Suggestion for NGFW features

[bwecs]

Hi,
I would like to make my OpenWrt box a NGFW firewall.
I need a web url filter(not DNS filter), IPS/IDS system, deep packet inspection and combine them with anti-virus(like ClamAV) at least
I can't install Squid or SquidGuard in 23 version. What's the best alternative to that? I need them to do SSL inspection and web-filtering.
Do you guys have any suggestion or thoughts on building a NGFW based on OpenWrt?

[lleachii]

@bwecs

I need them to do SSL inspection and web-filtering.

Do you have an Public SSL Certificate [illegally] issued to you for a wildcard on the root zone - to install on a DPI device?

If not, see:

How to view layer 7 application running on Network

The best you can do is guess by ports in use or Deep Packet Inspection as noted by @eduperez. Actually yes - full stop. A DPI device knowing a lot of patterns could see/copy/download all unencrypted traffic and it's contents/payload (i.e. normal DNS requests, HTTP, SMTP, etc. This is already resource intensive. It may even be able tell you what encrypted application is in use (i.e. VPN). If it's encrypted or unknown, then it's unknown, I assume you'd want to simply block it.† †- So unless …

Or are you doing this on a test network (that only you use and control) - purely for educational purposes?

Lastly - I assume you're aware that you cannot magically decrypt secure web traffic, correct?

[jow]

I think there is no way around Squid for this. If you run x86 you could use a Debian chroot to install required packages, or run the required services as Docker containers.

[bwecs]

@lleachii

Or are you doing this on a test network (that only you use and control) - purely for educational purposes?

For my homelab network, just want to have an NGFW without paying anything
.