Recommended Minimal Configuration - Revision history

Steve at 10:41, 13 October 2022

2022-10-13T10:41:39Z

← Older revision		Revision as of 11:41, 13 October 2022
Line 135:		Line 135:

	=== Safe search ===		=== Safe search ===
	We recommend that the ''Enforce Strict Safe Search'' setting is enabled for the ''Everyone'' group on the [[Web Safe Search\|Safe Search]] page.		We recommend that the ''Enforce Strict Safe Search'' setting is enabled for the ''Everyone'' group on the [[Web: Safe Search\|Safe Search]] page.

	[[Category:Product Manuals]]		[[Category:Product Manuals]]

Steve at 10:37, 13 October 2022

2022-10-13T10:37:45Z

← Older revision		Revision as of 11:37, 13 October 2022
Line 75:		Line 75:

	=== Blocked categories ===		=== Blocked categories ===
	The [[Web Blocked Categories\|Blocked Categories]] determine which categories of web site are blocked. We highly recommend that at least the following categories are blocked in the ''Everyone'' group:		The [[Web: Blocked Categories\|Blocked Categories]] determine which categories of web site are blocked. We highly recommend that at least the following categories are blocked in the ''Everyone'' group:

	* Anonymisers / Proxies / VPNs		* Anonymisers / Proxies / VPNs

Steve at 10:36, 13 October 2022

2022-10-13T10:36:05Z

← Older revision		Revision as of 11:36, 13 October 2022
Line 88:		Line 88:

	=== Overrides ===		=== Overrides ===
	[[Web Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:		[[Web: Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:

	* Disable auth		* Disable auth

Steve at 09:50, 12 October 2022

2022-10-12T09:50:42Z

← Older revision		Revision as of 10:50, 12 October 2022
Line 2:		Line 2:

	== Firewall zones ==		== Firewall zones ==
	The [[Firewall Zones]] come preconfigured to consider all private addresses to be part of the LAN. This should be reconfigured to match the real layout of your internal networks.		The [[Firewall: Zones]] come preconfigured to consider all private addresses to be part of the LAN. This should be reconfigured to match the real layout of your internal networks.

	Opendium Web Gateway does not support multiple internal network zones, so all of the internal networks must be added to the LAN zone.		Opendium Web Gateway does not support multiple internal network zones, so all of the internal networks must be added to the LAN zone.
Line 44:		Line 44:

	=== Egress ===		=== Egress ===
	The [[Firewall Egress\|Egress]] rules control connections from within your network to the internet. The policy should be set to ''Intercept'' in the Everyone group, which will cause all traffic between your internal networks and the internet to be blocked, with the exception of:		The [[Firewall: Egress\|Egress]] rules control connections from within your network to the internet. The policy should be set to ''Intercept'' in the Everyone group, which will cause all traffic between your internal networks and the internet to be blocked, with the exception of:

	* Web traffic will be intercepted and redirected through the Opendium system's transparent web proxy and filter.		* Web traffic will be intercepted and redirected through the Opendium system's transparent web proxy and filter.
Line 55:		Line 55:

	=== Ingress ===		=== Ingress ===
	The [[Firewall Ingress\|Ingress]] rules control connections from the internet to devices within your network. The policy should be set to ''Block'' in the Everyone group, since allowing indiscriminate connections from the internet into your network is a security risk.		The [[Firewall: Ingress\|Ingress]] rules control connections from the internet to devices within your network. The policy should be set to ''Block'' in the Everyone group, since allowing indiscriminate connections from the internet into your network is a security risk.

	If you are operating any internal servers which need to be accessible from the internet, you will need to create appropriate groups and networks for those servers and add suitable ingress bundles and NAT mappings to them.		If you are operating any internal servers which need to be accessible from the internet, you will need to create appropriate groups and networks for those servers and add suitable ingress bundles and NAT mappings to them.

