1. Getting started

3. Blacklist and domain categorization

4. Authentication

5. GUI overview

12. FAQ

- Windows, Linux, FreeBSD or other OS having Java(JRE) 1.7 or higher installed.
- 768 MB RAM.
- 4 GB of free disk space.
- UDP/53, TCP/80, TCP/443 ports.

- Go index -

We provide a Windows installer. When you download and run 'nxfilter-x.x.x.x.exe' you will see the following window.

After you follow several steps on the installer, it will try to create a Windows service for NxFilter. If you see the following message, you have NxFilter successfully installed.

To access its admin GUI, start your browser and type 'http://localhost/admin' into the address bar. Or if you created a desktop icon during the installation process you can click it. If you see a login screen like below, your NxFilter is up and running. The initial login name and password are 'admin' and 'admin'.

- Go to index -

We have a 'deb' package for installing NxFilter on Ubuntu Linux. To install it, after you install Java, download the package using 'wget', and then install it using 'dpkg'. Then start it from the Systemd script bundled with the package.

To access its admin GUI, start your browser. If you install it on '192.168.0.100' type 'http://192.168.0.100/admin' into the address bar of your browser. The initial admin name and password are 'admin' and 'admin'.

When you update NxFilter using a 'deb' package and if you update it to v4.0.3 use the following commands,

To remove NxFilter,

On Ubuntu 18, 'systemd-resolved' service uses UDP/53. You have to disable it before you install NxFilter. To stop and disable it, run these commands,

- Go to index -

We provide a Windows installer and packages for some Linux distributions for installaing and updating NxFilter. While it is convenient, sometimes you have to do it with a 'zip' package. When you update NxFilter using a 'zip' package,

1. Download 'nxfilter-x.x.x.zip' file.

2. Stop NxFilter.

3. Extract the zip file into the directory NxFilter installed.

4. Start NxFilter.

- Go index -

There are several utility scripts for NxFilter in '/nxfilter/bin' directory.

On Windows, use '.bat' files instead of '.sh' files.

- Go index -

After you install NxFilter you want to monitor and filter Internet activity in your network. To monitor and filter Internet activity you need to make NxFilter to be the only DNS server for your network.

The simplest way of setting up a DNS server for your users would be modifying the network setup on OS level like the above. But you don't want to set up all the PC in your network one by one. So the best way would be using DHCP server. You just need to modify DNS server address on your DHCP server setup and then your users will be using NxFilter as their DNS server.

If you have a firewall you can force your users to use NxFilter as their DNS server by blocking outgoing traffic on UDP/53, TCP/53 port. Now NxFilter became the only DNS server your users can use.

- Go index -

A blacklist is a database of categorized domains. It is an essential part of a DNS filter for blocking websites by categories. NxFilter supports several blacklists.

1. Jahaslist

2. Cloudlist

3. Globlist

- Go index -

You can add domains directly into system categories. It works like the domains added into custom categories. Even if you have the same domain classified differently in your blacklist your custom classification overrides it. So the effect of it is immediate. No need to report it back to somewhere and wait to see it updated.

There are two ways of reclassification. One is to add domains on 'Category > System' and the other one is using the popup reclassification form by clicking a domain on 'Logging > Request'.

- Go index -

NxFilter provides several authentication methods including single sign-on with Active Directory integration.

Why authentication

When you install NxFilter first time you only have one policy and it applies to everybody in your network. But what if you are working for a school as a systems administrator and you want to apply a policy based on user and group. For students, a stricter policy and for teachers, a bit lenient policy. Now you need to differentiate users. That's when you need to enable authentication.

Which authentication

NxFilter supports several ways of authentication. You can choose one of them or mix and match some of them.

1. IP based authentication

2. Password based authentication

3. LDAP based authentication

4. Login token based authentication

5. Single sign-on against Active Directory

- Go index -

NxMapper is a Windows service program that you can install and run on a domain controller. It will detect user logon events and create login sessions on NxFilter.

Install and run NxMapper

We offer a Windows installer for NxMapper. It will install NxMapper as a Windows service. After you install it, you will see its setup program running.

'Server IP' is your NxFilter IP address. When you check 'Refresh Session', it will refresh the login session it created on NxFilter.

After you modify the config values, test your setup and then start it.

- Go to index -

NxFilter supports multiple authentication methods. But what if a user having an associated IP also falls into an IP range which is associated to a different user? Or what if a user passed NxFilter login-page is in an IP range which associated to another user? To address this issue, we have a sequential order for the authentication methods.

This is the order of authentication methods.

1. Single IP association

2. IP session

3. IP range association

- Go index -

These are mostly system configuration parameters for NxFilter. Config > Setup > Block and Authentication

- Block Redirection IP

- External Redirection IP

- IPv6 Redirection IP

- Enable Authentication

- Login Domain

- Logout Domain

- Login Session TTL

- Disable Login Redirection

Config > Setup > Syslog

NxFilter supports Syslog exportation of its log data. You can build your own reporting system with this feature or you can monitor all the logging in a real-time manner.

