LANCOM Systemsi LCOS 10.92 turvaelemendid

Autoriõigus

© 2025 LANCOM Systems GmbH, Würselen (Germany). All rights reserved. While the information in this manual has been compiled with great care, it may not be deemed an assurance of product characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery. The reproduction and distribution of the documentation and software supplied with this product and the use of its contents is subject to written authorisation from LANCOM Systems. We reserve the right to make any alterations that arise as the result of technical development. Windows® and Microsoft® are registered trademarks of Microsoft, Corp. LANCOM, LANCOM Systems, LCOS, LANcommunity, LANCOM Service LANcare, LANCOM Active Radio Control, and AirLancer are registered trademarks. All other names or descriptions used may be trademarks or registered trademarks of their owners. This document contains statements relating to future products and their attributes. LANCOM Systems reserves the right to change these without notice. No liability for technical errors and/or omissions. This product contains separate open-source software components which are subject to their own licenses, in particular the General Public License (GPL). The license information for the device firmware (LCOS) is available on the device‘s WEBkonfiguratsiooniliides jaotises Lisad > Litsentsi teave. Kui vastav litsents seda nõuab, siis allikas files for the corresponding software components will be made available on a download server upon request. Products from LANCOM Systems include software developed by the “OpenSSL Project” for use in the “OpenSSL Toolkit” (www.openssl.org).
LANCOM Systemsi toodete hulka kuulub krüptotarkvara, mille on kirjutanud Eric Young (eay@cryptsoft.com).
LANCOM Systemsi toodete hulka kuulub NetBSD Foundation, Inc. ja selle kaastöötajate poolt välja töötatud tarkvara.
LANCOM Systemsi tooted sisaldavad LZMA SDK-d, mille on välja töötanud Igor Pavlov.

• LANCOM Systems GmbH
• Rohde & Schwarzi ettevõte
• Adenauerstr. 20/B2
• 52146 Wuerselen
• Saksamaa
• www.lancom-systems.com

Sissejuhatus

LANCOM Security Essentialsi abil saate filtreerida oma võrgus teatud sisu, et takistada juurdepääsu näiteksample, ebaseaduslik, ohtlik või solvav websites. Additionally, you can restrict private browsing on certain sites during working hours. This not only boosts employee productivity and network security but also ensures that full bandwidth is available exclusively for business processes. \LANCOM Security Essentials is an intelligent, dynamic websaidi filter. See võtab ühendust hinnanguserveriga, mis hindab usaldusväärselt ja täpselt websaite teie valitud kategooriate põhjal. LANCOM Security Essentialsi funktsionaalsus põhineb sisestatud IP-aadresside põhjal määratud IP-aadresside kontrollimisel URLPaljude lehtede puhul hinnatakse domeeni alamkatalooge ka eraldi, nii et domeeni erinevad osad URL saab erinevalt hinnata.

• Users cannot bypass webLANCOM Security Essentialsi poolt saidi kontrollimine, sisestades brauserisse saidi IP-aadressi. LANCOM Security Essentials kontrollib nii krüpteerimata (HTTP) kui ka krüpteeritud (HTTPS) andmeid. websaidid. BPjM moodul on osa LANCOM Security Essentialsist või selle saab eraldi hankida LANCOM BPjM Filter Option tarkvaralitsentsi kaudu. BPjM mooduli avaldab föderaalne laste ja noorte meediakaitse amet (Bundeszentrale für Kinder- und Jugendmedienschutz) ning see blokeerib domeene, millele ei tohi Saksamaal lastele ja noorukitele juurde pääseda. LANCOM Security Essentialsi jaoks ostetud litsents kehtib kindlale seadmekategooriale ja kindlale ajaperioodile (kas üks aasta või kolm aastat). Kasutajate arv on piiramatu. Teid teavitatakse ette, kui teie litsents hakkab aeguma.
• You can test the LANCOM Security Essentials on any router that supports this function. To do so, you must activate a time-limited 30-day demo license once per device. Demo licenses are created directly from within LANconfig. Right-click the device, select Activate Software Option from the context menu, and in the following dialog, click the link next to Need a demo license?. You will automatically be connected to the LANCOM registration server websait, kus saate seadme jaoks soovitud demolitsentsi valida ja registreerida.
• Kategooria profiles store all settings related to categories. You select from predefined main and subcategories in your LANCOM Security Essentials: 73 categories are grouped into 12 thematic groups, e.g., “Pornography”, “Shopping”, or “Illegal”. Each group allows you to enable or disable the included categories. Subcategories for “Pornography” include “Pornography”, “Sex toys”, “Sexual content”, “Nudity”, “Lingerie”, and “Sex education”.
  Additionally, administrators can enable an override option for each category during configuration. When override is active, users can temporarily access a blocked site by clicking a corresponding button—but the administrator will receive a notification via e-mail, SYSLOG, and/or SNMP trap.
  Using the category profile Koos valge ja musta nimekirjaga saate luua sisufiltri profiilifile mida saab tulemüüri kaudu kasutajatele määrata. Näiteksample, saate luua profifile “Employees_Department_A”, which is then assigned to all computers in that department.
  During installation, LANCOM Security Essentials automatically sets up useful default settings that only need to be activated for initial operation. In subsequent steps, you can further adapt the behaviour of LANCOM Security Essentials to your specific use case.
  Useful default settings are also automatically configured for the BPjM module. For exampNäiteks IPv4 või IPv6 tulemüüris on vaikimisi tulemüürireegel, mille sihtjaamaks on süsteemiobjekt „BPJM”. Määrake lähtejaamad võrkudeks, mida BPjM moodul peaks kaitsma. Reegli aktiveerimisel käivitatakse BPjM moodul.

