The Power of building Proxy ACLS
Proxy ACLs are similar to firewall rules. It is the same operating principle but only applies to the HTTP/HTTPS protocol
In order to offer a "centralized" system, and a unique competence, our development team makes sure that this principle of ACLs (the forms and the notion of objects) is in common with the other services such as Artica's firewall, Artica's DNS firewall, the management of the .pac proxy...
- How to enable the proxy ACLs feature ?
- The deny except method
- Forward requests to a specific network interface
- Web-filtering method with ACLs
- Use an outgoing network interface
- Import/export all/single ACL(s) rule(s)
Whitelisting
- The Global Whitelist
This list is used globally to access sites, and to pass through any filter at any cost (authentication, access rules, web filtering).
- Web API on the Global Whitelist
Manage the global authorization list via Web API, enabling other programs to automate authorization tasks.
- Whitelist Automation by accessing directly to the database
To feed white lists via script, you can read and write directly to the SQLite database
Blacklisting
- The Global Blacklist
The Global blacklist is used globally and prohibits access to sites, regardless of permissions and filters.
This list can be used to block access to anyone, regardless of user behavior.
- Web API on the Global blacklist
Manage the global authorization list via Web API, enabling other programs to automate authorization tasks.
- URL redirect using Javascript.
When a rule blocks a request, you can configure the proxy to force redirect to a custom web page of your choice.
Leveraging JavaScript minimizes the frequency of redirects, enhancing performance and user experience.
Acls
- Manage ACLs using the REST API
Through the API service, you can list, enable or disable main rules (ACLs). - Bandwidth Limiting
Limits incoming traffic with Artica Proxy edition, thus preventing your LAN users from consuming all the bandwidth of your internet link
Objects:
- ALL object
All object is an object that groups the concept of everything
- Group of objects
Group of other objects
- Access rule object
An Access Rule Object represents a single, simplified access rule.
By encapsulating simple rules as objects, you gain the flexibility to refine your policies—nesting multiple rule objects within one another to build complex, layered access controls.
- Artica categories
Categories object allows you to query the 70.000.000 Artica categorized websites
- Destination/Client IP Country
use MaxMind GeoIP to search the location of a destination or a source IP address
- Destination domain
Allows you to set a list of domains
- Time Slot (weekrange)
Allow you to define a range of days and time inside a week
- SSL certificate fingerprint
Perform an operation (deny,allow, use a specific outgoing address) using an SSL certificate fingerprint (sha1)
- SSL Certificate error
Used to match a specific SSL certificate validation error
- List of downloaded or uploaded URLs
This object can periodically retreive Urls via HTTP or HTTPs or can be filled by uploading a text file.
It matches strictly the full urls path listed in case sensitive.
Active Directory
- Recusive group search
When using filters with user groups, Artica only searches for users belonging to the specified group.
Child groups are not processed.
- Use an Active Directory group in ACLs
A video in order to create an ACL with an active directory, where the users within the group are blocked for the artica categories.
- Deny access to Internet from an Active Directory Group
A video in order to use An Active directory group in order to deny Internet access for all users stored in this group
Examples
- Allow Google services for specific domains
As an administrator, you might want to prevent users from signing in to Google services using any accounts other than those you provided them with.
- How to allow a single website and block all others
This method shows you the negation and domain acls objects that allow you to ban all sites that are not listed in the object container
- Bulk importation using Destination domain ACL
This trick allows you to download data from a URL.
The source files can be formatted with domains separated by a carriage return but also in "host" format.
- Block tlds like xyz or xxx or zip
We have no legitimate business need to access any ".xyz, xxx or .zip" domains.
Is there a reliable way to block access to this entire top-level domain ?