Zorp – Open source proxy firewall with deep protocol analysis

Re:Zorp – Open source proxy firewall with deep protocol anal... by tgragnato on Monday January 21, 2019 @01:04PM (#18962132)

Squid is mainly a web caching proxy. Zorp is a next generation firewall.

The architecture is modular, and you can write plug-ins that analyse the structure of communications beyond packet headers: the content is inspected. The open source version includes out of the box support for inspecting HTTP, FTP, SMTP, POP3, Finger, Whois, Telnet (+TLS). But you can write plugins that couple the engine with anything, from an IDS such as Snort, Bro or Suricata, to something like nDPI or AssemblyLine.

https://www.ntop.org/products/deep-packet-inspection/ndpi/ https://bitbucket.org/cse-assemblyline/assemblyline

Based on the results of the analysis, you can choose to apply firewall rules.

[ Parent | on HN ]

Re:Zorp – Open source proxy firewall with deep protocol anal... by ausjke on Monday January 21, 2019 @04:44PM (#18963887)

squid also has redirectors and c-icap filters etc, firewall wise it uses the OS(e.g. iptables), so it's more than a proxy but it does not do packet-level-firewall as it depends on iptables.

looks like zorp is a all-in-one solution, hope i have time to play with it soon

[ Parent | on HN ]