LANCOM Security Essentialsi kasutamise nõuded

The following requirements must be met in order to use LANCOM Security Essentials:

1. The LANCOM Security Essentials option is activated.
2. Tulemüür peab olema lubatud.
3. Tulemüüri reegel peab valima sisufiltri profile.
4. Valitud sisufiltri profiilfile peab defineerima kategooria profile and optionally a white and/or blacklist for every time period of the day. To cover different time periods, a content filter profile can consist of multiple entries.
   If a specific time period is not covered by an entry, unrestricted access to websaidid on selle aja jooksul võimalikud.

Kui sisufiltri funktsioon onfile hiljem ümber nimetatakse, tuleb muuta ka tulemüüri reeglit.

Kiire algus

Pärast LANCOM Security Essentialsi installimist on kõik sätted kiireks kasutuselevõtuks eelkonfigureeritud.

• The operation of the LANCOM Security Essentials may be subject to data protection regulations in your country or to company policies. Please check applicable rules before commissioning.
• In LANconfig, the settings of the LANCOM Security Essentials are listed under Content Filter.

Activate the content filter using the following steps:

1. Launch the setup wizard for the corresponding device.
2. Select the setup wizard to configure the content filter.
3. Select one of the predefined security profiles (Basic Profile, Corporate Profile, Vanemliku kontrolli programmfile):
   • Põhiline profile: See profile mainly blocks access to categories such as pornography, illegal, violent or discriminatory content, drugs, spam, and phishing.
   • Töö profileLisaks Basic Pro-lefile seaded, see profffile also blocks categories such as shopping, job search, games, music, radio, and certain communication services like chat.
   • Parental control profileLisaks Basic Pro-lefile seaded, see profffile includes stricter blocking for nudity and weapons.

If the firewall is disabled, the wizard will enable it. The wizard then checks whether the firewall rule for the content filter is set correctly and adjusts it if necessary. With these steps, the content filter is activated, and the default settings will apply to all stations in the network using the selected content filter profile tühjade mustade ja valgete nimekirjadega. Vajadusel kohandage neid sätteid vastavalt oma vajadustele. Viisard aktiveerib sisufiltri selle ajavahemiku jaoks ALATI.

Standard settings in the Content Filter

The following elements have been created in the default configuration of the Content Filter:

Firewall rule

The preset firewall rule is named CONTENT-FILTER and uses the action object CONTENT-FILTER-BASIC.

Firewall action objects

There are three firewall action objects:

• CONTENT-FILTER-BASIC
• CONTENT-FILTER-WORK
• CONTENT-FILTER-PARENTAL-CONTROL

These action objects work with the corresponding content-filter profiles.

Content filter profiles

There are three content filter profiles. Kogu sisu filtreerimine profileKasutan ajaraami ALATI, musta nimekirja MINU MUST LOEND ja valget nimekirja MINU VALGE LOEND. Iga sisufiltri funktsioonfile kasutab ühte eelnevalt määratletud kategooriaprofifiles:

• CF-BASIC-PROFILESee sisufiltri profile features a low level of restrictions and works with the category profile BASIC-CATEGORIES.
• CF-PARENTAL-CONTROL-PROFILESee sisufiltri profile protects minors (e.g. trainees) from unsuitable Internet content, and it works with the category profile PARENTAL-CONTROL.
• CF-WORK-PROFILESee sisufiltri profile is intended for companies wishing to place restrictions on categories such as Job Search or Chat. It works with the category profile TÖÖKATEGOORIAD.

Ajakava

There are two predefined timeframes:

• ALWAYS: 00.00-23.59 hrs
• NEVER: 00.00-0.00 hrs

Must nimekiri

• The preset blacklist is named MY-BLACKLIST and it is empty. Here you can optionally enter URLs, mis tuleb keelata.

Valge nimekiri

• The preset whitelist is named MY-WHITELIST and it is empty. Here you can optionally enter URLs, mis on lubatud.

Kategooria profiles

• There are three category profiles: PÕHIKATEGOORIAD, TÖÖKATEGOORIAD ja VANEMLIK KONTROLL. Kategooria profile määrab lubatud ja keelatud kategooriad ning mille puhul saab aktiveerida tühistamise.

