LANCOM Systems LCOS 10.92 Security Essentials User Guide

© 2025 LANCOM Systems GmbH, Würselen (Germany). All rights reserved. While the information in this manual has been compiled with great care, it may not be deemed an assurance of product characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery. The reproduction and distribution of the documentation and software supplied with this product and the use of its contents is subject to written authorisation from LANCOM Systems. We reserve the right to make any alterations that arise as the result of technical development. Windows® and Microsoft® are registered trademarks of Microsoft, Corp. LANCOM, LANCOM Systems, LCOS, LANcommunity, LANCOM Service LANcare, LANCOM Active Radio Control, and AirLancer are registered trademarks. All other names or descriptions used may be trademarks or registered trademarks of their owners. This document contains statements relating to future products and their attributes. LANCOM Systems reserves the right to change these without notice. No liability for technical errors and/or omissions. This product contains separate open-source software components which are subject to their own licenses, in particular the General Public License (GPL). The license information for the device firmware (LCOS) is available on the device‘s WEBantarmuka config ing "Tambahan> Informasi lisensi". Yen panjaluk lisensi pamilike, sumber files for the corresponding software components will be made available on a download server upon request. Products from LANCOM Systems include software developed by the “OpenSSL Project” for use in the “OpenSSL Toolkit” (www.openssl.org).
Produk saka Sistem LANCOM kalebu piranti lunak kriptografi sing ditulis dening Eric Young (eay@cryptsoft.com).
Produk saka LANCOM Systems kalebu piranti lunak sing dikembangake dening NetBSD Foundation, Inc. lan para kontributor.
Produk saka Sistem LANCOM ngemot LZMA SDK sing dikembangake dening Igor Pavlov.

LANCOM Systems GmbH
Perusahaan Rohde & Schwarz
Adenauerstr. 20/B2
52146 Wuerselen
Jerman
www.lancom-systems.com

Pambuka

Kanthi LANCOM Security Essentials, sampeyan bisa nyaring konten tartamtu ing jaringan kanggo nyegah akses, contoneample, ilegal, mbebayani, utawa nyerang websites. Additionally, you can restrict private browsing on certain sites during working hours. This not only boosts employee productivity and network security but also ensures that full bandwidth is available exclusively for business processes. \LANCOM Security Essentials is an intelligent, dynamic webpanyaring situs. Iku kontak server rating sing andal lan akurat ngevaluasi websitus adhedhasar kategori sing sampeyan pilih. Fungsi LANCOM Security Essentials adhedhasar mriksa alamat IP sing ditemtokake saka sing dilebokake URLs. Kanggo akeh kaca, subdirektori ing domain uga dievaluasi kanthi kapisah supaya bagean a URL bisa dirating beda.

Users cannot bypass webverifikasi situs dening LANCOM Security Essentials kanthi ngetik alamat IP situs ing browser. LANCOM Security Essentials mriksa unencrypted (HTTP) lan encrypted (HTTPS) websitus. Modul BPjM minangka bagéan saka LANCOM Security Essentials utawa bisa dipikolehi kanthi kapisah liwat lisensi piranti lunak LANCOM BPjM Filter Option. Modul BPjM diterbitake dening Badan Federal kanggo Perlindhungan Anak lan Remaja ing Media (Bundeszentrale für Kinder- und Jugendmedienschutz) lan mblokir domain sing ora bisa diakses bocah lan remaja ing Jerman. Lisensi sing sampeyan tuku kanggo LANCOM Security Essentials ditrapake kanggo kategori piranti tartamtu lan periode wektu tartamtu (setaun utawa telung taun). Jumlah pangguna ora winates. Sampeyan bakal diwenehi kabar luwih dhisik nalika lisensi sampeyan bakal kadaluwarsa.

You can test the LANCOM Security Essentials on any router that supports this function. To do so, you must activate a time-limited 30-day demo license once per device. Demo licenses are created directly from within LANconfig. Right-click the device, select Activate Software Option from the context menu, and in the following dialog, click the link next to Need a demo license?. You will automatically be connected to the LANCOM registration server websitus, ngendi sampeyan bisa milih lan ndhaftar lisensi Tur dikarepake kanggo piranti.
Kategori profiles store all settings related to categories. You select from predefined main and subcategories in your LANCOM Security Essentials: 73 categories are grouped into 12 thematic groups, e.g., “Pornography”, “Shopping”, or “Illegal”. Each group allows you to enable or disable the included categories. Subcategories for “Pornography” include “Pornography”, “Sex toys”, “Sexual content”, “Nudity”, “Lingerie”, and “Sex education”.
Additionally, administrators can enable an override option for each category during configuration. When override is active, users can temporarily access a blocked site by clicking a corresponding button—but the administrator will receive a notification via e-mail, SYSLOG, and/or SNMP trap.
Using the category profile sampeyan digawe, bebarengan karo whitelist lan blacklist, sampeyan bisa nggawe pro Filter isifile sing bisa ditugasake kanggo pangguna liwat firewall. Kanggo example, sampeyan bisa nggawe profile “Employees_Department_A”, which is then assigned to all computers in that department.
During installation, LANCOM Security Essentials automatically sets up useful default settings that only need to be activated for initial operation. In subsequent steps, you can further adapt the behaviour of LANCOM Security Essentials to your specific use case.
Useful default settings are also automatically configured for the BPjM module. For example, ana aturan firewall standar ing IPv4 utawa IPv6 firewall karo obyek sistem "BPJM" minangka stasiun tujuan. Netepake stasiun sumber minangka jaringan sing kudu dilindhungi dening modul BPjM. Kanthi ngaktifake aturan, modul BPjM diwiwiti.

