MIME types are allowed to be downloaded through the HTTP proxy. The management is analogous to the extension filtering explained above.

Domains filtering

You may customise which domains are allowed or denied to visit by editing the table Domains list. Write the full domain name, whose default behaviour you require to change. The domain name does not require the "www" string. For instance, you add as allowed domain "www.warp.es", we'd set "warp.es" domain.

Furthermore, you may block those domain sites which are not in the domains list overriding default allowance policy. It also let block those sites which does not have a fully qualified name (FQDN) and, therefore, they use an IP address to access to their content

8.3. Policy establishment

Through HTTP Proxy → Objects' Policy it is possible to establish one connection policy for every network object, allowing a different configuration for each newly created objects. This configuration will be applied previously to the eBox global policy for the selected objects.

Firewall

6.1. Firewall in eBox

One of the most important features in eBox is its firewall module. You can access it through Firewall . There you can make packet filtering (Section 6.3) or port redirection (Section 6.2).

The firewall has different behaviour with external or internal network interfaces.

The internal interfaces are connected to local networks. They had not restrictions as the external interfaces have.

The external interfaces are connected to external networks and eBox only allows redirections from them.

6.2. Port Redirects

Port redirects allow to get external traffic into a host behind a eBox system with firewall module installed. You can get the configuration of these options at Firewall → Redirects .

If you need to add a new redirect, first select your desired Interface which will listen incoming connections. This should be one of the interfaces previously selected as external. Moreover, it should be assigned the External port where you expect your incoming traffic, and the protocol that will be used.

You should enter the destination system IP address and its Port where packets would go on.

Once you have selected this data, you just need to select between the different Actions, the Add one, and click on it.

To remove a rule, you should select remove between the available Actions, and click on it.

Redirect configuration can be modified by changing its parameters and clicking on their modify Actions.

6.3. Packet filter

From Firewall → Packet filter you can configure packet filter rules. You may use the abstractions provided above such as network services and network objects. Using these concepts enhances the rules flexibility and clearness, reducing the amount.

At first sight, we have five different traffic flows to set your firewall rules to them.

From internal networks to eBox

These rules are meant to control access from internal network interfaces to services running on your eBox machine. Several eBox modules may add filtering rules for you to manage eBox services easily.

For internal networks

These rules allow you to control access from your internal networks to the Internet, and traffic between your internal networks.

Coming out from eBox

These rules allow you to control access from eBox to external services.

From external networks to eBox

These rules allow you to control access from external networks to services running on your eBox machine.

From external networks to internal networks

These rules allow you to control access from external networks to internal networks.

Take into account to the last two set of rules that it is granted access to untrusted networks to your managed networks. This may compromise your network security. As eBox secure by default policy recommends, do not modify these rules unless you know what you are doing. The figure Figure 6.1 try to make up the concept:

Figure 6.1. Firewall rules set

The deny policy for eBox firewall is a ignorance one. Every denied packet is filtered and discarded without any notification.

Every set of rules define a fixed behaviour for the traffic flows that they apply. These rules will be matched from top to the bottom, thus order is important. Each rule consists of these following fields, some of them are only available to several rule set by construction:

Decision

Accept or deny. This explicitly accepts or denies a traffic flow.

Source

The traffic flow origin. It may be a network object or a single IP address. This field is available for every rule set except for "Filtering rules for traffic coming out from eBox"

Destination

The traffic flow target. It may be a network object or a single IP address. This field is available for "For internal networks", "Coming out from eBox" and "From external networks to internal networks" filtering rules.

Service

The traffic flow service as it is described in Chapter 5. The match could be inverse one, i.e. the inverse "any" service is "none" service. This is a compulsory field, therefore in order to create a new rule, it is required to have a network service. If it does not exist, you must make up previously.

Description

An optional description to ease the firewall rule set management.

Network services

5.1. Network services in eBox

As it happened in Chapter 4, the network services are an abstraction to ease the management of your network. Each network service describes a set of ports for Internet protocols where service accepts requests. Providing a name plus an optional description allows you to manage the network service policies more intuitively and less error-prone.

The network services are used by firewall module (Chapter 6) and traffic shaping module (Chapter 19). Anyway, as eBox philosophy every feature which use a network service must use this module to work with and ease the administration life.

5.2. Network services management

In order to get the network service management you may go to Services.