Üldsätted

Saate määrata globaalse sisufiltri seaded LANconfigis jaotises Sisufilter > Üldine:

Activate Content Filter

This allows you to activate the content filter.

In case of error

This lets you define what happens in the event of an error. For exampNäiteks kui hinnanguserveriga ei saada ühendust, määrab see säte, kas kasutaja saab vabalt sirvida või mitte. web juurdepääs on blokeeritud.

On license expiration

The license for using LANCOM Security Essentials is valid for a specific period. You will be reminded of the upcoming license expiration 30 days, one week, and one day in advance (to the email address configured in LANconfig under Log & Trace > General > E-mail addresses > E-mail for license expiry reminder). Here, you can specify whether webpärast litsentsi kehtivusaja lõppemist tuleks saidid blokeerida või kontrollimatult läbi lasta. Selle seadistuse põhjal saab kasutaja pärast litsentsi kehtivusaja lõppemist vabalt sirvida või kõik saidid web juurdepääs keelatakse.

To ensure the reminder is actually sent to the specified email address, you must configure the appropriate SMTP account.

On Non-HTTPS via TCP port 443

Keelatud

Disallows non-HTTPS traffic on port 443.

Lubatud

Allows non-HTTPS traffic on port 443.
TCP port 443 is reserved by default exclusively for HTTPS connections. Some applications that do not use HTTPS still use TCP port 443. In such cases, you can allow TCP port 443 to accept non-HTTPS traffic.

• If you allow non-HTTPS connections on port 443, the traffic will not be classified but instead generally permitted. By default, non-HTTPS traffic on port 443 is not allowed.

Max. proxy connections

Set the maximum number of simultaneous proxy connections allowed. This helps limit system load. A notification is triggered if this number is exceeded. You can configure the type of notification under Content Filter > Options > Event notification.

Proxy processing timeout

Specify the time in milliseconds the proxy is allowed for processing. If this time is exceeded, a timeout error page is returned.

Save Content Filter information to flash ROM activated

If enabled, this option stores content filter information in the device’s Flash ROM.

Allow wildcard certificates

Sest websites using wildcard certificates (with CN entries such as *.mydomain.de de), enabling this function uses the main domain (mydomain.de) for filtering. The filtering process occurs in the following order:

• Check the server name in the “Client Hello” (depending on the browser used)
• Check the CN in the received SSL certificate
• Wildcard entries are ignored
• If the CN is not usable, the “Alternative Name” field is evaluated
• DNS reverse lookup of the corresponding IP address and evaluation of the resulting hostname
• If wildcards are included in the certificate, the main domain is used instead (as described above)
• Kontrollige IP-aadressi

Settings for blocking

Sa kohandad webSaidi blokeerimise seaded siin:

LANconfig: Content filter > Blocking / Override > Blocking & error
Command line: Setup > UTM > Content-Filter > Global-Settings

Alternative blocking URL:

Siia saate sisestada alternatiivse aadressi URLKui juurdepääs on blokeeritud, siis URL siia sisestatud kuvatakse soovitud asemel web sait. Saate seda välist HTML-lehte kasutada oma ettevõtte kujunduse kuvamiseks, näiteksample või selliste funktsioonide täitmiseks nagu JavaScripti rutiinid jne. Võite kasutada ka sama tags here as used in the blocking text. If you do not make any entry here, the default page stored in the device will be displayed..

Võimalikud väärtused:

• • Kehtiv URL aadress
• Vaikimisi:
  • Tühi

Alternative error URL:

Siia saate sisestada alternatiivse aadressi URLVea korral URL siia sisestatud kuvatakse tavapärase asemel web sait. Saate seda välist HTML-lehte kasutada oma ettevõtte kujunduse kuvamiseks, näiteksample või selliste funktsioonide täitmiseks nagu JavaScripti rutiinid jne. Võite kasutada ka sama tags here as used in the error text. If you do not make any entry here, the default page stored in the device will be displayed..

• Võimalikud väärtused:
  • Kehtiv URL aadress
• Vaikimisi:
  • Tühi

Source addr. for alt. block URL:

This is where you can configure an optional sender address to be used instead of the one that would normally be automatically selected for this target address. If you have configured loopback addresses, you can specify them here as sender address.

Võimalikud väärtused:

• Name of the IP networks whose address should be used
• INT for the address of the first Intranet
• DMZ for the address of the first DMZ.

If there is an interface called DMZ, its address will be taken in this case.

• LB0…LBF for the 16 loopback addresses
• KÜLALINE
• Any IP address in the form x.x.x.x

Vaikimisi:

• Tühi
  The sender address specified here is used unmasked for every remote station.

Allika aadressi viga alt-aadressi jaoks URL:

• This is where you can configure an optional sender address to be used instead of the one that would normally be automatically selected for this target address. If you have configured loopback addresses, you can specify them here as sender address.

Võimalikud väärtused:

• Name of the IP networks whose address should be used
• INT for the address of the first Intranet
• DMZ for the address of the first DMZ.

If there is an interface called DMZ, its address will be taken in this case.