Requirements kanggo nggunakake LANCOM Security Essentials

The following requirements must be met in order to use LANCOM Security Essentials:

The LANCOM Security Essentials option is activated.
Firewall kudu diaktifake.
Aturan firewall kudu milih pro filter kontenfile.
Filter konten sing dipilih profile kudu nemtokake kategori profile and optionally a white and/or blacklist for every time period of the day. To cover different time periods, a content filter profile can consist of multiple entries.
If a specific time period is not covered by an entry, unrestricted access to websitus bakal bisa ing wektu sing.

Yen filter isi profile diganti jeneng mengko, aturan firewall uga kudu diatur.

Miwiti cepet

Sawise nginstal LANCOM Security Essentials, kabeh setelan wis dikonfigurasi kanggo komisi cepet.

The operation of the LANCOM Security Essentials may be subject to data protection regulations in your country or to company policies. Please check applicable rules before commissioning.
In LANconfig, the settings of the LANCOM Security Essentials are listed under Content Filter.

Activate the content filter using the following steps:

Launch the setup wizard for the corresponding device.
Select the setup wizard to configure the content filter.
Select one of the predefined security profiles (Basic Profile, Perusahaan Profile, Parental Control Profile):
- Pro dhasarfile: Iki profile mainly blocks access to categories such as pornography, illegal, violent or discriminatory content, drugs, spam, and phishing.
- Kerja profile: Saliyane Basic Profile setelan, pro ikifile also blocks categories such as shopping, job search, games, music, radio, and certain communication services like chat.
- Parental control profile: Saliyane Basic Profile setelan, pro ikifile includes stricter blocking for nudity and weapons.

If the firewall is disabled, the wizard will enable it. The wizard then checks whether the firewall rule for the content filter is set correctly and adjusts it if necessary. With these steps, the content filter is activated, and the default settings will apply to all stations in the network using the selected content filter profile karo blacklist kosong lan whitelists. Setel setelan iki supaya cocog karo kabutuhan yen perlu. Tuntunan ngaktifake panyaring isi kanggo pigura wektu SELALU.

Standard settings in the Content Filter

The following elements have been created in the default configuration of the Content Filter:

Firewall rule

The preset firewall rule is named CONTENT-FILTER and uses the action object CONTENT-FILTER-BASIC.

Firewall action objects

There are three firewall action objects:

CONTENT-FILTER-BASIC
CONTENT-FILTER-WORK
CONTENT-FILTER-PARENTAL-CONTROL

These action objects work with the corresponding content-filter profiles.

Content filter profiles

There are three content filter profiles. Kabeh isi-filter profiles nggunakake timeframe tansah, dhaptar ireng MY-BLACKLIST lan whitelist MY-WHITELIST. Saben konten-filter profile nggunakake salah siji saka pro kategori sing wis ditemtokakefiles:

CF-BASIC-PROFILE: Iki isi-filter profile features a low level of restrictions and works with the category profile BASIC-CATEGORIES.
CF-PARENTAL-CONTROL-PROFILE: Iki isi-filter profile protects minors (e.g. trainees) from unsuitable Internet content, and it works with the category profile PARENTAL-CONTROL.

CF-WORK-PROFILE: Iki isi-filter profile is intended for companies wishing to place restrictions on categories such as Job Search or Chat. It works with the category profile KARYA-KATEGORI.

Jangka wektu

There are two predefined timeframes:

ALWAYS: 00.00-23.59 hrs
NEVER: 00.00-0.00 hrs

Daftar ireng

The preset blacklist is named MY-BLACKLIST and it is empty. Here you can optionally enter URLs kang kanggo pareng.

Dhaptar putih

The preset whitelist is named MY-WHITELIST and it is empty. Here you can optionally enter URLs kang kanggo diijini.

Kategori profiles

There are three category profiles: BASIC-KATEGORI, KARYA-KATEGORI lan PARENTAL-KONTROL. Kategori profile nemtokake kategori sing kudu diijini lan dilarang, lan sing bisa diganti bisa diaktifake.