- Syslog Host

- Syslog Port

- Export Blocked Only

- From Each Node

- Enable Remote Logging

Config > Setup > NetFlow

NxFilter supports bandwidth control. This is possible by importing NetFlow data.
To find out more, read this, Bandwidth control with NxFilter

- Router IP

- Listen Port

- Run Collector

Config > Setup > Misc

- Admin Domain

- Bypass Microsoft Update

- Logging Retention Period

- SSL Only to Admin GUI

- Auto Backup

- Agent Policy Update Period

Config > Admin

You can change admin name and password for GUI login here.

Config > Alert

NxFilter sends an email for recent blocking or access violation. If you want to send an alert email to 'admin @ nxfilter.org' from 'alert200 @ gmail.com' on every 15 minutes then the setup would look like the below.

Config > Allowed IP

NxFilter has IP based access restriction function for its DNS, GUI, login redirection. You may need to use this feature when you put your NxFilter on a public IP address. You can make whitelist/blacklist way of ACL here.

Config > Backup

You can create and download a backup file for the current configuration of NxFilter manually.

Config > Block Page

This is the setup for custom block-page, login-page, welcome-page. When you edit your block-page you can use the following variables populated by NxFilter for making your block-page more informative.

Config > Cluster

NxFilter has a built-in clustering. You can make your NxFilter to be a master node or a slave node in a cluster. After you change the values in cluster setup you need to restart your NxFilter to apply the new settings.

- Go index -

NxFilter is basically a DNS server with filtering ability. This is for DNS service related settings. DNS > Setup > DNS Setup

- Upstream DNS server

- Upstream DNS Query Timeout

- Response Cache Size

- Use Persistent Cache

- Use Negative Cache

- Minimal Responses

- Minimum Cache TTL

- Block Cache TTL

DNS > Setup > Local DNS

- Local DNS Server

- Local Domain

- Local DNS Query Timeout

- Use Local DNS

DNS > Setup > DNS Over HTTPS

- HTTPS DNS Server

- HTTPS DNS Query Timeout

- Fail-safe With UDP/53

- Use HTTPS DNS

DNS > Setup > Misc

- Drop Hostname Without Domain

- Drop PTR For Private IP

DNS > Zone File

When you use NxFilter as an authoritative DNS server you would need to set up a zone file. We use the same format as a BIND zone file. To find out more, read Authoritative DNS server.

DNS > Redirection

Domain to IP or domain to domain redirection is possible with NxFilter. It works like a custom DNS record.

DNS > Zone Transfer

You may need to import a DNS zone from another DNS server. Once you add a zone-transfer setup here, NxFilter imports the DNS zone every minutes using IXFR protocol.

- Go to index -

You can create or import users and groups here. NxFilter supports user importation from Active Directory and OpenLDAP.

Creating a user

There are 3 types of users you can create on NxFilter.

1. IP user

2. Password user

3. LDAP user

Properties of a user

- Password : The password for login through NxFilter's login page.
- Work-time Policy : The policy to be applied when it is not in a free-time.
- Free-time Policy : The policy to be applied during a free-time. You can define a free-time on 'Policy > Free Time'.
- Expiration Date : The expiration date for a user account.
- Login Token : The token for remote user filtering or remote user authentication. It is created when a user created or imported.
- Group : You can set a group for a user if you created the user on NxFilter GUI manually.

Testing a user

When you have an LDAP imported user you may have multiple groups and policies for a user. As a result, it becomes difficult to figure out which policy a user falls into. To find out which is the 'Applied Policy' for a user, use 'TEST' button on the user list. It fetches the state of a user from NxFilter in a real-time manner.

Creating a group

After you create a group on 'User > Group', you can set up a policy for the group by editing its properties. You also can assign members to the group.

Importing users and groups from Active Directory, OpenLDAP

You can import users and groups from Active Directory on 'User > Active Directory'. For example, if you have your Active Directory with the following setup.

Then create an Active Directory importation setup with the following details.

After having an Active Directory importation setup, you can import users and groups with 'IMPORT' button. You also can set up a periodical import by selecting an auto-sync interval.

- Go to index -

You can have multiple filtering policies in your network based on user and group.

Creating a policy

When you install NxFilter, there is only one policy that is 'Default'. This policy will be applied to everybody if you don't make any change on NxFilter setup. If you want to apply a different policy for a specific user or group, you need to create another policy and enable authentication.

Editing a policy

After you create a policy you can modify its properties.

- Priority Points

- Enable Filter

- Block All

- Block Unclassified

- Ad-remove

- Max Domain Length

- Block Covert Channel

- Block Mailer Worm

- Allow 'A' Record Only

- Quota

- Quota All

- Bandwidth Limit

- Safe-search

- Block-time

- Logging Only

- Blocked Categories

- Quotaed Categories

Define a free-time

Global free-time can be defined on 'Policy > Free Time'. If you assign a free-time policy to a user, it will be applied during the time defined here.

