Documentation for WinProxy

WinProxy Content Filtering

Content Filtering is a method for identifying objectionable e-mail before it reaches your email readers. Content filtering works by comparing text, words, or phrases that you specify to the text of incoming email.

Using WinProxy to identify and modify objectionable content before it gets to end users on your network is easy with WinProxy's customizable Content Filtering options. To make it work you will establish rules and within each rule specify one or more conditions that define the rule.

Enabling Content FiItering

To begin using Content Filtering In WinProxy, go to file \ Settings \ Email filtering and check "Enable Content Filtering" (This can also be done in the Web Interface on the "Content Filtering" Tab)

To access the HTML administrator interface, type admin.winproxy on a computer connected to your Win-Proxy network. After you have loaded the administrator interface click on the "Content Filtering" bar located on the left of the administrator interface screen.

Now that you have accessed the Content Filtering Rules page, click on "Add New Rule." The page that follows will allow you to make a new content filtering rule

After you have clicked on the "Add New Rule" button, the Content Filtering Rules page will now show your new rule listed as a "New Rule" link, as shown below. Now, click on that "New Rule" link to bring up the Content Filtering Rule Details page and begin customizing how the rule will work.

Once you have accessed the Content Filtering Rule Details page start by giving your new rule a name in the "Rule Name" box. WinProxy will use this name on the main Rules page, so a distinctive name will help you distinguish one rule from another.

Next, click on "Add Condition" button

You will now have a couple of drop-down boxes and a text box to make the first condition. You can have as many conditions as you want.

In the first drop down menu under "Rule Conditions," you can specify what portion of an email you want to filter using these criteria:

• Subject: This will look for a match only in the subject line of the e-mail
• Body: This will look for a match in the body of the e-mail
• Body or Subject: This will look in both the subject line and the body for a match

These conditions are probably all that most users will want to use, and they are quite powerful on their own. For even more power and discrimination in your filtering, there are two additional options:

• Source IP: This will match the source IP for your email. It is a match for the packet source IP, not necessar ily for the original sender. For most users, the IP address of their ISP's mail server or company mail server is appropriate for filtering. This condition makes it possible to have different filtering rules for different email servers.
• Dest. IP: This will match the destination IP for your email. For most users, this will be the IP address of their client computers. This makes it possible to have different filtering rules for different computers - little Johnny has different filters than Daddy.

Note:If you choose either of these IP options, you will see that the boxes to the right change their op tions. They will then be ready to accept IP address and mask in the 'slash' form, eg 90.0.0.0/ 24 (equivalent to IP 90.0.0.0 subnet mask255.255.255.0).

For this example, we're going to use "Body or Subject" as the portion of the email that will be scanned to see if it matches the criteria in the rule we will be making in the pages to follow.

In the pull down menu to the right of "Body or Subject" you can specify which criterion you want applied:

For this example, we're going to use "Contains Word" in combination with the selection in the first pull down menu, "Body or Subject.

• Contains Word: Use this when you are matching specific words. The exact definition is "alphanumeric char acters enclosed within non-alphanumeric characters". As an example, "contains word sex" will match sex, "sex", and "sex!", but not Susex or unisex.
• Contains Case Sensitive Word: The same as 'contains word', except that the case of each letter is important to the match. So, "contains case sensitive word Sex" will match Sex or "Sex", but not sex or seX.
• Contains Text: This will search for the text you specify, regardless of what is on either side of the characters. So "contains text sex" will match sex, Sex!, Susex, or unisex.
• Contains Case Sensitive Text: The same as 'contains text, except that the case of each letter is important to the match.
• Does Not Contain Word: Uses the same logic as 'contains word', but negated. So, "Does not contain word sex" will match Godzilla is a bum, Susex and unisex, but not sex or "sex".
• Does Not Contain Case Sensitive Word: same as above, except the case of each letter is important to the match.
• Does Not Contain Text: same as 'contains text', except negated.
• Does Not Contain Case Sensitive Text: This should be self-explanatory by now...

