How can you make an Internet traffic filtering system?

Question

linux

There is an organization (10-15 computers) There is no server. IP static. It is necessary to install a gateway that will filter traffic (for example, block access to VK and classmates) There is an old computer with two network cards. There is nothing else and no one will give out money for anything. Please tell me how you can organize the filtering. As far as I know all this business can be organized on Linux. Well, as an option, take centos. I just don't know how to set up this whole thing. Friends, please tell me a way out of the situation. It is necessary that this server has both routing (from local to external and vice versa) and filtering, well, NAT + dhcp. I'd like to hear a variant on the example of any Linux distributions

Answer 1

centos will be quite good, we configure interfaces, then:
squid + dhcp + static routes do you have? if the speaker is still quagga for example.
squid - proxy server for filtering traffic
yum install squid
many configuration guides on the Internet
chkconfig squid on - don't forget to add
dhcp server to startup - everything is simple here yum install dhcp and configure /etc/dhcp/dhcpd.conf (how to configure - on the Internet also many guides)
/etc/init.d/dhcpd start - start the daemon
chkconfig dhcpd on - autoload

Answer 2

https://ru.wikipedia.org/wiki/Zentyal ?

Answer 3

go into the router and set it up, in most routers it's all there, here you are and here you have no classmates.

Answer 4

www.sophos.com/en-us/products/unified-threat-manag...
www.sophos.com/en-us/products/free-tools/sophos-ut...
home license for 50 Ip
web interface, everything is configurable. Antivirus in addition, you can ban sites by category

Answer 5

as already suggested here - pfsense
for example, here is the installation
https://ghostadmin666.wordpress.com/2012/09/18/%D1...
and stuff like that
https://ghostadmin666.wordpress.com/tag/pfsense/

Answer 6

privoxy - sharpened just for this .
There are excellent configuration guides: https://sites.google.com/site/rpfteam/
Updated configs there.
To start in transparent proxy mode:
-A PREROUTING -s YourSubnet/24 ​​-p tcp -m tcp --dport 80 -j DNAT --to-destination IpGatewayOnSubnet:8118
-A OUTPUT -p tcp -m owner --uid-owner UidUserFrom Which Launched Privoxy -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j DNAT --to-destination IpGatewayInSubnet:8118
The only thing is that if you need to filter https, you will have to fuck.

Answer 7

pfSense - everything is there out of the box.

Answer 8

RouterOS
As an option to use such a thing. It doesn’t ask for much to eat, it works according to the set-and-forget principle, it is installed on the x86 architecture and has all the necessary network functionality.