I think Endian doesnt work well with only one NIC.
I haven't worked too much with content filtering. Just upgraded EFW to a new URL blacklist and blocked all that I consider unsuitable on a working environment.
I dislike phrase filtering (regular expressions) on Endian. It is too restrictive for me, and I got blocked some legit webpages. In fact I have it to 300.
The problem with regular expressions is that maybe a single word doesn't fire the block event. It must add 160 points of bad words/bad phrases to block the page. If you find out that this is not enough you have two options:
1- Lower Max. score for phrases (50-300) to 50
2- Tweak the phrase filtering to raise scores on phrases/words you define. Check
/etc/dansguardian/phraselists/pornography/ files. If you check the file
/etc/dansguardian/phraselists/pornography/weighted , you'll see that the term <vagina> only scores 5 points. It seems that this word is not very indicative of pornography. Of course you can tweak those scores to what you like.
Tip: If you got some page blocked, you can see why this webpage is being block by seeing the source page on your browser (any browser can do that, by right clicking on the webpage). On source code you'll see something like:
</>
<BODY><!--
Url: http://www.playmates.comReason: Banned Regular Expression URL found.
Reasonlogged: Banned Regular Expression URL: (os|sight|site|sonly|web|-?job|bondage|centerfold|shot|cyberlust|cybercore||incest|masturbat|obscene|pedophil|pedofil|playmate|pornstar|dream|show|softcore|striptease)User: 127.0.0.2IP: 192.168..XXXFiltergroup: Filter content2Byp: -->That helps you find out why some page was blocked.
Author