• LB0…LBF for the 16 loopback addresses
• KÜLALINE
• Any IP address in the form x.x.x.x

Vaikimisi:

• Tühi

The sender address specified here is used unmasked for every remote station.

Block text

Siin saate määrata teksti, mis kuvatakse blokeerimise korral. Erinevate keelte jaoks saab määrata erinevad blokeerimistekstid. Blokeerimisteksti kuvamist kontrollib brauseri (kasutajaagendi) edastatud keeleseade.

Keel

Entering the appropriate country code here ensures that users receive all messages in their browser’s preset language. If the country code set in the browser is found here, the matching text will be displayed. You can add any other language.
Examples of the country code:

• de-DE: German-Germany
• de-CH: German-Switzerland
• de-AT: German-Austria
• en-GB: English-Great Britain
• en-US: English-United States

The country code must match the browser language setting exactly, e.g. “de-DE” must be entered for German (“de” on its own is insufficient). If the country code set in the browser is not found in this table, or if the text stored under that country code is deleted, the predefined default text (“default”) will be used. You can modify the default text.

Võimalikud väärtused:

• 10 alphanumerical characters

Vaikimisi:

• Tühi

Tekst

Enter the text that you wish to use as block text for this language.

Võimalikud väärtused:

• 254 tähte ja numbrit

Vaikimisi:

• Tühi

Special values:

You can also use special tags teksti blokeerimiseks, kui soovite kuvada erinevaid lehti olenevalt põhjusest, miks see web site was blocked (e.g. forbidden category or entry in the blacklist).

Järgmised tags saab kasutada kui tag väärtused:

• <CF-URL/> keelatud asja jaoks URL
• <CF-CATEGORIES/> for the list of categories why the web site was blocked
• <CF-PROFILE/> professionaalidelefile nimi
• <CF-OVERRIDEURL/> selle jaoks URL kasutatakse aktiveerimiseks URL (seda saab integreerida lihtsasse tag or in a button)
• <CF-LINK/> adds a link for activating the override
• <CF-BUTTON/> for a button to activate the override
• <CF-IF att1 att2> … </CF-IF> to display or hide parts of the HTML document. The attributes are:
• BLACKLIST: If the site was blocked because it is in the profile must nimekiri
• CATEGORY: If the site was blocked due to one of its categories
• ERR: If an error has occurred.
• OVERRIDEOK: If users have been allowed an override (in this case, the page should display an appropriate button)

Since there are separate text tables for the blocking page and the error page, this attribute only makes sense if you have configured an alternative URL blokeerimisel kuvamiseks. Kui ühes on määratletud mitu atribuuti tag, kuvatakse jaotis, kui vähemalt üks neist tingimustest on täidetud. Kõik tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking text may only contain a maximum of 254 characters.

Example:

<CF-URL/> on blokeeritud, kuna see vastab kategooriatele . Sinu sisuprofffile on .

The tags siin kirjeldatud saab kasutada ka välistel HTML-lehtedel (alternatiiv URLs blokeerimisel kuvamiseks).

Error text

Siin saate määrata teksti, mis kuvatakse vea ilmnemisel.

Keel

Entering the appropriate country code here ensures that users receive all messages in their browser’s preset language. If the country code set in the browser is found here, the matching text will be displayed. You can add any other language.

Examples of the country code:

• de-DE: German-Germany
• de-CH: German-Switzerland
• de-AT: German-Austria
• en-GB: English-Great Britain
• en-US: English-United States

The country code must match the browser language setting exactly, e.g. “de-DE” must be entered for

German (“de” on its own is insufficient). If the country code set in the browser is not found in this table, or if the text stored under that country code is deleted, the predefined default text (“default”) will be used. You can modify the default text.

Võimalikud väärtused:

• 10 alphanumerical characters

Vaikimisi:

• Tühi

Tekst

Enter the text that you wish to use as error text for this language.

Võimalikud väärtused:

• 254 tähte ja numbrit

Vaikimisi:

• Tühi

Special values:

You can also use HTML tags for the error text.

The following empty element tags saab kasutada kui tag väärtused:

• <CF-URL/> keelatud asja jaoks URL
• <CF-PROFILE/> professionaalidelefile nimi
• <CF-ERROR/> for the error message

Example:

<CF-URL/> on blokeeritud, kuna ilmnes viga:

Override settings

Ülekirjutusfunktsioon võimaldab a websaidile pääseda isegi siis, kui see on liigitatud keelatuks. Kasutaja peab keelatud lehe avamise taotlemiseks klõpsama tühistamisnupul. Selle funktsiooni saab konfigureerida nii, et administraatorit teavitatakse tühistamisnupu klõpsamisest (LANconfig: Sisu filter > Valikud > Sündmused).

If the override type “Category” has been activated, clicking on the override button makes all of the categories for that URL kasutajale ligipääsetav Järgmisel kuvataval blokeerimislehel on ainult üks kategooria, mis selgitab, miks juurdepääs URL was blocked. If the override type “Domain” has been activated, then the entire domain can be accessed.