	=== Internal ===		=== Internal ===
	The [[Firewall Internal\|Internal]] rules on Opendium UTM control traffic between internal networks which are in different [[Firewall Zones\|Zones]]. The policy should be set to ''Block'' in the Everyone group, to isolate the networks. Additional bundles can be added to allow specific types of traffic between networks.		The [[Firewall: Internal\|Internal]] rules on Opendium UTM control traffic between internal networks which are in different [[Firewall: Zones\|Zones]]. The policy should be set to ''Block'' in the Everyone group, to isolate the networks. Additional bundles can be added to allow specific types of traffic between networks.

	Opendium Web Gateway does not have this capability.		Opendium Web Gateway does not have this capability.

	=== NAT ===		=== NAT ===
	A suitable prefix needs to be configured within the [[Firewall NAT\|NAT]] page to translate the source addresses of egress (outbound) connections from your network to the internet. This will often be the external IP address of your Opendium system.		A suitable prefix needs to be configured within the [[Firewall: NAT\|NAT]] page to translate the source addresses of egress (outbound) connections from your network to the internet. This will often be the external IP address of your Opendium system.

	=== Services ===		=== Services ===
	The [[Firewall Services\|Services]] page controls which of the Opendium system's services are exposed to the internet.		The [[Firewall: Services\|Services]] page controls which of the Opendium system's services are exposed to the internet.

	HTTP (required to renew encryption certificates), Secure Shell (for Opendium engineer access) and ICMP (for connectivity monitoring) should all be enabled.		HTTP (required to renew encryption certificates), Secure Shell (for Opendium engineer access) and ICMP (for connectivity monitoring) should all be enabled.

Steve at 09:47, 12 October 2022

2022-10-12T09:47:10Z

← Older revision		Revision as of 10:47, 12 October 2022
Line 21:		Line 21:
	The system comes preconfigured with all of the standard private addresses in the ''Networks'' group, but it is a good idea to trim this down to better match your network's configuration. Often the overarching network will be a single entry for the IPv4 network, such as 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and a single entry for the IPv6 prefix (if there is one). However, some schools may have more complex networks that require multiple network objects to be created. In the example above, we have defined a single 10.0.0.0/8 IPv4 network and a single 2001:DB8:c0ff:ee00::/56 IPv6 network.		The system comes preconfigured with all of the standard private addresses in the ''Networks'' group, but it is a good idea to trim this down to better match your network's configuration. Often the overarching network will be a single entry for the IPv4 network, such as 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and a single entry for the IPv6 prefix (if there is one). However, some schools may have more complex networks that require multiple network objects to be created. In the example above, we have defined a single 10.0.0.0/8 IPv4 network and a single 2001:DB8:c0ff:ee00::/56 IPv6 network.

	You can create subgroups for specific parts of your network. In the example above, we have created groups for ''LAN'', and ''Wifi'' and subdivided the ''Wifi'' group into ''Staff wifi'', ''Student wifi'', ''Guest wifi'' and ''Unfiltered wifi'', with appropriate networks within each. This allows us to set specific configuration for those networks. For example, we may want to set the web proxy's [[Web Permissions & Limits#User identification\|User Identification]] profile to ''RADIUS'' for the ''Wifi'' group, and disable [[Web Permissions & Limits#User identification\|User Identification]] and switch [[Web Permissions & Limits#HTTPS decryption\|HTTPS Decryption]] into Passive mode for ''Guest wifi''. We've also added a ''Servers'' group within the ''LAN'', since servers often need different settings compared to the rest of the LAN.		You can create subgroups for specific parts of your network. In the example above, we have created groups for ''LAN'', and ''Wifi'' and subdivided the ''Wifi'' group into ''Staff wifi'', ''Student wifi'', ''Guest wifi'' and ''Unfiltered wifi'', with appropriate networks within each. This allows us to set specific configuration for those networks. For example, we may want to set the web proxy's [[Web: Permissions & Limits#User identification\|User Identification]] profile to ''RADIUS'' for the ''Wifi'' group, and disable [[Web: Permissions & Limits#User identification\|User Identification]] and switch [[Web: Permissions & Limits#HTTPS decryption\|HTTPS Decryption]] into Passive mode for ''Guest wifi''. We've also added a ''Servers'' group within the ''LAN'', since servers often need different settings compared to the rest of the LAN.