Setelan Umum

Sampeyan bisa nggawe setelan filter konten global ing LANconfig ing Filter Konten> Umum:

Activate Content Filter

This allows you to activate the content filter.

In case of error

This lets you define what happens in the event of an error. For exampNanging, yen server rating ora bisa digayuh, setelan iki nemtokake manawa pangguna bisa browsing kanthi bebas utawa kabeh web akses diblokir.

On license expiration

The license for using LANCOM Security Essentials is valid for a specific period. You will be reminded of the upcoming license expiration 30 days, one week, and one day in advance (to the email address configured in LANconfig under Log & Trace > General > E-mail addresses > E-mail for license expiry reminder). Here, you can specify whether websitus kudu diblokir utawa liwati ora dicenthang sawise lisensi kadaluwarsa. Adhedhasar setelan iki, pangguna bisa browsing kanthi bebas sawise lisensi kadaluwarsa utawa kabeh web akses bakal ditolak.

To ensure the reminder is actually sent to the specified email address, you must configure the appropriate SMTP account.

On Non-HTTPS via TCP port 443

Dilarang

Disallows non-HTTPS traffic on port 443.

diijini

Allows non-HTTPS traffic on port 443.
TCP port 443 is reserved by default exclusively for HTTPS connections. Some applications that do not use HTTPS still use TCP port 443. In such cases, you can allow TCP port 443 to accept non-HTTPS traffic.

If you allow non-HTTPS connections on port 443, the traffic will not be classified but instead generally permitted. By default, non-HTTPS traffic on port 443 is not allowed.

Max. proxy connections

Set the maximum number of simultaneous proxy connections allowed. This helps limit system load. A notification is triggered if this number is exceeded. You can configure the type of notification under Content Filter > Options > Event notification.

Proxy processing timeout

Specify the time in milliseconds the proxy is allowed for processing. If this time is exceeded, a timeout error page is returned.

Save Content Filter information to flash ROM activated

If enabled, this option stores content filter information in the device’s Flash ROM.

Allow wildcard certificates

Kanggo websites using wildcard certificates (with CN entries such as *.mydomain.de de), enabling this function uses the main domain (mydomain.de) for filtering. The filtering process occurs in the following order:

Check the server name in the “Client Hello” (depending on the browser used)
Check the CN in the received SSL certificate
Wildcard entries are ignored
If the CN is not usable, the “Alternative Name” field is evaluated
DNS reverse lookup of the corresponding IP address and evaluation of the resulting hostname
If wildcards are included in the certificate, the main domain is used instead (as described above)
Priksa alamat IP

Settings for blocking

Sampeyan nyetel websetelan pamblokiran situs ing kene:

LANconfig: Content filter > Blocking / Override > Blocking & error
Command line: Setup > UTM > Content-Filter > Global-Settings

Alternative blocking URL:

Iki ngendi sampeyan bisa ngetik alamat alternatif URL. Yen akses diblokir, ing URL mlebu ing kene bakal ditampilake tinimbang sing dijaluk web situs. Sampeyan bisa nggunakake kaca HTML njaba iki kanggo nampilake desain perusahaan perusahaan, contoneample, utawa kanggo nindakake fungsi kayata rutin JavaScript, etc. Sampeyan uga bisa nggunakake padha tags here as used in the blocking text. If you do not make any entry here, the default page stored in the device will be displayed..

Nilai sing bisa ditindakake:

- sah URL alamat
Default:
- kosong

Alternative error URL:

Iki ngendi sampeyan bisa ngetik alamat alternatif URL. Ing acara saka kesalahan, ing URL mlebu kene bakal ditampilake tinimbang biasanipun web situs. Sampeyan bisa nggunakake kaca HTML njaba iki kanggo nampilake desain perusahaan perusahaan, contoneample, utawa kanggo nindakake fungsi kayata rutin JavaScript, etc. Sampeyan uga bisa nggunakake padha tags here as used in the error text. If you do not make any entry here, the default page stored in the device will be displayed..

Nilai sing bisa ditindakake:
- sah URL alamat
Default:
- kosong

Source addr. for alt. block URL:

This is where you can configure an optional sender address to be used instead of the one that would normally be automatically selected for this target address. If you have configured loopback addresses, you can specify them here as sender address.

Nilai sing bisa ditindakake:

Name of the IP networks whose address should be used
INT for the address of the first Intranet
DMZ for the address of the first DMZ.

If there is an interface called DMZ, its address will be taken in this case.

LB0…LBF for the 16 loopback addresses
TAMU
Any IP address in the form x.x.x.x

Default:

kosong
The sender address specified here is used unmasked for every remote station.

Sumber addr. kanggo alt. kesalahan URL:

This is where you can configure an optional sender address to be used instead of the one that would normally be automatically selected for this target address. If you have configured loopback addresses, you can specify them here as sender address.

Nilai sing bisa ditindakake:

Name of the IP networks whose address should be used

INT for the address of the first Intranet
DMZ for the address of the first DMZ.