The settings for the override function are to be found here:

LANconfig: Content filter > Blocking / Override > Override
Command line: Setup > UTM > Content-Filter > Global-Settings

Override-Active

This is where you can activate the override function and make further related settings.

Override duration

Siin saab piirata tühistamise kestust. Kui periood lõpeb, blokeeritakse uuesti kõik katsed samale domeenile ja/või kategooriale juurde pääseda. Uuesti tühistamisnupule klõpsamine lubab... web site to be accessed again for the duration of the override and, depending on the settings, the administrator will be notified once more.

Võimalikud väärtused:

• 1-1440 (minutit)

Vaikimisi:

• 5 (minutit)

Override type:

This is where you can set the type of override. It can be allowed for the domain, for the category of web site to be blocked, or for both.

Võimalikud väärtused:

Kategooria

For the duration of the override, all URLLubatud on toimingud, mis kuuluvad mõjutatud kategooriatesse (samuti need, mis oleksid lubatud ka ilma tühistamiseta).

Domeen

For the duration of the override all URLs in this domain are allowed, irrespective of the categories they belong to.

Category-and-Domain

For the duration of the override, all URLLubatud on nii sellesse domeeni kui ka lubatud kategooriatesse kuuluvad objektid. See on kõrgeim piirang.

Override text

Siin saate määrata teksti, mis kuvatakse kasutajatele tühistamise kinnitamisel.

Keel

Entering the appropriate country code here ensures that users receive all messages in their browser’s preset language. If the country code set in the browser is found here, the matching text will be displayed. You can add any other language.

Examples of the country code:

• de-DE: German-Germany
• de-CH: German-Switzerland
• de-AT: German-Austria
• en-GB: English-Great Britain
• en-US: English-United States

The country code must match the browser language setting exactly, e.g. “de-DE” must be entered for German (“de” on its own is insufficient). If the country code set in the browser is not found in this table, or if the text stored under that country code is deleted, the predefined default text (“default”) will be used. You can modify the default text.

Võimalikud väärtused:

• 10 alphanumerical characters

Vaikimisi:

• Tühi

Tekst

Enter the text that you wish to use as override text for this language.

Võimalikud väärtused:

• 254 alphanumerical characters

Vaikimisi:

• Tühi

Special values:

You can also use HTML tags teksti blokeerimiseks, kui soovite kuvada erinevaid lehti olenevalt põhjusest, miks see web site was blocked (e.g. forbidden category or entry in the blacklist).

Järgmised tags saab kasutada kui tag väärtused:

• <CF-URL/> algselt keelatud URL that is now allowed
• <CF-CATEGORIES/> for the list of categories that have now been allowed as a result of the override (except if domain override is specified).
• <CF-BUTTON/> displays an override button that forwards the browser to the original URL.
• <CF-BUTTON/> displays an override link that forwards the browser to the original URL.
• <CF-HOST/> or <CF-DOMAIN/> displays the host or the domain for the allowed URL. The tags are of equal value and their use is optional.
• <CF-ERROR/> generates an error message in the event that the override fails.
• <CF-DURATION/> displays the override duration in minutes.
• <CF-IF att1 att2> … </CF-IF> to display or hide parts of the HTML document. The attributes are:
• CATEGORY when the override type is “Category” and the override was successful
• DOMAIN when the override type is “Domain” and the override was successful
• BOTH when the override type is “Category-and-Domain” and the override was successful
• ERROR when the override fails
• OK if either CATEGORY or DOMAIN or BOTH are applicable

If several attributes are defined in one tag, peaks jaotis kuvatama, kui vähemalt üks neist tingimustest on täidetud. Kõik tags and attributes can be abbreviated to the first two letters (e.g. CF-CA or CF-IF BL). This is necessary as the blocking text may only contain a maximum of 254 characters.

Example:

Kategooriad on domeenis Domeen on vabastatud minutit. Ülekirjutamise viga:

Profilesisufiltris

Sisu filtri alt > Profilesaate luua sisufiltri profilemida kasutatakse kontrollimiseks web keelatud sisuga saite. Sisu filtreerimise tööriistfile sellel on alati nimi ja see aktiveerib erinevateks ajaperioodideks soovitud kategooriaprofiili.file ja valikuliselt must nimekiri ja valge nimekiri. Erinevate ajaraamide jaoks erinevate konfiguratsioonide pakkumiseks on mitu sisufiltriprogrammifile kirjed luuakse sama nimega. Sisufiltri funktsioonfile koosneb seega kõigi samanimeliste kirjete summast. Tulemüür viitab sellele sisufiltriprogrammilefile.

Please note that you must make corresponding settings in the firewall in order to use the profiles LANCOMi sisufiltris.

Profiles

Professionaali seadedfiled leiate siit:

LAN-konfiguratsioon: sisu filer > Profiles > Profile
Käsurida: Seadistamine > UTM > Sisufilter > Profiles > Profile

Nimi

Profile name that the firewall references must be specified here.