NxClient

NxFilter supports remote user filtering and application control by NxClient. For more details, read NxClient and remote user filtering.

- Go to index -

On NxFilter, there are system categories and custom categories. System categories are already defined by your blacklist DB. But you can create your own custom categories. You can add domains into these system/custom categories and block domains by these categories.

Currently, NxFilter supports several blacklist options. If you want to find out more, read Blacklist and domain categorization.

- Go to index -

This is for making a whitelist/blacklist by a domain or a keyword.

- Bypass Authentication : To allow your users to access some sites without authentication, use this option.

- Bypass Filtering : To exclude some domains from your filtering, check this option.

- Bypass Logging : When you have too many log data for a domain which you are not interested in, you can bypass logging for the domain.

- Admin Block : To block some domains without setting up a policy, use this option. This option overrides 'Bypass Filtering'.

- Drop Packet : When you want to completely ignore and not to respond the requests for a specific domain check this option.

- Go to index -

These are frequently asked questions about NxFilter.

I can bypass NxFilter by accessing websites using IP address.

There are people saying that DNS filtering is useless as they can access a website using IP address. This is a very naive thought and simply not true. In today's Internet environment most websites are running on a virtual host. This means there are multiple websites on one IP address. You can't access these websites without using a domain.

And the other thing you need to think about is that there are many URLs in a webpage. This is especially true when it comes to a big portal site. Those URLs are based on DNS as well. If you try to access a blocked website using an IP address, you will get just a brocken webpage.

- Go index -

It doesn't get blocked/unblocked right away.

This is most likely from the DNS cache on your system. If you are on a Windows system there are two kinds of DNS caches. One is from your browser and the other is from your Windows OS. Before the cache expires your policy change for blocking/unblocking will not be working. Both caches expire eventually but you might want to clear it out immediately. If it is a browser cache you can clear it out by restarting your browser.

If you want to clear out your Windows DNS cache, use the following command on CMD.

Normally DNS cache from Windows expires in a day at the maximum. Of course it depends on TTL from DNS record but I have not seen it being bigger than 86,400 seconds(1 day) usually. About browser cache it may take several minutes to get expired. But it will be expired and blocked eventually. So in practice, this is not a problem as you don't need to block/unblock a site many times a day.

- Go index -

How do I force a user to be filtered by NxFilter?

If you have a firewall in your network it is a simple task. You just need to block outgoing UDP/53, TCP/53 traffic except from NxFilter. And then you use DHCP to set up NxFilter to be the DNS server for your network. Now NxFilter became the only DNS server that your users can use and their DNS setup to point NxFilter will be done automatically.

- Go index -

How NxFilter determin which policy to apply for a user?

You can assign a policy to a user directly. If a user belongs to a group then a group policy overrides a user policy. This is simple so far. But when you import users from Active Directory there might be users belonging to multiple groups. You don't know which policy to apply to a user in this case.

To solve this problem, we introduced 'Priority Points' on a policy. If there are multiple groups and if they have several different policies, the policy having the highest priority points will be applied. When you want to find out which policy being applied to a user, use 'TEST' button on 'User & Group > User'.

- Go index -

What is the quickest way of blocking 'facebook.com'?

Add '*.facebook.com' into 'Whitelist > Domain' and check 'Admin Block' option.

- Go index -

I want to block 'facebook.com' only for students.

You need to be able to differentiate your students on NxFilter with authentication first. And then block 'Social Networking' category on a policy when you use Jahaslist. Then assign the policy to the user or group for your students.

- Go index -

I want to allow sales department to use the Internet freely at lunchtime.

Create a user or a group for your sales department and define a free-time in 'Policy & Rule > Free Time' then assign a free-time policy which is more lenient to the user or group.

- Go index -

How do I reset admin password?

We have '/nxfilter/bin/reset-pw.sh' script to reset admin password. Once you run the script, the admin name and password will be reset to 'admin'. You need to run the script while NxFilter working.

- Go index -

How do I bypass my local domain?

On 'DNS > Setup' You can set your local DNS server and local domain. With this setup if there are DNS queries for your local domain NxFilter forwards the queries to your local DNS server and bypass authentication, filtering and logging.

- Go index -

How do I enable debug mode?

When there is something wrong with NxFilter the first thing you can do is to find out what is going on exactly with its log data. NxFilter keeps its system log data inside '/nxfilter/log' directory. If you need more detailed log data, enable debug mode on '/nxfilter/conf/log4j.properties'. Change 'INFO' to 'DEBUG' inside the file and restart NxFilter.

- Go index -

I don't see any username on 'Logging > Request'.

The first thing you need to check would be 'Enable Authentication' option on 'Config > Setup'. Some people don't understand that they need to enable authentication before implementing any authentication method.

- Go index -

How do I restrict porn on Google, Youtube search result?

You can force safe-search from NxFilter. We have 'Safe-search' option on NxFilter policy.

- Go index -