If there is an interface called DMZ, its address will be taken in this case.

LB0…LBF for the 16 loopback addresses
TAMU
Any IP address in the form x.x.x.x

Default:

kosong

The sender address specified here is used unmasked for every remote station.

Block text

Ing kene sampeyan bisa nemtokake teks sing bakal ditampilake nalika ana pamblokiran. Teks pamblokiran sing beda bisa ditetepake kanggo macem-macem basa. Tampilan teks pamblokiran dikontrol dening setelan basa sing ditularake dening browser (agen pangguna).

Basa

Entering the appropriate country code here ensures that users receive all messages in their browser’s preset language. If the country code set in the browser is found here, the matching text will be displayed. You can add any other language.
Examples of the country code:

de-DE: German-Germany
de-CH: German-Switzerland
de-AT: German-Austria
en-GB: English-Great Britain
en-US: English-United States

The country code must match the browser language setting exactly, e.g. “de-DE” must be entered for German (“de” on its own is insufficient). If the country code set in the browser is not found in this table, or if the text stored under that country code is deleted, the predefined default text (“default”) will be used. You can modify the default text.

Nilai sing bisa ditindakake:

10 alphanumerical characters

Default:

kosong

Teks

Enter the text that you wish to use as block text for this language.

Nilai sing bisa ditindakake:

254 karakter alfanumerik

Default:

kosong

Special values:

You can also use special tags kanggo mblokir teks yen sampeyan pengin nampilake kaca sing beda-beda gumantung saka sebabe web site was blocked (e.g. forbidden category or entry in the blacklist).

Ing ngisor iki tags bisa digunakake minangka tag nilai:

<CF-URL/> kanggo sing dilarang URL
<CF-CATEGORIES/> for the list of categories why the web site was blocked
<CF-PROFILE/> kanggo profile jeneng
<CF-OVERRIDEURL/> kanggo URL digunakake kanggo ngaktifake URL (iki bisa digabungake kanthi prasaja tag or in a button)

<CF-LINK/> adds a link for activating the override
<CF-BUTTON/> for a button to activate the override
<CF-IF att1 att2> … </CF-IF> to display or hide parts of the HTML document. The attributes are:
BLACKLIST: If the site was blocked because it is in the profile daftar ireng
CATEGORY: If the site was blocked due to one of its categories

ERR: If an error has occurred.
OVERRIDEOK: If users have been allowed an override (in this case, the page should display an appropriate button)

Since there are separate text tables for the blocking page and the error page, this attribute only makes sense if you have configured an alternative URL kanggo nuduhake ing pamblokiran. Yen sawetara atribut ditetepake ing siji tag, bagean kasebut bakal ditampilake yen paling ora salah siji saka syarat kasebut ditemoni. Kabeh tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking text may only contain a maximum of 254 characters.

Example:

<CF-URL/> diblokir amarga cocog karo kategori . Konten sampeyan profile punika .

Ing tags diterangake ing kene uga bisa digunakake ing kaca HTML eksternal (alternatif URLs kanggo nuduhake ing pamblokiran).

Error text

Ing kene sampeyan bisa nemtokake teks sing bakal ditampilake nalika ana kesalahan.

Basa

Examples of the country code:

de-DE: German-Germany
de-CH: German-Switzerland
de-AT: German-Austria
en-GB: English-Great Britain
en-US: English-United States

The country code must match the browser language setting exactly, e.g. “de-DE” must be entered for

German (“de” on its own is insufficient). If the country code set in the browser is not found in this table, or if the text stored under that country code is deleted, the predefined default text (“default”) will be used. You can modify the default text.

Nilai sing bisa ditindakake:

10 alphanumerical characters

Default:

kosong

Teks

Enter the text that you wish to use as error text for this language.

Nilai sing bisa ditindakake:

254 karakter alfanumerik

Default:

kosong

Special values:

You can also use HTML tags for the error text.

The following empty element tags bisa digunakake minangka tag nilai:

<CF-URL/> kanggo sing dilarang URL
<CF-PROFILE/> kanggo profile jeneng
<CF-ERROR/> for the error message

Example:

<CF-URL/> diblokir amarga ana kesalahan:

Override settings

Fungsi override ngidini a websitus sing bisa diakses sanajan diklasifikasikake minangka dilarang. Pangguna kudu ngeklik tombol override kanggo njaluk kaca sing dilarang dibukak. Sampeyan bisa ngatur fitur iki supaya administrator diwenehi kabar nalika tombol override diklik (LANconfig: Filter isi > Pilihan > Acara).

If the override type “Category” has been activated, clicking on the override button makes all of the categories for that URL bisa diakses pangguna Kaca pamblokiran sabanjure sing bakal ditampilake mung siji kategori sing nerangake kenapa akses menyang URL was blocked. If the override type “Domain” has been activated, then the entire domain can be accessed.