Ajakava

Valige selle kategooria jaoks ajavahemik, mis on profile and, optionally, the blacklist and the whitelist. The timeframes

ALWAYS and NEVER are predefined. You can configure other timeframes under:

• LANconfig: Date & time > General > Time frame
• Command line: Setup > Time > Timeframe

One profile may contain several lines with different timeframes.

Võimalikud väärtused:

• Alati
• Mitte kunagi
• Name of a timeframe profile

If multiple entries are used for a content-filter profile ja nende ajaraamid kattuvad, blokeeritakse kõik aktiivsetes kirjetes olevad lehed selleks ajaks. Kui sisufiltri jaoks kasutatakse mitut kirjetfile ja ajaperiood jääb määratlemata, juurdepääs kõigile web sites will be unchecked for this period.

Must nimekiri

Name of the blacklist profile see on selle sisufiltri profiili jaoks kandideeriminefile during the period in question. A new name can be entered, or an existing name can be selected from the blacklist table.

Võimalikud väärtused:

• Name of a blacklist profile
• New name

Valge nimekiri

Name of the whitelist profile see on selle sisufiltri profiili jaoks kandideeriminefile during the period in question. A new name can be entered, or an existing name can be selected from the whitelist table.

Võimalikud väärtused:

• Name of a whitelist profile
• New name

Kategooria profile

Kategooria nimi profile see on selle sisufiltri profiili jaoks kandideeriminefile during the period in question. A new name can be entered, or an existing name can be selected from the category table.

Võimalikud väärtused:

• Name of a category profile
• New name

Blacklist addresses (URL)

Siin saate neid konfigureerida web saidid, mis tuleks blokeerida.

• LAN-konfiguratsioon: sisu files > Profiles > Musta nimekirja aadressid (URL)
• Käsurida: Seadistamine > UTM > Sisufilter > Profiles > Must nimekiri

Nimi

Enter the name of the blacklist for referencing from the content-filter profile.

Võimalikud väärtused:

• Blacklist name

Aadress (URL)

Juurdepääs URLs entered here will be forbidden by the blacklist.

Võimalikud väärtused:

• Kehtiv URL aadress

The following wildcard characters may be used:

• * for any combination of more than one character (e.g. www.lancom.* encompasses the websaidid www.lancom.com, www.lancom.de, www.lancom.eu, www.lancom.esjne)
• ? for any one character (e.g. www.lancom.e* encompasses the web saidid www.lancom.eu, www.lancom.es)

URLs tuleb sisestada ilma eesoleva http://-ta. Pange tähele, et paljude puhul URLs, a forward slash is automatically added as a suffix to the URL, e.g. “www.mycompany.de/”. For this reason, it is advisable to enter the URL as: “www.mycompany.de*”.

Individuaalne URLs on eraldatud tühikuga.

Whitelist addresses (URL)

Siin saate seadistada web saidid, millele juurdepääs on lubatud.

LAN-konfiguratsioon: sisu files > Profiles > Valge nimekirja aadressid (URL)
Käsurida: Seadistamine > UTM > Sisufilter > Profiles > Whitelist

Nimi

Sisesta valge nimekirja nimi, millele viidatakse sisufiltri profiilist.file.

Võimalikud väärtused:

• Name of a whitelist

Aadress (URL)

Siin saate seadistada websites which are to be checked locally and then accepted

Võimalikud väärtused:

• Kehtiv URL aadress

The following wildcard characters may be used:

• * for any combination of more than one character (e.g. www.lancom.* encompasses the websaidid www.lancom.com, www.lancom.de, www.lancom.eu, www.lancom.esjne)
• ? for any one character (e.g. www.lancom.e* encompasses the web saidid www.lancom.eu, www.lancom.es)
• URLs tuleb sisestada ilma eesoleva http://-ta. Pange tähele, et paljude puhul URLs, a forward slash is automatically added as a suffix to the URL, e.g. “www.mycompany.de/”. For this reason, it is advisable to enter the URL as: “www.mycompany.de*”.

Individuaalne URLs on eraldatud tühikuga.

Kategooria profiles

Siin loote kategooriaprofiilifile ja määrake kindlaks, milliseid kategooriaid või rühmi tuleks hindamiseks kasutada web iga kategooria saidid profileSaate lubada või keelata üksikuid kategooriaid või aktiveerida iga rühma puhul tühistamisfunktsiooni.

LANconfig: Sisufilter > Profiles > Categories
Käsurida: Seadistamine > UTM > Sisufilter > Profiles > Kategooria-Profile

Kategooria profile

Kategooria pro nimifile sisufiltriprogrammist viitamiseksfile is entered here.

Võimalikud väärtused:

• Name of a category profile

Category settings

For each main category and the associated sub-categories, it is possible to define whether the URLs are to be allowed, forbidden or allowed with override only.

The following main categories can be configured:

• Ebaseaduslik
• Cyberthreats
• pornograafia
• Reklaam
• Mängud
• Web rakendusi
• Ostlemine
• Rahandus
• Religions & occult
• Teave
• Entertainment & Culture
• Mitmesugust

Kategooria profile tuleb seejärel määrata sisufiltri profiililefile together with a time frame in order to become active.

