Configuration
Avira GmbH
Avira AntiVir WebGate
31
direct communication partners’ and not the address of the computer issuing the
request.
If the
AddXForwardedForHeader
option is active, WebGate adds a header field
(X-Forwarded-For) to the HTTP request or adds the IP address of the Client it
received the request from. In this way WebGate can forward the Client IP address
to the downstream proxy servers. These are then able to analyze the header field
and to use the included indirect data for example, for access control mechanisms
or for logging purposes.
This option could also enable the use of ACLs for a Squid proxy, which is configured
by WebGate as parent proxy. The parent proxy must certainly hold the necessary
functionality for header analysis.
AddXForwardedForHeader no
Allow
Client
Addresses
Allowing connections for certain Clients/ networks
:
WebGate can activate certain Clients or networks using this option. Single Clients
are set using their IP address. A network is set typing a ’/’ and its netmask (for
example, 192.168.1.0/24).
AllowClientAddresses 127.0.0.1 192.168.0.0/16
If you do not specify any IP address, the access is not restricted.
If you specify at least one IP address, the access is permitted only to the entered IPs.
Anyone else has no access.
Forbidden
UserAgents
Denying access to specific user agents:
You can specify one or more user agent strings that will be denied access. The main
purpose is to avoid unnecessary traffic generated by clients issuing range requests
(such as Microsoft's BITS "Background Intelligent Transfer Service") or streaming
services (such as Apple's iTunes). Range requests and data streaming are only
permitted if specified in
AclConfigFile
(see below).
ForbiddenUserAgents BITS iTunes
Allow
Destination
Ports
Allowing connections for certain ports:
WebGate can limit the connections to certain destination ports, using this option.
You may specify domains with a hyphen.
AllowDestinationPorts 21 80 1025-65535
If you do not specify any ports, the access is not restricted.
If you specify at least one port, the access is permitted only on the entered ports. Any
other port has no access.
AclConfigFile
Access control scheme:
WebGate can also support more complex rules by implementing a Squid-like access
control scheme. To use the access control scheme you must create a new
configuration file containing the rules describing the desired behavior and have
AclConfigFile
contain the path to it. The syntax supported by the access
control scheme is described in
MANUAL.avwebgate
file.
AclConfigFile /etc/avwebgate.acl