The settings for the override function are to be found here:

LANconfig: Content filter > Blocking / Override > Override
Command line: Setup > UTM > Content-Filter > Global-Settings

Override-Active

This is where you can activate the override function and make further related settings.

Override duration

Durasi override bisa diwatesi ing kene. Nalika periode kasebut kadaluwarsa, upaya kanggo ngakses domain lan/utawa kategori sing padha bakal diblokir maneh. Ngeklik tombol override sapisan maneh ngidini web site to be accessed again for the duration of the override and, depending on the settings, the administrator will be notified once more.

Nilai sing bisa ditindakake:

1-1440 (menit)

Default:

5 (menit)

Override type:

This is where you can set the type of override. It can be allowed for the domain, for the category of web site to be blocked, or for both.

Nilai sing bisa ditindakake:

kategori

For the duration of the override, all URLs diijini sing ana ing kategori sing kena pengaruh (uga sing wis diijini sanajan tanpa override).

Domain

For the duration of the override all URLs in this domain are allowed, irrespective of the categories they belong to.

Category-and-Domain

For the duration of the override, all URLs diijini sing kagungane domain iki lan uga kanggo kategori diijini. Iki minangka watesan sing paling dhuwur.

Override text

Ing kene sampeyan bisa nemtokake teks sing ditampilake kanggo pangguna sing ngonfirmasi override.

Basa

Examples of the country code:

de-DE: German-Germany
de-CH: German-Switzerland
de-AT: German-Austria
en-GB: English-Great Britain
en-US: English-United States

Nilai sing bisa ditindakake:

10 alphanumerical characters

Default:

kosong

Teks

Enter the text that you wish to use as override text for this language.

Nilai sing bisa ditindakake:

254 alphanumerical characters

Default:

kosong

Special values:

You can also use HTML tags kanggo mblokir teks yen sampeyan pengin nampilake kaca sing beda-beda gumantung saka sebabe web site was blocked (e.g. forbidden category or entry in the blacklist).

Ing ngisor iki tags bisa digunakake minangka tag nilai:

<CF-URL/> kanggo asline dilarang URL that is now allowed

<CF-CATEGORIES/> for the list of categories that have now been allowed as a result of the override (except if domain override is specified).
<CF-BUTTON/> displays an override button that forwards the browser to the original URL.
<CF-BUTTON/> displays an override link that forwards the browser to the original URL.

<CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the allowed URL. Ing tags are of equal value and their use is optional.
<CF-ERROR/> generates an error message in the event that the override fails.
<CF-DURATION/> displays the override duration in minutes.
<CF-IF att1 att2> … </CF-IF> to display or hide parts of the HTML document. The attributes are:

CATEGORY when the override type is “Category” and the override was successful
DOMAIN when the override type is “Domain” and the override was successful
BOTH when the override type is “Category-and-Domain” and the override was successful

ERROR when the override fails
OK if either CATEGORY or DOMAIN or BOTH are applicable

If several attributes are defined in one tag, bagean kasebut kudu ditampilake yen paling ora salah siji saka kondisi kasebut ditemoni. Kabeh tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking text may only contain a maximum of 254 characters.

Example:

Kategori yaiku ing domain Domain kasebut punika dirilis kanggo menit. Kesalahan override:

Profiles ing Filter Konten

Ing Filter Konten > Profiles sampeyan bisa nggawe isi-filter profiles sing digunakake kanggo mriksa web situs kanggo konten sing dilarang. Pro saringan kontenfile tansah duwe jeneng lan, kanggo macem-macem periode wektu, iku ngaktifake pro kategori dikarepakefile lan, opsional, dhaptar ireng lan dhaptar putih. Supaya bisa nyedhiyani konfigurasi beda kanggo macem-macem timeframes, sawetara konten-filter profile entri digawe kanthi jeneng sing padha. Konten-filter profile mangkono digawe saka jumlah kabeh entri karo jeneng sing padha. Firewall nuduhake konten-filter pro ikifile.

Please note that you must make corresponding settings in the firewall in order to use the profiles ing Filter Konten LANCOM.

Profiles

Setelan kanggo profiles bisa ditemokake ing kene:

LANconfig: Content filer > Profiles > Profile
Baris perintah: Setup > UTM > Content-Filter > Profiles > Profile

jeneng

Profile name that the firewall references must be specified here.

Jangka wektu

Pilih jangka wektu kanggo kategori iki profile and, optionally, the blacklist and the whitelist. The timeframes

ALWAYS and NEVER are predefined. You can configure other timeframes under:

LANconfig: Date & time > General > Time frame
Command line: Setup > Time > Timeframe

One profile may contain several lines with different timeframes.

Nilai sing bisa ditindakake:

tansah
ora tau
Name of a timeframe profile

If multiple entries are used for a content-filter profile lan jangka wektune tumpang tindih, banjur kabeh kaca sing ana ing entri aktif bakal diblokir sajrone wektu kasebut. Yen sawetara entri digunakake kanggo pro isi-filterfile lan periode wektu tetep undefined, akses kanggo kabeh web sites will be unchecked for this period.