Võimalikud väärtused:

• a Allowed, forbidden, override

Options for the Content Filter

Jaotises Sisufilter > Valikud saate määrata, kas soovite saada sündmustest teavitusi ja kuhu sisufiltri teavet salvestatakse.

Sündmused

This is where you define how you wish to receive notification of specific events. Notification can be made by e-mail, SNMP or SYSLOG. For different event types you can specify whether messages should be output and, if so, how many.

E-post

Here, you specify if and how e-mail notification takes place:

• Ei
  No e-mail notification is issued for this event.
• Kohe
  Notification occurs when the event occurs.
• Igapäevane
  The notification occurs once per day.

Notifications can be sent for the following events:

• Viga
  For SYSLOG: Source “System”, priority “Alert”.
  Default: SNMP notification
• License expiry
  For SYSLOG: Source “Admin”, priority “Alert”.
  Default: SNMP notification
• License exceeded
  For SYSLOG: Source “Admin”, priority “Alert”.
  Default: SNMP notification
• Override applied
  For SYSLOG: Source “Router”, priority “Alert”.
  Default: SNMP notification
• Proxy limit
  For SYSLOG: Source “Router”, priority “Info”.
  Default: SNMP notification

E-mail recipient

An SMTP client must be defined if you wish to use the e-mail notification function. You can use the client in the device, or another client of your choice.

No e-mail will be sent if no e-mail recipient is specified.

Content Filter snapshot

This is where you can activate the content filter snapshot and determine when and how often it should be taken. The snapshot copies the category statistics table to the last snapshot table, overwriting the old contents of the snapshot table. The category statistics values are then reset to 0.

Intervall

Here you decide whether the snapshot should be taken monthly, weekly or daily.

Võimalikud väärtused:

• Igakuine
• Iganädalane
• Igapäevane

Kuu päev

For monthly snapshots, set the day of the month when the snapshot should be taken. Possible values: a 1-31

It is advisable to select a number between 1 and 28 in order to ensure that it occurs every month.

Nädalapäev

For weekly snapshots, set the day of the week when the snapshot should be taken. Possible values:

• Esmaspäev, teisipäev, kolmapäev, neljapäev, reede, laupäev, pühapäev

Kellaaeg:

If you require a daily snapshot, then enter here the time of day for the snapshot in hours and minutes. Possible values:

• Format HH:MM (default: 00:00)

Additional settings for the Content Filter

Firewall settings for the content filter

The firewall must be activated in order for the Content Filter to function. You can activate the firewall under:

• LANconfig: Firewall/QoS > General
• Command line: Setup > IP-Router > Firewall

In the default configuration, you will find the firewall rule CONTENT-FILTER that refers to the action object CONTENT-FILTER-BASIC:

The firewall rule should be limited to the target services HTTP and HTTPS so that only outgoing HTTP and HTTPS connections are examined. Without this restriction, all packets will be checked by the content filter, which could lead to a loss of system performance. A content-filter related firewall rule must contain a special action object that uses packet actions to check the data according to a content-filter profile. In the default configuration, you will find the action objects CONTENT-FILTER-BASIC,

CONTENT-FILTER-WORK and CONTENT-FILTER-PARENTAL-CONTROL, each of which refer to their corresponding content-filter profile:

Example: Kui a web Kui lehele ligipääsetakse, läbivad andmepaketid tulemüüri ja neid töötleb reegel CONTENT-FILTER. Toiminguobjekt CONTENT-FILTER-BASIC kontrollib andmepakette, kasutades reeglit content-filter pro.file SISU-FILTER-PÕHILINE.

Ajakava

Ajaraamid kasutatakse koos sisufiltriga, et määrata ajad, millal sisufiltri protsessfilekehtivad. Üks profffile võib sisaldada mitut rida erinevate ajaraamidega. Ajaraami erinevad read peaksid üksteist täiendama, st kui määrate TÖÖAJA, peaksite tõenäoliselt määrama ajaraami nimega VABATIME, et katta aeg väljaspool tööaega. Ajaraame saab kasutada ka WLAN SSID püsiva edastamise takistamiseks. Selle saab lisada loogiliste WLAN-i sätetesse. Ajarajad ALATI ja KUNAGI on eelnevalt määratletud. Teisi ajaraame saate konfigureerida järgmiste jaotiste all:

Command line: Setup > Time > Timeframe

Nimi

Sisesta viitamise ajaraami nimi sisufiltri profiilistfile või WLAN SSID abil. Mitu sama nimega kirjet annavad tulemuseks ühise profiili.file.

Võimalikud väärtused:

• Name of a timeframe

Alusta

Here you set the start time (time of day) when the selected profile becomes valid.

Võimalikud väärtused:

• Format HH:MM (default: 00:00)

Peatus

Here you set the stop time (time of day) when the selected profile ceases to be valid.

