0

We are having a internet cafe with guests walking in and out. We would like to keep an eye on browsing traffic on LAN 192.168.2.0/24, because we don't want guests to visit wrong websites. In such situations, we can remove people from our internet cafe. This could happen rarely, but we want to prevent this on-time.

We have Windows clients generally. We need some kind of overview, containing URL's on client PC's with associated host name. Which can be accessed on the same subnet, from Linux or Windows. The disadvantage in this environment is: the cooperation don't want to make any changes in the router configuration. And this makes me curious if there is someway to accomplish this from another system, without making client-side changes and/or router changes.

What do we need for this?

  • 1
    don't you have firewall? – infra May 16 '19 at 8:48
  • More and more businesses are outsourcing guest access to companies that specialize in doing that because of the legal liabilities when a guest network is misused for illegal activity. The companies that provide this service have the expertise to block such activity. – Ron Maupin May 16 '19 at 14:47
  • Ok. Thats too bad! Some people also look for a way to do this by themself, like me actually. Just curious for some software names. We have an openmediavault server on the local net (debian-based), but not yet configured as a firewall for blocking erotic traffic. – l4jos May 27 '19 at 12:32
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 3:17
3

We would like to keep an eye on browsing traffic on LAN 192.168.2.0/24, because we don't want guests to visit wrong websites.

Instead of "keeping an eye" on specific traffic you should simply block unwanted traffic.

  1. Separate guest subnet from management subnet by firewall.
  2. Allow guest subnet access to Internet but not to management network.
  3. Allow management network access anywhere.

We need some kind of overview, containing URL's on client PC's with associated host name.

In order to monitor the URLs visited by clients you'll need to break SSL encryption - most web traffic is HTTPS nowadays. You need to deploy your own CA certificate on the clients and set up a firewall with deep SSL inspection support.

the cooperation don't want to make any changes in the router configuration.

Without setting up the network appropriately, this is close to undoable. However, you can add a firewall behind the router without it requiring changes.

In a rather simple scenario, you could alternatively set up a managed switch and use ACLs to filter out any unwanted traffic.

  • Yes, that's a good practice for most public environments and I had the same idea as you. But my employer does not feel the need yet for content blocking implementations on network-level. Collaborating this idea makes sense to him, but I can't convince the whole organisation about the importance. So thats why my curiosity for a workaround wakes up. – l4jos Jun 4 '19 at 9:36
  • Doing this stuff casually lets an attack slip by very easily - if you've proposed doing it properly and your boss doesn't want it it's his responsibility. Remind him periodically though. – Zac67 Jun 4 '19 at 16:39
2

I think, this is a somewhat brooder question to answer. There are many option you can implement.

  1. Firewall Implementation
  2. Network Monitoring System Implementation
  3. Proxy Server Implementation

We have no idea about size of your network, and but generally real time monitoring on each user is not a good idea and it will not be a possible if you have lot of customers.

Therefore You can use proxy server to limit browsing traffic. You can get proxy server as a hardware or software.Both free and proprietary versions are available in market.

If you have firewall, You can do same thing. You can limit unnecessary sites.

You do not need to keep your eye on each user and Device or application will be done your requirement. Even you need not remove from your location as well.

What monitoring system do is, they provide real time and historical logs for your knowledge. But you are not able to block or prohibit what they did.

  • If my company is not ready for a router change (default DNS to a content-blocking DNS), the only workaround is not 100% common. That is the question actually. – l4jos Jun 4 '19 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.