Daftar ireng

Name of the blacklist profile yaiku kanggo nglamar pro filter konten ikifile during the period in question. A new name can be entered, or an existing name can be selected from the blacklist table.

Nilai sing bisa ditindakake:

Name of a blacklist profile
New name

Dhaptar putih

Name of the whitelist profile yaiku kanggo nglamar pro filter konten ikifile during the period in question. A new name can be entered, or an existing name can be selected from the whitelist table.

Nilai sing bisa ditindakake:

Name of a whitelist profile
New name

Kategori profile

Jeneng kategori profile yaiku kanggo nglamar pro filter konten ikifile during the period in question. A new name can be entered, or an existing name can be selected from the category table.

Nilai sing bisa ditindakake:

Name of a category profile
New name

Blacklist addresses (URL)

Iki ngendi sampeyan bisa ngatur sing web situs sing arep diblokir.

LANconfig: Content files > Profiles > Alamat daftar ireng (URL)
Baris perintah: Setup > UTM > Content-Filter > Profiles > Daftar ireng

jeneng

Enter the name of the blacklist for referencing from the content-filter profile.

Nilai sing bisa ditindakake:

Blacklist name

alamat (URL)

Akses menyang URLs entered here will be forbidden by the blacklist.

Nilai sing bisa ditindakake:

sah URL alamat

The following wildcard characters may be used:

* for any combination of more than one character (e.g. www.lancom.* encompasses the websitus www.lancom.com, www.lancom.de, www.lancom.eu, www.lancom.es, lsp.)
? for any one character (e.g. www.lancom.e* encompasses the web situs www.lancom.eu, www.lancom.es)

URLs kudu diketik tanpa anjog http: //. Elinga yen ing kasus akeh URLs, a forward slash is automatically added as a suffix to the URL, e.g. “www.mycompany.de/”. For this reason, it is advisable to enter the URL as: “www.mycompany.de*”.

individu URLs dipisahake dening kothong.

Whitelist addresses (URL)

Iki ngendi sampeyan bisa ngatur web situs sing akses kanggo diijini.

LANconfig: Content files > Profiles > alamat dhaptar putih (URL)
Baris perintah: Setup > UTM > Content-Filter > Profiles > Whitelist

jeneng

Ketik jeneng dhaptar putih kanggo referensi saka konten-filter profile.

Nilai sing bisa ditindakake:

Name of a whitelist

alamat (URL)

Iki ngendi sampeyan bisa ngatur websites which are to be checked locally and then accepted

Nilai sing bisa ditindakake:

sah URL alamat

The following wildcard characters may be used:

* for any combination of more than one character (e.g. www.lancom.* encompasses the websitus www.lancom.com, www.lancom.de, www.lancom.eu, www.lancom.es, lsp.)
? for any one character (e.g. www.lancom.e* encompasses the web situs www.lancom.eu, www.lancom.es)

URLs kudu diketik tanpa anjog http: //. Elinga yen ing kasus akeh URLs, a forward slash is automatically added as a suffix to the URL, e.g. “www.mycompany.de/”. For this reason, it is advisable to enter the URL as: “www.mycompany.de*”.

individu URLs dipisahake dening kothong.

Kategori profiles

Kene sampeyan nggawe kategori profile lan nemtokake kategori utawa klompok sing kudu digunakake kanggo menehi rating web situs kanggo saben kategori profile. Sampeyan bisa ngidini utawa nglarang kategori individu utawa ngaktifake fungsi override kanggo saben grup.

LANconfig: Filter Konten > Profiles > Categories
Baris perintah: Setup > UTM > Content-Filter > Profiles > Kategori-Profile

Kategori profile

Jeneng kategori profile kanggo referensi saka konten-filter profile is entered here.

Nilai sing bisa ditindakake:

Name of a category profile

Category settings

For each main category and the associated sub-categories, it is possible to define whether the URLs are to be allowed, forbidden or allowed with override only.

The following main categories can be configured:

Ilegal
Cyberthreats
Pornografi
Iklan
Games
Web aplikasi
Blanja
Keuangan
Religions & occult
Informasi
Entertainment & Culture
macem-macem

Kategori profile banjur kudu ditugasake menyang pro konten-filterfile together with a time frame in order to become active.

Nilai sing bisa ditindakake:

a Allowed, forbidden, override

Options for the Content Filter

Ing Filter Konten > Pilihan sampeyan nemtokake manawa sampeyan pengin diwenehi kabar babagan acara lan ing ngendi informasi Filter Konten bakal disimpen.

Acara

This is where you define how you wish to receive notification of specific events. Notification can be made by e-mail, SNMP or SYSLOG. For different event types you can specify whether messages should be output and, if so, how many.

