Will web filter inherit the parent config?

jcoehoorn · 08-26-2011, 03:06 PM

I'm considering adding a new rack with a policy to run during our busiest time of day (10:30pm to 1:30am). The only difference on the this rack is that I want to add the Download category as blocked during that time.

However, when I go to try setting this up and install web filter on my new child rack, web filter does not seem to inherit the configuration of the parent. I would have to completely set up that app again. Am I missing something here? We have a lot of extra passed or blocked sites configured that will be a pain to copy over every time we make a change.

hlarsen · 08-26-2011, 03:17 PM

when you add a new instance of Web Filter it's added with the default settings - it's an interesting idea, though.

what you can do is use the import/export feature in the upper right and corner of the block/pass lists, but you'll still need to reconfigure the categories and other options by hand.

jcoehoorn · 08-26-2011, 05:35 PM

Keeping the parent's settings initially wouldn't be enough, because I want changes to the parent to also propagate. I really need a whole different instance running.

I think what I will do for this purpose is use web filter lite on the child rack, since that uses a separate list. Not ideal, but it will do the job.

jcoehoorn · 08-26-2011, 05:39 PM

... except that lite doesn't have a download category. Argh.

dmorris · 08-26-2011, 06:52 PM

apps in the child rack override the apps in the parent rack. They don't "mix" or "blend" their settings together.

far182 · 08-26-2011, 08:20 PM

I really wish inherited settings was a feature. It would be so wonderful.

dmorris · 08-26-2011, 08:35 PM

Only if you squint your eyes and pretend like it would just magically work in some simple manner. The reality doesn't look like that.

what would two firewall rulesets look like when merged together? would the parents rule go first or the childrens? or would you just mix them together like shuffled cards? Run through the above scenarios and you'll find none make much sense.

what about web filter? would a explicitly passed site in the child override a specifically blocked site in the parent? what about vice versa?

you would end up with a scenario would for every new setting you'd have to define how it interacts and merges with both parents' and childrens' settings.

and don't forget about grandchildren and grandparents.

There is a reason in object oriented programming when you override a function it doesn't "merge" the function with the parent's function. It overrides it.

This would ultimately mean we wouldn't add new features because its so much complexity for the 1% of people using inherited settings.

far182 · 08-26-2011, 08:41 PM

Yes it isn't easy. I completely respect that this isn't simple at all.

If you and your team ever decide that this is something you would like to tackle, please do contact me. I have some great ideas for this. High level, make it like file security on a windows folder. For example, in a sub folder the inherited settings show up and are gray. You can even choose to stop inheriting etc.

jcoehoorn · 08-29-2011, 02:03 PM

You know how to solve those problems? Allow multiple instances in the rack. The instances are processed in the order they appear in the rack. An explicit pass or block (including as a member of a category) stops processing.

dmorris · 08-29-2011, 02:08 PM

Quote:

Originally Posted by jcoehoorn

You know how to solve those problems? Allow multiple instances in the rack. The instances are processed in the order they appear in the rack. An explicit pass or block stops processing.

Yep, we've thought about it and its an interesting idea.

People would still complain though as the two web filters would still be independent.
A site in one's passlist would not apply to the other.

08-26-2011, 03:06 PM	#1 (permalink)
jcoehoorn Master Untangler Join Date: Mar 2010 Location: York, NE Posts: 475	Will web filter inherit the parent config? I'm considering adding a new rack with a policy to run during our busiest time of day (10:30pm to 1:30am). The only difference on the this rack is that I want to add the Download category as blocked during that time. However, when I go to try setting this up and install web filter on my new child rack, web filter does not seem to inherit the configuration of the parent. I would have to completely set up that app again. Am I missing something here? We have a lot of extra passed or blocked sites configured that will be a pain to copy over every time we make a change. __________________ Three time Microsoft ASP.Net MVP managing an IBM System x3250 / X3440 / 8GB with Untangle 9.2 to protect 40Mbits for 450+ residential college students and associated staff and faculty

