fifthsegment / gatesentry

🌟 Elevate Network Safety with Gatesentry! A powerful Proxy & DNS server combo, adept at blocking harmful content. Ensure a secure and focused online space for kids and adults alike. Dive into a world of enhanced security and productivity now! #SecureNetwork #FocusedBrowsing

Gatesentry

An open source proxy server (supports SSL filtering / MITM) + DNS Server with a nice frontend.

Download the latest releast

Usages:

• Privacy Protection: Users can use Gatesentry to prevent tracking by various online services by blocking tracking scripts and cookies.

• Parental Controls: Parents can configure Gatesentry to block inappropriate content or websites for younger users on the network.

• Bandwidth Management: By blocking unnecessary content like ads or heavy scripts, users can save on bandwidth, which is especially useful for limited data plans.

• Enhanced Security: Gatesentry can be used to block known malicious websites or phishing domains, adding an extra layer of security to the network.

• Access Control: In a corporate or institutional setting, Gatesentry can be used to restrict access to non-work-related sites during work hours.

• Logging and Monitoring: Track and monitor all the requests made in the network to keep an eye on suspicious activities or to analyze network usage patterns.

• Custom Redirects (via DNS): Redirect specific URLs to other addresses, useful for local development or for redirecting deprecated domains.

Getting started

There are 2 ways to run Gatesentry, either using the docker image or using the single file binary directly.

Method 1: Using Docker

1. Use the docker-compose.yml file from the root of this repo as a template, copy and paste it to any directory on your computer, then run the following command in a terminal docker compose up

Method 2: Using the Gatesentry binary directly

1. Downloading Gatesentry:

   Navigate to the 'Releases' section of this repository. Identify and download the appropriate file for your operating system, named either gatesentry-linux or gatesentry-mac.

2. Installation:

   For macOS and Linux:

   Locate the downloaded Gatesentry binary file in your system. Open a terminal window and navigate to the directory containing the downloaded binary. Run the following command to grant execution permissions to the binary file:

   chmod +x gatesentry-{platform}
   

   Replace {platform} with your operating system (linux or mac). Proceed to execute the binary file to initiate the server.

   Running as a Service (Optional)

   If you want Gatesentry to keep running in the background on your machine, install it as :

   ./gatesentry-{platform} -service install

   Next, on linux you can use your system service runner to start or stop it, for example for ubuntu:

   service gatesentry start #starts the service

   service gatesentry stop #stops the service

   For Windows

   The installer (GatesentrySetup.exe) contains instructions.

   Running as a Service

   The installer (GatesentrySetup.exe) should automatically install a service. You can look for it by searching for gatesentry in your Service manager (open it by running services.msc)

3. Launching the Server:

   Execute the Gatesentry binary file to start the server. Upon successful launch, the server will begin listening for incoming connections on port 10413.

Important information

Ports

By default Gatesentry uses the following ports

Port	Purpose
10413	For proxy
10786	For the web based administration panel
53	For the built-in DNS server
80	For the built-in webserver (showing DNS block pages)

Accessing the User Interface:

Open a modern web browser of your choice. Enter the following URL in the address bar: http://localhost:10786 The Gatesentry User Interface will load, providing access to various functionalities and settings.

Default Login Credentials:

Username: admin
Password: admin

Use the above credentials to log in to the Gatesentry system for the first time. For security reasons, it is highly recommended to change the default password after the initial login.

Note:Ensure your system’s firewall and security settings allow traffic on ports 10413 and 10786 to ensure seamless operation and access to the Gatesentry server and user interface.

This guide now specifically refers to the Gatesentry software and uses the gatesentry-{platform} filename convention for clarity.

DNS Information

Gatesentry ships with a built in DNS server, which can be used to block domains. The server as of now forwards requests to Google DNS for resolution, this can be modified from inside the application/dns/server/server.go file.

Local Development

./setup.sh

To run it:

./run.sh

gatesentry's Issues

Custom DNS server

It'd be great to be able to configure the DNS server without the need to compile.