As you may notice, there are several services which have been created by eBox for you. These services are used by eBox modules afterwards. For instance, dhcp service is described as an internal service called 'Dynamic Host Configuration Protocol'.This service is read-only as it is already managed by dhcp module automatically. Each service has a configuration where the service protocol, well-known source and destination ports are set. There are three special services which define the generic abstraction for every service (any) and every TCP/UDP service. They are entered to handle easily rules defined in other modules that depends on this network services.

You may input a new service with these following elements:

Service name

The name for the service which refers uniquely this service in the system

Description

This field defines the verbose description for the network service to ease the administration management. It is an optional field.

Internal

When a network service is set as internal, those protocol/port pairs that owns this service will be set as busy, that is not available for others services to use.

Configuration

The service configuration is a multiple value configuration setting which may contain these three elements:

Protocol

The Internet protocol which may set one of these values: TCP/UDP, TCP, UDP, GRE, ICMP or "any". If the protocol is set to GRE or ICMP, then it is banned to set any port since it is banned by protocol construction

Source port

A well-known source port may contain one of the following:

• Any. Indicates any port for that protocol or set of them

• Single port. Indicates a single port for that protocol or set of them

• Port range. Indicates a port range including all of them for that protocol or set of them

Destination port

Analogously with source port, the same elements appear in destination port.

You might inspect several system-defined services prior to add your own ones. Anyway, a user-defined service may be created when additional network services be installed on top of an eBox installation, for example introducing FTP (File Transfer Protocol) service.

Example 5.1. Service configuration example

• Service name. ftp

• Description. File Transfer Protocol

• Internal. yes

• Configuration:

  • protocol: tcp, source port: any, destination port: 20 (Define the control connection channel)

  • protocol: tcp, source port: any, destination port: 21 (Define the data flow connection channel)

Network objects

4.1. What the network objects are?

Network objects are an easy way to give a name to a network item, or a group of them. They are used to simplify network configuration management, allowing you to choose different behaviors for each item or group of them with just a descriptive name.

Network objects can be used, for instance, to five a name to an IP or a group of IPs. If the object is a group of IPs, instead of defining some rules for each IP, every IP inside the object will acquire that configuration.

4.2. Network objects management

Network objects used by eBox can be created, modified and erased in an easy and intuitive way using the web interface.

You may add as many objects you want. A name must be provided to the object. After that, you may enter into members field where you may define:

• Name : name assigned to the member.

• IP address : member IP address

• Network mask : network mask, using CIDR notation

• MAC (optional): hardware address -or MAC address- of the network interface corresponding to that IP address.

Editing an object or a member of it is done by clicking the pencil icon in Action field. Likewise the object/member removal is done by clicking on the trash can icon.

Booting Windows dari Flashdisk

Artikel kali ini saya akan berbagi ilmu yang saya dapatkan ketika kuliah. Waktu itu saya mendapat masalah pada system operasi saya, jalan terakhir solusinya yaitu Instal ulang Windows XP. Tapi ternyata CD ROM computer saya rusak entah kenapa. Karena computer pada saat itu sangat saya perlukan, maka saya mencari cara lain untuk bisa install XP tanpa melalui CD ROM.

Singkat cerita saya saya mendapatkan sebuah free software yang berfungsi untuk install ulang sebuah OS tanpa menggunakan CD ROM. Nama Software tersebut ialah PeToUSB, bagi Anda yang memerlukan software ini bias di search di om GOOGLE.
Caranya mudah sekali, silahkan ikuti langkah-langkah berikut setelah Anda memiliki software tersebut:

1. Extract file bernama PeToUSB_3.0.0.7.rar

2. Buka folder hasil extractnya kemudian klik dua kali file bernama PeToUSB.exe.

3. Masukkan Flashdisk berkapasitas min. 1 GB

3. Setelah keluar jendela PeToUSB, pilih option button USB Removable dan pilih USB Anda.

4. Contreng enable Disk Format

5. Pada source path, cari File Windowsnya.

6. Setelah semua selesai, klik start dan ikuti petunjuk berikutnya.

Proses ini memakan waktu cukup lama. Setelah selesai lakukan instalasi windows seperti biasanya dengan menggunakan first boot dari flashdisk.

Semoga Bermanfaat

dikutip dari ib-raspati.co.cc