E-mail

Here, you specify if and how e-mail notification takes place:

Ora
No e-mail notification is issued for this event.
Langsung wae
Notification occurs when the event occurs.
Saben dina
The notification occurs once per day.

Notifications can be sent for the following events:

Kesalahan
For SYSLOG: Source “System”, priority “Alert”.
Default: SNMP notification
License expiry
For SYSLOG: Source “Admin”, priority “Alert”.
Default: SNMP notification
License exceeded
For SYSLOG: Source “Admin”, priority “Alert”.
Default: SNMP notification

Override applied
For SYSLOG: Source “Router”, priority “Alert”.
Default: SNMP notification
Proxy limit
For SYSLOG: Source “Router”, priority “Info”.
Default: SNMP notification

E-mail recipient

An SMTP client must be defined if you wish to use the e-mail notification function. You can use the client in the device, or another client of your choice.

No e-mail will be sent if no e-mail recipient is specified.

Content Filter snapshot

This is where you can activate the content filter snapshot and determine when and how often it should be taken. The snapshot copies the category statistics table to the last snapshot table, overwriting the old contents of the snapshot table. The category statistics values are then reset to 0.

Interval

Here you decide whether the snapshot should be taken monthly, weekly or daily.

Nilai sing bisa ditindakake:

Saben wulan
Mingguan
Saben dina

Dina sasi

For monthly snapshots, set the day of the month when the snapshot should be taken. Possible values: a 1-31

It is advisable to select a number between 1 and 28 in order to ensure that it occurs every month.

Dina minggu

For weekly snapshots, set the day of the week when the snapshot should be taken. Possible values:

Senen, Selasa, Rebo, Kemis, Jum'at, Setu, Minggu

Wektu dina:

If you require a daily snapshot, then enter here the time of day for the snapshot in hours and minutes. Possible values:

Format HH:MM (default: 00:00)

Additional settings for the Content Filter

Firewall settings for the content filter

The firewall must be activated in order for the Content Filter to function. You can activate the firewall under:

LANconfig: Firewall/QoS > General
Command line: Setup > IP-Router > Firewall

In the default configuration, you will find the firewall rule CONTENT-FILTER that refers to the action object CONTENT-FILTER-BASIC:

The firewall rule should be limited to the target services HTTP and HTTPS so that only outgoing HTTP and HTTPS connections are examined. Without this restriction, all packets will be checked by the content filter, which could lead to a loss of system performance. A content-filter related firewall rule must contain a special action object that uses packet actions to check the data according to a content-filter profile. In the default configuration, you will find the action objects CONTENT-FILTER-BASIC,

CONTENT-FILTER-WORK and CONTENT-FILTER-PARENTAL-CONTROL, each of which refer to their corresponding content-filter profile:

Example: kapan a web kaca diakses, paket data liwat firewall lan diproses dening aturan CONTENT-FILTER. Objek tumindak CONTENT-FILTER-BASIC mriksa paket data nggunakake konten-filter profile ISI-FILTER-DASAR.

Jangka wektu

Pigura wektu digunakake karo Filter Konten kanggo nemtokake wektu nalika konten-filter profiles nglamar. Siji profile bisa ngemot sawetara garis kanthi jangka wektu sing beda. Garis sing beda-beda ing jangka wektu kudu nglengkapi siji liyane, yaiku yen sampeyan nemtokake WORKTIME, mesthine sampeyan kudu nemtokake jangka wektu sing diarani FREETIME kanggo nutupi wektu ing njaba jam kerja. Pigura wektu uga bisa digunakake kanggo nyegah WLAN SSID saka siaran permanen. Iki bisa ditambahake menyang setelan WLAN logis. Jangka wektu ALWAYS lan NATE wis ditemtokake. Sampeyan bisa ngatur pigura wektu liyane ing ngisor iki:

Command line: Setup > Time > Timeframe

jeneng

Ketik jeneng pigura wektu kanggo referensi saka konten-filter profile utawa dening SSID WLAN. Sawetara entri kanthi jeneng sing padha ngasilake pro umumfile.

Nilai sing bisa ditindakake:

Name of a timeframe

Miwiti

Here you set the start time (time of day) when the selected profile becomes valid.

Nilai sing bisa ditindakake:

Format HH:MM (default: 00:00)

mandeg

Here you set the stop time (time of day) when the selected profile ceases to be valid.

Nilai sing bisa ditindakake:

Format HH:MM (default: 23:59)

A stop time of HH:MM usually runs until HH:MM:00. The stop time 00:00 is an exception, since this is interpreted as 23:59:59.

dina minggu

Here you select the weekday on which the timeframe is to be valid.

Nilai sing bisa ditindakake:

Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday, Holiday

The holidays are set under Date & Time > General > Public holidays.

