In this page you find:
The Endian Hotspot Appliance includes many useful services to prevent threats and to monitor the networks and the running daemons, whose activation and set up is explained in this section. In particular, among them, we highlight the antivirus engine, quality of service, and traffic monitoring. The available services appear as items in the sub-menu list on the left-hand side of the screen.
The DHCP server is used by the clients (workstations and servers) in the zones controlled by the Endian Hotspot Appliance to receive an IP address (“lease”), and allows to control the IP address assigned to them in a centralised way. Two types of leases can be assigned to clients: Dynamic and fixed. The DHCP server page is divided into three tabs, namely Server configuration, in which to configure the DHCP server, Fixed leases, showing the fixed leases, and Dynamic leases that lists all the clients that have obtained a dynamic lease. Dynamic leases are assigned on a network basis within a given range that is configured in the first tab, whereas fixed leases are assigned on a per-host basis and are configured in the second tab.
When a client (be it either a host or another device such as networked printer) joins the network it will automatically get a valid IP address from a range of addresses and other settings from the DHCP service. The client must be configured to use DHCP, which is sometimes called “automatic network configuration”, and is often the default setting on most workstations. Dynamic leases are configured on a zone basis: for example, it is possible to enable them only for clients in the GREEN zone, while the other active zones receive only fixed leases.
It is however possible to let also devices in the ORANGE (DMZ) zone to receive dynamic leases.
Note
The BLUE zone is always enabled but normally managed by the hotspot. Therefore it cannot be configured here if the hotspot is enabled. DHCP configuration is managed by hotspot appears.
Once the DHCP server is enabled on a zone click on the Settings link and a list of new options will show up. These are the available options:
The range of IP addresses to be supplied to the clients. These addresses have to be within the subnet that has been assigned to the corresponding zone. If some hosts should receive a fixed lease, (see below), make sure their IP addresses are included neither in this range nor in the range of the OpenVPN address pool (see ) to avoid conflicts.
Leaving these two fields blank will use the whole IP range of the zone for dynamic leases.
Advanced users might want to add some custom configuration lines to be
added to the dhcpd.conf file (e.g., custom routes to subnets)
by writing them in the text area at the bottom, marked with the
Custom configuration lines label.
Warning
No syntax check on these lines is carried out: the lines are appended to the configuration file. Any mistake here might inhibit the DHCP server from starting!
It is sometimes necessary or desirable for certain devices to always use the same IP address while still using DHCP, for example servers that provide services like a VoIP box, a SVN repository, a file server, or devices like printers or scanners. A fixed lease is usually referred to as Static IP Address, since a device will always receive the same IP address when requesting a lease from the DHCP server.
This tab reports the list of all the fixed leases currently active in the local network, providing several information about that lease. By clicking on the Add a fixed lease link, new fixed leases can be assigned to a device and insert all the information that will be displayed in the list. The devices are identified by their MAC addresses.
Note
Assigning a fixed lease from the DHCP server is very different from setting up the IP address manually on a device. Indeed, in the latter case, the device will still contact the DHCP server to receive its address and to announce its presence on the network. When the IP address required by the device has already been assigned, however, a dynamic lease will be given to the device.
The following parameters can be set for fixed leases:
dhcpd.conf.When clicking the Advanced options link extra options will appear:
The actions available for each fixed lease in the table are:
- toggle the status of the lease, enabled or disabled.
- modify the property of the lease.
- remove the lease.A use case for a fixed lease.
A use case that shows the usefulness of a fixed lease is the case of thin clients or disk-less workstations on the network that use PXE, i.e., boot the operating system from an image supplied by a networked tftp server. If the tftp server is hosted on the same server with the DHCP, the thin client receives both the lease and the image from the same server. More often, however, the tftp server is hosted on another server on the network, hence the client must be redirected to this server by the DHCP server, an operation that can be done easily adding a fixed lease on the DHCP server for the thin client, adding a next-address and the filename of the image to boot.
Besides the information supplied during the fixed lease creation, the list allow each lease to be enabled or disabled (by ticking the checkbox), edited, or deleted, by clicking on the icons in the Actions column. Editing a lease will open the same form as the creation of a new lease, whereas deleting a lease will immediately remove it from the configuration.
