Security

Ask something
Discussion Locked

Students bypassing filtering

0 helpful
15 replies

by cporter

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I work for a large school district. We have a problem with students and teachers byapssing our filtering system (websense). They are simply entering in a proxy server into the browser and it's past the firewall etc. The machines in question are personal laptops and old win9x machines so the group policy isnt an option. We do not have any kind of network registration system in place either. Does anyone know how to prevent this? We are running a PIX firewall version 7. Any help would be greatly appreciated.

Chris

15 replies

by royceb1

We represent several school districts that HAD the same problem. We installed the Sonicwall appliance and configured them as required to filter and block. WORKS GREAT.

by tombrend

Sonicwall has immense issues with improperly blocking sites and being easily circumvented. Google caches of blocked sites are not blocked unless google is blocked completly, and proxies such as proxify are easily accessed by using https protocol on an http site: the added s causes sonicwall to overlook it.

by witch_walker

yes, you can. the school my daughter goes to blocks everytning from hacking to websense avoidance and proxy servers.

by brianfurtado

Do you listen to yourself when you talk? Get this straight... it takes weeks/months to accurately fix holes in blocking programs, but only hours to create them. You may THINK that your daughter's school blocks hack attacks and proxies, but it's called hacking for a reason. There's a great program out there called ultrasurf... it is virtually impossible to block. That's the very same program that the chinese population mainly uses to bypass the CHINESE GOVERNMENT'S blocks. If they can't block Usurf, neither can you

by vishal_saxena02

re-organise the topology in such a way that firewall becomes the gateway to the proxy server. That is, any access to proxy server should be via the firewalls.
Also, block those sites in the proxy server. you can use SQUID as your proxy server. it comes with list of blacklisted sites, and you can add more.

by lesko

Setup your PIX to only allow outbound traffic from a certain subnet coming in from one of its internal ports. The these internal ports would be the users you want to get out freely and one of them would be the websense box. The rest of the traffic route them over to the websense box.

regular traffic --> default gateway --> websense --> pix --> Internet

special traffic --> default gateway --> pix --> Internet

the default gateway could be the same as the pix

by dmudaliar

Include following command in PIX :
url-server (interface-of-Websense) host A.B.C.D timeout 10
filter url http X.Y.Z.U 255.255.255.0 0.0.0.0 0.0.0.0 allow

X.Y.Z.U is traffic to pass

by sawshop

Our district has the same problem. We have a PIX and use a Barracuda web filter. The point is that there at tens of thousands of proxy sites and more added daily. Some of our high school students get new ones in their email every morning. Kids want to get into MySpace and gaming sites and they will.
What it comes down to is having clear policies and holding teachers accountable for what happens in their classrooms.

by techrep_route.20.crowem

You said you are running PIX 7.0. Are you running a Cisco Router in your edge stack? If so, you can implement Network Admission Control (NAC) for free in IOS 12.3 at the router.

by sabrodiesel2000

Ok seriously your topology needs modification. You need to restrict users to not being able to make changes in settings on internet explorer. If that is not an option then configure your network to authorize IDs and apply restrictions to those IDs. If that is not an option as well then go for SQUID or CyberArmour. They are good firewalls and they should do the trick. Your requirements had alot of limitations but lets hope that would have been the answer to your questions.

by Former member

then educate don't restrict.

Restrictions can and always will be broken and the students are mostly more savvy than you think.

This discussion is closed to new replies.