Get acquainted! Eric The Epic Elephant

It will be about the development of our Russian company A-Real Consulting LLC, namely, the Internet access control system - Internet Control Server (IKS) , with such a funny name “Eric the epic elephant”.
IKS is a universal Internet gateway with tools for protection of a corporate network, traffic accounting, access control, mail, proxy, file server, Web, jabber and even IP telephony organization.
The core of this system is FreeBSD 8.4 with the ZFS file system.

Let's see what features are used.

• Universal Gateway. Support for various connections: Internet, Wi-fi, 3G, PPTP, PPPoE, L2TP, works with VLAN and DMZ, as well as, it is possible to organize VPN tunnels (cPSEC PSK encryption and OpenVPN).
• Access control. Authorization of users by IP address, MAC, name / password, AD and many others
• Network security. Firewall, built-in antiviruses from Dr.Web, Kaspersky, ClamAV. DLP module - to protect against leakage of confidential information.
• And much more who will be interested can look at the company's website .

Implementation experience

')
In 2010, while working at the institute, it became necessary to collect statistics on student site visits, differentiation of access rights and many more different tasks.
I want to note that the company has certain discounts for educational institutions, which played a key role in the decision to purchase. We couldn’t judge much about the system itself, because there was a trial version and only our small IT department worked through it. Spitting on the risks (anyway, the old servachek on the windows with the traffic inspector we were not going to destroy). They convinced the rector of the need for procurement, and began to implement.
At first I thought that I was provided with a couple of days and an overnight stay at work to prepare and configure everything, but as it turned out the system was so flexible and easy to install and configure that it didn’t take up any difficulties at all.

The installation, it passes, very quickly, I only had time to smoke, and when I returned I had to press the OK button.



Everything, we can rejoice, the system is ready for the first launch. After clicking “OK”, services and modules will start to load, and after that, our X will notify you of the readiness to work by issuing a melody as a speaker from the Star Wars (by the way, when you turn off, the imperial march from the same k / f sounds).

All interaction with the server passes through the Web interface. Initially, we are offered to connect to the Internet using the setup wizard. For those who first see the system and have not previously watched the video from the developer’s site, it’s best to use the connection wizard. He will immediately configure both the provider and the local network.
Here is the working interface.








As you can see on the screen, in addition to all the functions I listed at the beginning, there are naturally some such as DHCP, DNS and other delights of our life.
In short, this system allowed creating two local area networks for students so that the administration had access to student servers, but students could not get anywhere except the allowed ones. Also, notably, there is already a ready base with filters for the proxy server.
Already in the new company in which I work, with the help of ICS, a VPN tunnel with regional representatives, shared file storage was organized, and now you can control site visits by employees of remote offices, with the formation of statistics for department heads.

And so, what can be taken out the advantages of working with the X?

• Reduced IT costs. All you need is a machine with Core i5 (i7 can be used),> 4Gb RAM, and HDD 500 Gb, if you have a file server on a separate machine.
• Easy to manage and configure. Even if you do not own FreeBSD, you will not have problems configuring and managing.
• Collect statistics of visits. You can always see which user eats up how much traffic and which resources they visit.
• DLP module designed to protect against leakage of confidential information has proven itself very well. When, while still at the institute, one employee wanted to send a base of our students to someone by mail, she didn’t work.

I can enumerate the advantages further, but it is better to see it live as they say. The company recently launched X-online (login: root, password: 00000), which allows you to visually navigate through the settings and understand whether this system is right for you or not.

The company holds a lot of shares on which you can get a good discount, or several users to the license.
The license, by the way, is acquired once and for life. Then just buy more users.
This system has fully proven itself for 4 years of work at the institute, with one single malfunction and solely due to the fault that there was no electricity, and UPS did not work for a long time.