Note
All leases assigned by the DHCP server are stored by default
in the /var/lib/dhcp/dhcpd.leases file. Although the DHCP
daemon takes care of cleaning that file, it may happen that
the file stores lease that have already been expired and are
quite old. This is not a problem and does not interfere with
the normal DHCP server working. A typical entry in that file
is:
lease 192.168.58.157 {
starts 2 2013/06/11 13:00:21;
ends 5 2013/06/14 01:00:21;
binding state active;
next binding state free;
hardware ethernet 00:14:22:b1:09:9b;
}
When the DHCP server is active in the third tab the list of the currently assigned dynamic IP addresses is shown. This list reports the IP address, the MAC address, the hostname, and the expiration time of the lease associated to each client.
A DNS server provides a service that allows to resolve the (numeric) IP address of a host, given its hostname, and vice versa, and works perfectly for hosts with fixed IP address and hostname.
DDNS providers, like DynDNS or no-IP, offer a similar service when the IP addresses is dynamic, which is normally the case when using residential ADSL connections: Any domain name can be registered and associated to a server with a dynamic IP address, which communicates any IP address change to the DDNS provider. To be compatible and to integrate with the root DNS servers, each time IP address changes, the update must then be actively propagated from the DDNS provider.
The Endian Hotspot Appliance includes a dynamic DNS client for 14 different providers and if enabled, it will automatically connect to the dynamic DNS provider to communicate the new IP address whenever it changes.
Note
If no dynamic DNS account has been set up, detailed instruction to register a new one, detailed online helps and howtos are available on the web site of the providers.
This page displays the list of the Dynamic DNS accounts. Indeed, more than one DDNS provider can be used. For each account, the list shows information about the service used, the hostname and domain name registered, if the anonymous proxy and the wildcards are active, if it is enabled, and the possible actions:
- toggle the status of the lease, enabled or disabled. - modify the property of the lease. - remove the lease.New accounts can be created by clicking on the Add a host link, providing the following parameters:
Note
It is still necessary to export a service to the RED zone to be able to use the domain name to connect to the Endian Hotspot Appliance from the Internet using its dynamic IP address, since the dynamic DNS provider only resolves the domain name and not the associated services. Exporting a service might typically involve setting up port forwarding (see ).
After making a change in the configuration or to immediately update the dynamic DNS for all the defined accounts, click on the Force update button. This proves useful for example when the uplink has been disconnected and the REDIP has changed: When this happens, updating all the DDNS accounts is required, otherwise the services offered via DDNS will be unreachable.
The ClamAV antivirus engine settings page consists of two boxes. The first one shows all the available configuration possibilites, in particular its management of archive bombs. The second box on the other hand is showing the current synchronisation status of the signatures.
To avoid DoS attacks, ClamAV is configured to not scan archives with certain attributes, that can be modified here.
Archives whose uncompressed size exceeds the compressed archive size by more than X times, where X is the compression ration specified here, are not scanned. The default value is 1000.
Note
The compression rate for a normal file, depending on the algorithm used, is about between 10 and 15. That is, the uncompressed size of a file is between 10 to 15 times the size of the archive.
What should happen to an archive that is not scanned because it passed the limit set in at least one of the above settings. Choices are Do not scan but pass and Block as virus. In the first case the file is not scanned and passes the control, so that the recipient of the e-mail needs to carefully examine it, while in the second case it is considered as a virus and therefore blocked.
Note
When a file is larger that the size specified in the Max. archive size filed above and the policy here is “Block as virus”, the file is blocked. However, since it is downloaded until the size limit is reached, it may give the impression that the download did not complete successfully. To avoid this behaviour, change either this option or the size above.
In the ClamAV signature update schedule panel on the right part of the box, another important aspect of running ClamAV can be configured: How often the antivirus signatures are downloaded. Indeed, to keep the system up to date, information about new viruses must be downloaded periodically from a ClamAV server. The default frequency of download is once every hour, but it can be configured shoosing among the four available options (hourly, daily, weekly, monthly). Moving the mouse over the question marks displays the exact time when the updates are performed in each case - the default setting is one minute past the full hour.
This box shows a couple of information about the signatures virus. At the top of the box, a message like “Last signature updated on Sep 16 13:21:28 from db.local.clamav.net which loaded a total of 1040149 signatures.” reports the date and time of the latest download (Sep 16 13:21:28), the server from which the signatures have been downloaded (db.local.clamav.net), and the number of signatures downloaded (1040149).
Below the message, a list shows the types of the signatures downloaded, the time of the last synchronisation, their version, and the time of the last update. The update and synchronisation times may differ if the last synchronisation check did not contain any signature update.