My use case is possibly unique - using samba as domain controller and GPO to restrict my 7 yr olds computer. As I can't find a way to lock down DNS, I'm configuring browsers to use a proxy, mainly to have the proxy resolve DNS using 1.1.1.3 (content and malware blocking Cloudflare DNS server).

Internet not working over hotspot (using LAN)

Hi Abdullah,

I'm using backupSmall.img RPi2 with wifi dongle plugged. It's working well for Hotspot and blocking site or phrase without internet. But when I will try to share the internet over LAN cabel plugged in RPi2, the internet not shared over wifi.

Also I try to install the certificate. But it doesn't work.

Please help,
Thank You
Ketut

Why are no instructions given about how to self-sign a certificate?

If i'm going to use this as my proxy, then why aren't there any instructions for how to self-sign a certificate / become your own certificate authority for using GateSentry? That seems like a security hole in the software.

Anyway here is how to do that:

• http://unix.stackexchange.com/questions/289706/images-and-stylesheets-not-loading-from-squid-due-to-a-bad-certificate - My Question on the topic
• http://wiki.squid-cache.org/Features/DynamicSslCert - DynamicSslCert How to for Squid
• https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html#prepare-the-configuration-file - How to Become a Certificate Authority for yourself.

custom blocking page

Hi,

In the current version is possible to customize the webpage which is shown when a page is blocked ?

Thank you for sharing this software i think is very good

Sincerely Sergio

Greetings From Colombia

Can the Certificate Expiry Date be set in settings?

Can the Certificate Expiry Date be set in settings?

Just testing and noticed it is set to expire Certificate Expiry: 2024-12-30.

Kind Regards,

Block traffic on tablet

Hi,

Is it possible to use GateSentry for blocking youtube (app) trafic to IOS and android devices?

Bart

Why doesn't GateSentry use peek-n-splice?

I was reading in the documentation about Squid and I found the following:

"This section is outdated. The below limitations were resolved in Squid-3.5 by peek-n-splice"

• Squid Documentation

Why doesn't GateSentry use peek-n-splice?

Can't load images/css from provided certificate?

I can't seem to load the images / css from some https sites, seemly due to the fact that they detect that I'm basically doing a MiM attack with GateSentry. If my certificate was certified by a CA, would I be able to make this work?

My question is posted in more detail here

customize page

Hi,

Can the webpage which is shown when a page is blocked be customized?

Bart

YouTube Filtering

Hi,

I would like to use GatSentry to filter my daughters youtube movies.

Problem is that if I download the certificate an error is thrown. (This file cann't be used for securty certificate).

Can you pleas explain to me how to implement youtube filtering?

Bart

Is it possible to use Gate Sentry as a transparent proxy?

If I set all of my firewall rules correctly, is it possible to use Gate Sentry as a transparent proxy?

ICAP Protokoll Error

When opening the page www.sueddeutsche.de, always comes the error:

ICAP protocol error.

The system answered: [No Error]
This means that something is wrong with ICAP communication.

Possible problems are:

• The ICAP server is not available.
• The ICAP server response was invalid.

Please check it & give me Feedback.
Thanks Alex

GateSentry is blocking all traffic

I wanted to modify the squid.conf file (to add tmpfs cache). This did not work out too well, everything being blocked thereafter. Then I reverted to the previous configuration file and restarted but GateSentry keeps blocking all traffic. (I've put the original config file https://gist.github.com/fifthsegment/79fb356bf4cbf90253104388d504ee43 )

/var/log/squid3/access.log gives me little information on what is happening :

1464957874.619    407 127.0.0.1 TCP_MISS/500 133277 GET https://www.google.fr/ - PINNED/2a00:1450:4007:80d::2003 text/html
1464957884.167   5768 127.0.0.1 TCP_MISS/500 133282 GET http://google.com/ - HIER_DIRECT/2a00:1450:4007:807::200e text/html

Tie into MITKeberos?

Is it possible to tie this system in with different restrictions for MIT Keberos?