	We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.		We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.
Line 102:		Line 102:

	=== Permissions & limits ===		=== Permissions & limits ===
	We recommend the following settings are applied to the ''Everyone'' group on the [[Web Permissions & Limits\|Permissions & Limits]] page:		We recommend the following settings are applied to the ''Everyone'' group on the [[Web: Permissions & Limits\|Permissions & Limits]] page:

	* Allow users to override a block: Disabled		* Allow users to override a block: Disabled

Steve at 16:30, 11 October 2022

2022-10-11T16:30:08Z

← Older revision		Revision as of 17:30, 11 October 2022
Line 21:		Line 21:
	The system comes preconfigured with all of the standard private addresses in the ''Networks'' group, but it is a good idea to trim this down to better match your network's configuration. Often the overarching network will be a single entry for the IPv4 network, such as 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and a single entry for the IPv6 prefix (if there is one). However, some schools may have more complex networks that require multiple network objects to be created. In the example above, we have defined a single 10.0.0.0/8 IPv4 network and a single 2001:DB8:c0ff:ee00::/56 IPv6 network.		The system comes preconfigured with all of the standard private addresses in the ''Networks'' group, but it is a good idea to trim this down to better match your network's configuration. Often the overarching network will be a single entry for the IPv4 network, such as 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and a single entry for the IPv6 prefix (if there is one). However, some schools may have more complex networks that require multiple network objects to be created. In the example above, we have defined a single 10.0.0.0/8 IPv4 network and a single 2001:DB8:c0ff:ee00::/56 IPv6 network.

	You can create subgroups for specific parts of your network. In the example above, we have created groups for ''LAN'', and ''Wifi'' and subdivided the ''Wifi'' group into ''Staff wifi'', ''Student wifi'', ''Guest wifi'' and ''Unfiltered wifi'', with appropriate networks within each. This allows us to set specific configuration for those networks. For example, we may want to set the web proxy's [[User Identification]] profile to ''RADIUS'' for the ''Wifi'' group, and disable [[User Identification]] and switch [[HTTPS Decryption]] into Passive mode for ''Guest wifi''. We've also added a ''Servers'' group within the ''LAN'', since servers often need different settings compared to the rest of the LAN.		You can create subgroups for specific parts of your network. In the example above, we have created groups for ''LAN'', and ''Wifi'' and subdivided the ''Wifi'' group into ''Staff wifi'', ''Student wifi'', ''Guest wifi'' and ''Unfiltered wifi'', with appropriate networks within each. This allows us to set specific configuration for those networks. For example, we may want to set the web proxy's [[Web Permissions & Limits#User identification\|User Identification]] profile to ''RADIUS'' for the ''Wifi'' group, and disable [[Web Permissions & Limits#User identification\|User Identification]] and switch [[Web Permissions & Limits#HTTPS decryption\|HTTPS Decryption]] into Passive mode for ''Guest wifi''. We've also added a ''Servers'' group within the ''LAN'', since servers often need different settings compared to the rest of the LAN.

	We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.		We recommend setting up a completely unfiltered wifi network, to be '''only''' used for temporary testing and device onboarding. Since such a network is a potential risk, ensure that the password is kept secure, and consider restricting it only to certain parts of the school, such as the ICT office.

Steve: /* Group configuration */

2022-10-11T11:28:22Z

Group configuration

@@ Line 13: / Line 13: @@
 There are very few restrictions placed on the groups and you are therefore free to arrange the groups as you wish, but the recommendations below provide a good starting point and are formed by many years of experience.  This is a typical structure for a secondary school:
-* '''GROUP:''' Everyone
+{{Recommended Group Structure}}
 There are a few special groups - ''Everyone'' is always at the root of the tree.  Users within the ''Administrators'' group have administrative access to the system.  The ''Anonymous'' group is also a special case and is used in situations where no other groups are applicable.  Typically, the ''Anonymous'' group is left empty.