Sampeyan bisa nggawe jadwal wektu kanthi jeneng sing padha nanging kanthi wektu sing beda-beda ngluwihi sawetara baris:

BPjM module

Modul BPjM diatur dening Federal Re Jermanview Papan kanggo Media mbebayani kanggo bocah cilik (BPjM) lan pamblokiran websitus sing ngirim ora bisa diakses kanggo bocah lan wong enom. Fitur iki utamané cocog kanggo sekolah lan institusi pendidikan karo siswa cilik. DNS-Domain kanthi konten sing resmi diklasifikasikake minangka mbebayani kanggo bocah cilik ora bisa diakses dening klompok target sing cocog. Dhaptar iki dijamin bakal dianyari kanthi otomatis lan ditambahi kanthi rutin. Modul BPjM mblokir DNS-Domain sing kadhaptar ing resmi websitus saka Federal Review Board for Media Harmful to Minor (BPjM) ing Jerman. Pamblokiran miturut kategori lan overrides (allow) ora kasedhiya. Modul BPjM kasedhiya minangka bagéan saka pilihan Filter Isi LANCOM utawa kanthi kapisah liwat pilihan piranti lunak LANCOM BPjM Filter. Firewall IPv4 utawa IPv6 ngleksanakake fitur iki kanthi aturan firewall standar sing bisa diaktifake lan dikonfigurasi kanggo saben jaringan. Kanggo example, iku bisa kanggo nglengkapi mung jaringan siswa karo Filter iki, nanging ora kalebu jaringan liyane saka iku. Firewall IPv6 nduweni aturan standar anyar BPJM, sing dipateni kanthi gawan kanthi obyek sistem "BPJM" minangka stasiun tujuan. Aturan sing padha kasedhiya ing firewall IPv4. Jaringan sing bakal dilindhungi dening modul BPjM kasebut minangka stasiun sumber.

Setelan liyane bisa ditemokake ing LANconfig ing Layanan Miscellaneous> Layanan> Filter BPjM.

Alamat sumber

Source address used by the BPjM module to access the server for BPjM signature updates.

Rekomendasi kanggo nggunakake

If content filters and BPJM filters are to be used together, both rules must be configured with different priorities so that they are run through one after the other. Likewise, for the first rule, care must be taken to ensure that the item “Observe further rules, after this rule matches” is activated.
In rare cases, the BPJM module may block desired domains because only (DNS) domains and not URL directory levels can be checked due to TLS. In this case, these desired domains can be added to the “BPJM Allow list”, e.g. *.example.com. The LANCOM router must serve as DNS server or DNS forwarder in the network, i.e. clients in the local network must use the router as DNS server. In addition, the direct use of DNS-over-TLS and DNS-over-HTTPS (possibly browser-internal) with external DNS servers by clients must be prevented.

This can be achieved as follows:

The DHCP server must distribute the router’s IP address as the DNS server (set up by default by the Internet Wizard).
Set up firewall rules that prevent direct use of external DNS servers, for example. by blocking outgoing port 53 (UDP) for clients from the corresponding source network.
Setting up firewall rules that prevent direct use of external DNS servers supporting DNS-over-TLS, e.g. by blocking outgoing port 853 (TCP) for clients from the corresponding source network.
Disabling DNS-over-HTTPS (DoH) in the browser.

Notes on synchronising the firewall’s DNS database: Because the firewall learns its information from client DNS requests, in certain situations, the DNS database may not yet be complete. This can happen in the following situations:

A new firewall rule is added, but the client still has a DNS record cached.
Shortly after the router reboots and the client still has a DNS record cached. In these cases, clearing the DNS cache on the client, rebooting the client, or timing out the DNS record on the client will help.

If different DNS names resolve to the same IP address, then they cannot be distinguished. In this case, the first rule that references one of these DNS names always applies. This should not be a problem with large service providers. However, it could occur with small websites hosted by the same provider

FAQ

Apa sing kudu dilakoni yen isi filter profile kudu dimodifikasi?
- Yen sampeyan kudu ngowahi isi filter profile, ensure to adjust the corresponding firewall rule accordingly to maintain proper functionality.
Kepiye carane bisa njamin panggunaan LANCOM Security Essentials sing efektif?
- Kanggo mesthekake panggunaan efektif, ajeg review and update the category profiles and settings based on your organisation’s requirements and policies.

Dokumen / Sumber Daya

LANCOM Systems LCOS 10.92 Security Essentials [pdf] Pandhuan pangguna
LCOS 10.92, LCOS 10.92 Security Essentials, LCOS 10.92, Security Essentials, Essentials

Referensi

Manual pangguna

LANCOM Systems LCOS 10.92 Security Essentials

Pambuka

Miwiti cepet

Standard settings in the Content Filter

Setelan Umum

Settings for blocking

Override settings

Profiles ing Filter Konten

Options for the Content Filter

Additional settings for the Content Filter

BPjM module

FAQ

Dokumen / Sumber Daya

Referensi

Ninggalake komentar

Batal balesan