08-26-2011, 03:17 PM	#2 (permalink)
hlarsen Join Date: Jul 2010 Location: sfba URLs submitted: 1 Posts: 1,139	when you add a new instance of Web Filter it's added with the default settings - it's an interesting idea, though. what you can do is use the import/export feature in the upper right and corner of the block/pass lists, but you'll still need to reconfigure the categories and other options by hand. __________________ Attention: Support on the Untangle Forums is provided by volunteers and community members. If you need official Untangle support please call or email support@untangle.com.

08-26-2011, 05:35 PM	#3 (permalink)
jcoehoorn Master Untangler Join Date: Mar 2010 Location: York, NE Posts: 475	Keeping the parent's settings initially wouldn't be enough, because I want changes to the parent to also propagate. I really need a whole different instance running. I think what I will do for this purpose is use web filter lite on the child rack, since that uses a separate list. Not ideal, but it will do the job. __________________ Three time Microsoft ASP.Net MVP managing an IBM System x3250 / X3440 / 8GB with Untangle 9.2 to protect 40Mbits for 450+ residential college students and associated staff and faculty

08-26-2011, 05:39 PM	#4 (permalink)
jcoehoorn Master Untangler Join Date: Mar 2010 Location: York, NE Posts: 475	... except that lite doesn't have a download category. Argh. __________________ Three time Microsoft ASP.Net MVP managing an IBM System x3250 / X3440 / 8GB with Untangle 9.2 to protect 40Mbits for 450+ residential college students and associated staff and faculty

08-26-2011, 06:52 PM	#5 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 10,613	apps in the child rack override the apps in the parent rack. They don't "mix" or "blend" their settings together. __________________ Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

Protect

Filter

Perform

Connect

Manage

Add-Ons

08-26-2011, 08:20 PM	#6 (permalink)
far182 Master Untangler Join Date: Aug 2008 URLs submitted: 1 Posts: 946	I really wish inherited settings was a feature. It would be so wonderful.

08-26-2011, 08:35 PM	#7 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 10,613	Only if you squint your eyes and pretend like it would just magically work in some simple manner. The reality doesn't look like that. what would two firewall rulesets look like when merged together? would the parents rule go first or the childrens? or would you just mix them together like shuffled cards? Run through the above scenarios and you'll find none make much sense. what about web filter? would a explicitly passed site in the child override a specifically blocked site in the parent? what about vice versa? you would end up with a scenario would for every new setting you'd have to define how it interacts and merges with both parents' and childrens' settings. and don't forget about grandchildren and grandparents. There is a reason in object oriented programming when you override a function it doesn't "merge" the function with the parent's function. It overrides it. This would ultimately mean we wouldn't add new features because its so much complexity for the 1% of people using inherited settings. __________________ Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

08-26-2011, 08:41 PM	#8 (permalink)
far182 Master Untangler Join Date: Aug 2008 URLs submitted: 1 Posts: 946	Yes it isn't easy. I completely respect that this isn't simple at all. If you and your team ever decide that this is something you would like to tackle, please do contact me. I have some great ideas for this. High level, make it like file security on a windows folder. For example, in a sub folder the inherited settings show up and are gray. You can even choose to stop inheriting etc.

08-29-2011, 02:03 PM	#9 (permalink)
jcoehoorn Master Untangler Join Date: Mar 2010 Location: York, NE Posts: 475	You know how to solve those problems? Allow multiple instances in the rack. The instances are processed in the order they appear in the rack. An explicit pass or block (including as a member of a category) stops processing. __________________ Three time Microsoft ASP.Net MVP managing an IBM System x3250 / X3440 / 8GB with Untangle 9.2 to protect 40Mbits for 450+ residential college students and associated staff and faculty Last edited by jcoehoorn; 08-29-2011 at 02:31 PM..