Võimalikud väärtused:

• Format HH:MM (default: 23:59)

A stop time of HH:MM usually runs until HH:MM:00. The stop time 00:00 is an exception, since this is interpreted as 23:59:59.

Argipäevad

Here you select the weekday on which the timeframe is to be valid.

Võimalikud väärtused:

• Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday, Holiday

The holidays are set under Date & Time > General > Public holidays.

Saate koostada sama nimega, aga erinevate aegadega ajakava, mis ulatuvad mitmele reale:

BPjM module

BPjM mooduli seadistas Saksamaa föderaalne revolutsiooniteenistus.view Alaealistele kahjuliku meedia nõukogu (BPjM) ja plokid websaidid, mis ei tohiks olla lastele ja noortele ligipääsetavad. See funktsioon on eriti oluline koolide ja haridusasutuste jaoks, kus õpivad alaealised õpilased. DNS-domeenid, mille sisu on ametlikult liigitatud alaealistele kahjulikuks, ei ole vastaval sihtrühmal ligipääsetavad. Selle loendi automaatne uuendamine ja regulaarne laiendamine on garanteeritud. BPjM moodul blokeerib DNS-domeenid, mis on ametlikult loetletud webföderaalse revolutsiooni saitview Alaealistele kahjuliku meedia nõukogu (BPjM) Saksamaal. Kategooria järgi blokeerimine ja tühistamised (lubamine) pole saadaval. BPjM moodul on saadaval LANCOM-i sisufiltri osana või eraldi LANCOM-i BPjM-i filtri tarkvaravaliku kaudu. IPv4 või IPv6 tulemüürid rakendavad seda funktsiooni vaikimisi tulemüürireegliga, mida saab iga võrgu jaoks aktiveerida ja konfigureerida. NäiteksampNäiteks on võimalik selle filtriga varustada ainult õpilaste võrk, kuid teised võrgud sellest välja jätta. IPv6 tulemüüril on uus vaikereegel BPJM, mis on vaikimisi deaktiveeritud ja sihtjaamaks on süsteemiobjekt „BPJM”. Sarnane reegel on saadaval ka IPv4 tulemüüris. BPjM mooduli poolt kaitstavad võrgud on määratud lähtejaamadena.

Täiendavad sätted leiate LANconfigist menüüst Muud teenused > Teenused > BPjM-filter.

Allika aadress

Source address used by the BPjM module to access the server for BPjM signature updates.

Soovitused kasutamiseks

If content filters and BPJM filters are to be used together, both rules must be configured with different priorities so that they are run through one after the other. Likewise, for the first rule, care must be taken to ensure that the item “Observe further rules, after this rule matches” is activated.
In rare cases, the BPJM module may block desired domains because only (DNS) domains and not URL directory levels can be checked due to TLS. In this case, these desired domains can be added to the “BPJM Allow list”, e.g. *.example.com. The LANCOM router must serve as DNS server or DNS forwarder in the network, i.e. clients in the local network must use the router as DNS server. In addition, the direct use of DNS-over-TLS and DNS-over-HTTPS (possibly browser-internal) with external DNS servers by clients must be prevented.

This can be achieved as follows:

• The DHCP server must distribute the router’s IP address as the DNS server (set up by default by the Internet Wizard).
• Set up firewall rules that prevent direct use of external DNS servers, for example. by blocking outgoing port 53 (UDP) for clients from the corresponding source network.
• Setting up firewall rules that prevent direct use of external DNS servers supporting DNS-over-TLS, e.g. by blocking outgoing port 853 (TCP) for clients from the corresponding source network.
• Disabling DNS-over-HTTPS (DoH) in the browser.

Notes on synchronising the firewall’s DNS database: Because the firewall learns its information from client DNS requests, in certain situations, the DNS database may not yet be complete. This can happen in the following situations:

• A new firewall rule is added, but the client still has a DNS record cached.
• Shortly after the router reboots and the client still has a DNS record cached. In these cases, clearing the DNS cache on the client, rebooting the client, or timing out the DNS record on the client will help.

If different DNS names resolve to the same IP address, then they cannot be distinguished. In this case, the first rule that references one of these DNS names always applies. This should not be a problem with large service providers. However, it could occur with small websites hosted by the same provider

KKK

• Mida peaksin tegema, kui sisufiltri profile on vaja muuta?
  • Kui teil on vaja sisu filtreerimise profiili muutafile, ensure to adjust the corresponding firewall rule accordingly to maintain proper functionality.
• Kuidas saan tagada LANCOM Security Essentialsi tõhusa kasutamise?
  • Tõhusa kasutamise tagamiseks kontrollige regulaarseltview and update the category profiles and settings based on your organisation’s requirements and policies.

Dokumendid / Ressursid

LANCOM Systemsi LCOS 10.92 turvaelemendid [pdfKasutusjuhend LCOS 10.92, LCOS 10.92 turbe põhitõed, LCOS 10.92, turbe põhitõed, põhitõed

Viited

• Kasutusjuhend