E2guardian Web Content Filtering Proxy

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## E2guardian - Secure Web Content Filtering Proxy for AWS

E2guardian is a mature open source web content filtering proxy trusted in schools, managed networks and regulated environments worldwide. It sits between your users and the internet, applying URL, domain, phrase and content policy to every request, and returning a clear block page when a request is refused. This AMI delivers E2guardian fully built, configured and running as a managed systemd service within minutes of launch - no compilation, no packaging work and no configuration required before it starts filtering.

### Who is this for?

This image is built for network, security and platform teams who need to govern and audit outbound web browsing from their VPC. Common scenarios include:

• Acceptable-use enforcement: Block categories, domains or phrases for a managed user population, with an on-brand block page explaining why a request was refused.
• Regulated egress control: Every request is written to a structured access log, ready to forward to your SIEM for audit and compliance reporting.
• Layered filtering: Run standalone for direct filtering, or chain to an existing Squid caching proxy with two configuration lines.

### Secure by default - never an open relay

An exposed proxy is one of the most abused assets on the internet, so this appliance ships a fail-closed access control. The proxy port accepts connections only from loopback and private client networks - every other source is dropped - and the proxy service will not start at all if that allowlist cannot be applied. Scope your security group to your own client subnet as the mandatory second layer. The appliance performs no TLS interception, so no certificate authority key exists in the image or on your instance, and there is no shared interception authority to leak. HTTPS is still filtered by hostname.

### Application stack

E2guardian 5.5.9r is built from pinned upstream source (the distribution archive package is two minor series behind) and runs as a hardened systemd service listening on port 8080 as an unprivileged daemon user. The source allowlist is enforced by an nftables table that the proxy service requires, so the appliance fails closed. A documented, self-demonstrating policy ships enabled so you can prove filtering works on your own instance with a single command. There is no product login and no bootstrap password - administration is over your own key-based SSH.

### Architecture overview

E2guardian runs inline within your VPC as a forward proxy. Clients in your private subnets route HTTP/HTTPS requests to the instance on port 8080. Permitted requests are forwarded to the internet via the VPC's NAT gateway or internet gateway. Blocked requests receive the E2guardian block page immediately. The nftables allowlist ensures only your designated client subnets can reach the proxy port, and your security group provides the second enforcement layer.

### How to get started

1. Launch the AMI in your VPC and choose an instance type appropriate for your expected request volume.

2. Configure the Security Group to allow inbound TCP 8080 only from your trusted client subnets, and TCP 22 from your administration network.

3. SSH into the instance and read the per-instance proxy facts from the root-only info file.

4. Point any HTTP client at the instance on port 8080. Requests to permitted sites are served; a banned site returns the E2guardian block page.

5. Prove filtering in one command and add your own policy to the local block list.

### Next steps

Ready to deploy? Launch the AMI and verify filtering in under five minutes. For a guided deployment walkthrough, policy review, or help integrating with your existing SIEM, contact cloudimg support at any time - our engineers are available 24/7 and typically respond to critical issues within one hour.

cloudimg engineers can help you scope client access, restrict the proxy port to trusted subnets, chain to an upstream proxy, build filtering policy, forward the access log to your SIEM, and plan version upgrades.

cloudimg is not affiliated with or endorsed by the E2guardian project. E2guardian is distributed under the GNU General Public License version 2. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.