Steve: /* Permissions & limits */

2022-10-11T10:36:08Z

Permissions & limits

← Older revision		Revision as of 11:36, 11 October 2022
Line 147:		Line 147:
	* Autoconfigure devices to use the proxy: Enabled		* Autoconfigure devices to use the proxy: Enabled
	* User identification: Enabled (the most suitable profile to use depends on your network)		* User identification: Enabled (the most suitable profile to use depends on your network)
			* Restrict requests to IP literals: Block all
	* Allow users to access reports: Disabled		* Allow users to access reports: Disabled

Steve at 16:13, 10 October 2022

2022-10-10T16:13:32Z

← Older revision		Revision as of 17:13, 10 October 2022
Line 124:		Line 124:
	You may want to add more categories here, or in more specific subgroups. However, keep in mind that more is not always better. For example, blocking Offensive Language may be desirable for primary school children, but is likely to result in significant overblocking for staff and secondary school children.		You may want to add more categories here, or in more specific subgroups. However, keep in mind that more is not always better. For example, blocking Offensive Language may be desirable for primary school children, but is likely to result in significant overblocking for staff and secondary school children.

	=== ~~Filter~~ Overrides ===		=== Overrides ===
	[[Web ~~Filter~~ Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:		[[Web Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:

	* Disable auth		* Disable auth

Steve at 13:14, 10 October 2022

2022-10-10T13:14:00Z

← Older revision		Revision as of 14:14, 10 October 2022
Line 109:		Line 109:
	HTTP (required to renew encryption certificates), Secure Shell (for Opendium engineer access) and ICMP (for connectivity monitoring) should all be enabled.		HTTP (required to renew encryption certificates), Secure Shell (for Opendium engineer access) and ICMP (for connectivity monitoring) should all be enabled.

	== Web ~~proxy~~ settings ==		== Web settings ==

	=== Blocked categories ===		=== Blocked categories ===
	The [[Web ~~Proxy~~ Blocked Categories\|Blocked Categories]] determine which categories of web site are blocked. We highly recommend that at least the following categories are blocked in the ''Everyone'' group:		The [[Web Blocked Categories\|Blocked Categories]] determine which categories of web site are blocked. We highly recommend that at least the following categories are blocked in the ''Everyone'' group:

	* Anonymisers / Proxies / VPNs		* Anonymisers / Proxies / VPNs
Line 125:		Line 125:

	=== Filter Overrides ===		=== Filter Overrides ===
	[[Web ~~Proxy~~ Filter Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:		[[Web Filter Overrides]] allow certain aspects of the web proxy and filter to be disabled for specific websites. The following are the default overrides which we recommend to be applied to the ''Everyone'' group:

	* Disable auth		* Disable auth
Line 139:		Line 139:

	=== Permissions & limits ===		=== Permissions & limits ===
	We recommend the following settings are applied to the ''Everyone'' group on the [[Web ~~Proxy~~ Permissions & Limits\|Permissions & Limits]] page:		We recommend the following settings are applied to the ''Everyone'' group on the [[Web Permissions & Limits\|Permissions & Limits]] page:

	* Allow users to override a ~~web proxy~~ block: Disabled		* Allow users to override a block: Disabled
	* Bypass all web ~~proxy~~ restrictions: Disabled		* Bypass all web restrictions: Disabled
	* HTTPS decryption: Active		* HTTPS decryption: Active
	* Display splash page for new devices: Disabled		* Display splash page for new devices: Disabled
Line 162:		Line 162:
	If you have an unfiltered wifi network, we recommend setting the following on its group:		If you have an unfiltered wifi network, we recommend setting the following on its group:

	* Bypass all web ~~proxy~~ restrictions: Enabled		* Bypass all web restrictions: Enabled
	* HTTPS decryption: Disabled		* HTTPS decryption: Disabled
	* Display splash page for new devices: Disabled		* Display splash page for new devices: Disabled
Line 171:		Line 171:

	=== Safe search ===		=== Safe search ===
	We recommend that the ''Enforce Strict Safe Search'' setting is enabled for the ''Everyone'' group on the [[Web ~~Proxy~~ Safe Search\|Safe Search]] page.		We recommend that the ''Enforce Strict Safe Search'' setting is enabled for the ''Everyone'' group on the [[Web Safe Search\|Safe Search]] page.

	[[Category:Product Manuals]]		[[Category:Product Manuals]]