A click on the Update signatures now button performs an immediate update (regardless of scheduled updates, which will continue as before), that might take some time, while a click on the Search the online virus database opens a new browser tab (or window) to ClamAV’s online database, to look for information about a specific virus.
Note
Since the databases of signatures may be updated several times a day from the provider, it is suggested to set the download to a high frequency of updates.
The Endian Hotspot Appliance uses NTP to keep its system time synchronised with time servers on the Internet. The settings available are grouped into two boxes.
A number of time server hosts on the Internet are preconfigured and used by the system, but custom time servers can be specified after ticking the Override default NTP servers checkbox. This might prove necessary when running a setup that does not allow the Endian Hotspot Appliance to reach the Internet. Several time servers addresses can be supplied, one per line, in the small form that will show up.
This box also shows the current time zone setting, that can also be changed by choosing a different one from the drop-down menu. An immediate synchronisation can be done by clicking on the Synchronize now button.
The second box gives the possibility to manually change the system time. While this is not recommended, this action proves useful when the system clock is way off and an immediate update of the Endian Hotspot Appliance‘s clock to the correct time is needed.
Automatic synchronisation using time servers is not done instantly, but the clock is “slow down” or “speed up” a bit to recover and align to the correct time, hence a system with a significant error in its time may require a long period to be corrected. In those cases, forcing a manual synchronisation represents a more drastic but immediate solution.
Traffic monitoring is done by ntopng and can be enabled or disabled by clicking on the main switch on this page. Once traffic monitoring is enabled a link to its new administration interface appears in the lower section of the page. There, the traffic can be visualised and analysed by host, protocol, local network interface and many other types of information: All these operations can be carried out directly from the Traffic Monitoring module in The Logs and Reports Menu.
Only one option is available in this page.
Note
This option is not available on appliances with limited resources.
By default, information about the history of each host is not stored on disk. Tick the checkbox to enable per-host logging.
Warning
When this option is enabled, a number of files for each host is written on disk and updated every time that that host connects to the Endian Hotspot Appliance. With traffic monitoring active and a high network traffic, disk space may be quickly filled up and disk access may become a bottleneck in the system’s performances.
The purpose of the QoS module is to prioritise the IP traffic that is flowing through the Endian Hotspot Appliance depending on the service. In other words, the QoS is a convenient way to reserve a given amount of the available bandwidth (both incoming and outgoing) for a given service. Applications that typically need to be prioritised over bulk traffic are interactive services such as SSH or VoIP.
The QoS configuration options are arranged into three tabs: Devices, Classes, and Rules.
The Device tab is also the starting page for the QoS and is initially empty. Once populated, a table showing a list of all the Quality of Service devices appears and for each device, some parameters and the available actions are displayed.
New QoS devices can be added by clicking on the Add Quality of Service Device link above the list and by configuring a few options.
The actions available on the devices are:
- enable or disable the device. - modify the properties of the device. - remove the device.When editing a device, the same form opens as when adding a new device, in which to modify the current device’s parameters.
For every device added, four items will appear under the Classes tab: Three for high, medium, and low priority, respectively, and one for bulk traffic (see below).
This tab shows a list of all Quality of Service classes that have been created, if any. For each entry, several data are shown. New items can be added by clicking on the Add Quality of Service Class link above the list of classes. The parameters to configure are the same shown in the list:
The drop down menu allows to choose the Quality of Service device for which the class was created.
Hint
At least one QoS device must have been created before defining a QoS class.
Note
The sum of reserved percentages can not be greater than 100 per device. Moreover, the reserved bandwidth can not be higher than the limit bandwidth.
The actions available are:
- modify the properties of the device.
- move the class in the list. - remove the device.Classes can be moved up or down the list: Items closer to the top of the list are the first to be processed when the bandwidth does not suffice for all the traffic and the Endian Hotspot Appliance needs to choose which traffic should be prioritised.
The third tab displays a list of the already defined Quality of Service Rules and allows to specify which type of traffic should belong to each of the classes. To add a new Quality of Service rule click on the Add Quality of Service Rule link. In the form that will open, which is very similar to the one used to define firewall rules, several values should be configured. Many drop-down menus are employed here to ease the choices and guide through the configuration.
Note
If there is more than one service in a Quality of Service class, then all these services together will share the reserved bandwidth.
The actions available on the rules are:
- enable or disable the rule. - modify the properties of the rule. - remove the rule.