We are now telling WinProxy to search incoming email for a specific word and to look for it in both the body or subject line of the email. It could look for "New Item", but it would be more useful to add your own search term here.

In the field farthest to the right under "Rule Conditions" where the words "New Item," are found, insert the word you want to search for (ex. "sex")

For this example, we're going to use "Contains Word" in combination with the selection in the first box, "Body or Subject"

By adding the word "Sex" in the field furthest to the right, we are now asking WinProxy to : o Search for the word "Sex" in the Body or Subject of the e-mail.

If you have more than one condition, you now need to specify how those conditions relate to each other.

• "Match All": This means "it's match only if ALL if the conditions are met". If even a single one of your con ditions is not met, then it is not considered a match.
• "Match Any": This means "It's a match if ANY of the conditions are met". If even a single one of your condi tions is met, it is considered a match and WinProxy will invoke the Action you specify. We'll get to what actions you can specify shortly.

Now we have a rule that will search for the word "sex" in any part of the Body or Subject of the e-mail, but we still need to tell WinProxy what to do if it finds this word in an email Body or Subject, i.e. the "Action". (This is the exciting part!!)

There are three things you can do when an email has met its match:

• Prefix Subject: Will insert a message you define in front of the original subject
• Prefix Body: Will insert a message you define in front of the body of the e-mail
• Replace Body: Will replace the body of the e-mail with a message you define, i.e. instead of an inappropriate message being delivered to your kids or employees, you can specify a message that will replace the inappro priate content, such as, "This message has been deleted by the network administrator because it violates the acceptable use policy of this network."

Let's add "Prefix Subject" to our previous example, and prefix the text "SPAM ". Now our rule will Search for the word "Sex" in any part of the Body or Subject of the e-mail and if it is found it will insert the text "SPAM" before the original subject"

Now that you have finished specifying your rule and the action to take when the rule matches, don't forget to click, "Save Changes"!!!

You can add multiple "Rule Conditions" to one Action by clicking on the ""Add Condition" button. Use this feature to narrow or expand the scope of your rule.

In the example below we clicked on the "Add Conditions" button 3 times, thus creating 3 "Rule Conditions."

We can also delete individual rule conditions by clicking the "Del" button next to the Rule Condition you want to delete.

As always, don't forget to click "Save Changes" after you have modified your rule(s).

To return to the "Content Filtering" page, click the "Cancel" button located next to the "Delete Rule" button at the bottom of the "Content Filtering Rule Details" page.

Once you go back to the Content Filtering page you will see the rule we just created.

You can also Enable and Disable the rule with the box to the right. A disabled rule retains its configuration information, something you'll find handy as you refine the rules to your liking.

You can prioritize a rule by moving it up or down. Prioritizing rules allows you to decide the order in which filters will be applied to incoming email traffic.

Matches found within the subject line will take priority over matches found in the body of the email. In essence, the filtering engine will make two passes through your list of rules. On the first pass through, it will try to find a match for your keywords in the subject line of the email, starting with rule number one and working down through the list. It will look in the rule conditions for 'subject' and 'subject and body' for these keywords. As soon as it finds a match, it will stop looking and invoke the Action you have specified. Any other potential match will be ignored.

After testing the subject line for a match and finding none, it will then repeat the procedure looking for a match within the body of the email. This search will also start at rule number one and proceed down through the rules until it finds a match. If it finds a match, it will stop looking and invoke the Action you have specified for that rule.

You will likely find that you can make the best use of your new filters by using them in conjunction with the filtering that is already a part of many commonly used email programs such as Eudora, Outlook, Netscape, and others. For example, if you have told WinProxy to prefix any email that has the word "sex" in it with the message: "SPAM-SEX" Then you can tell your email program to divert any message whose subject line includes "SPAM-SEX" to a folder you specify, such as a spam folder or the Trash folder. Now you can periodically review this spam folder or trash all of these messages, rather than have these messages clutter your inbox in your email program.