Performance and licensing

[pwjw]

We are looking to start using nxfilter. I have a few questions if you can help.

We run a small guest wifi service and have around 60 customers for who we provide DNS filtering for.

Each customer comes from a different public IP address and they have their own policies/category allowed/denied etc.

We currently use an open source solution and subscribe to a 3rd party URL list.

If we switch to nxfilter, is it correct that this software itself is no cost, and no limitations (apart from the server resources themselves of course)? The license/costs is only if we choose to subscribe to Jahaslist (or another 3rd party URL list)?

How would licensing work for our model in the above case? Are we charged based on 60 customers (users), or based on volume of DNS requests, or both?

But a URL list is downloaded to the server, so why is the cost per user/volume when it's the same URL list regardless of 1 or 60 users?

P.S. we're taking tens of millions DNS requests per day across all users.

Thank you

[support200]

Yes. The software has no cost and it's the benefit from us. We could make the software itself commercial but we didn't do that as we we wanted to help people to start their business and make success. So there's only small amount of cost for using Jahaslist. We have per user licensing for Jahaslist as your end users are under filtering by using it. And the license policy is ours to decide and we can do whatever we like as it's all ours.

If you get tens of millions DNS requests per day then you'd need to buy Unlimited License in the end. If there're more than 3000 users, the cost would be the same as using Unlimited License for Jahaslist. We have many business users using Unlimited License. https://tutorial.nxfilter.org/i-faq....c-license-user

Your 60 customers, doesn't look like the end users. It seems like that you want to build a cloud filtering service and there are 60 networks to be filtered by your service. And they need to have their own filtering policies. In that case, try NxCloud. It was developed as a commercial software for our cloud business partners but we made its license policy as simple as NxFilter. You just need to buy Jahaslist or Cloudlist license. However, there's no Globlist for NxCloud.

If you combine NxCloud and NxRelay, you can filter several tens of thousand users easily. https://tutorial.nxfilter.org/d-nxre...le-network.php

[pwjw]

Correct, they are not "end users" but customers where many end users are using the WiFi in the venue. This is why the DNS requests end up in the millions across the 60 customers.

Looking at NxCloud, I can't see a lot of difference/benefit if the licensing is the same? We will manage our customers and their policy settings. They will not get access to the nxfilter UI. We will build reports in to our own portal where our customers already have a login to our product. nxfilter allows us to create users and associate IP ranges to each user, then map to a policy. This is all we need. Is it just that NxCloud is more efficient with multiple customers? Is it as easy to add new customers like in the nxfilter UI?

We are not able to install anything on the customer network therefore we can only provide filtering via DNS. No agent etc.

The Jahaslist license page says it is per user, and this is counted by number of users and unique client IP addresses. No mention of DNS request volume. So do I need a license for 60 users, or unlimited? To us, we wil only have 60 "users" and 60 client IP's in the nxfilter UI.



Thank you

[support200]

If you don't need to let your user have their own GUI and manage their policies then NxFilter might be better. We also have business users using NxFilter in that way.

This is from the link (https://tutorial.nxfilter.org/i-faq....c-license-user) I added,

"NxFilter counts the number of usernames and client IP addresses and DNS requests on daily basis. If one of them exceeds your licensed user number, any unlicensed user or request will appear being blocked on your log view. However, since it is a warning measure, this blocking is not actually happening on user side.

The daily request number for one user allowed by NxFilter is 4,000 (If you have 100 user license, you can make 4000 x 100 requests a day). On our statistics so far, in an ordinary office or school environment, one user makes up to 1,500 requests a day. We added 2,500 requests as a redundancy to it. So, it becomes 4,000 requests a day for one user. For request counting, we only count 'A' type DNS queries."

4,000 requests for one user is more than enough if we look into the actual reports from our test user group members in https://forum.nxfilter.org/usage-reports

For your case, with such high traffic volume, it's better to have an unlimited license. However, we also have some users doing exact calculation and saving a lot of money. Though if you really have that many requests, it will exceed 3000 x 4000 anyway.

[pwjw]

Thanks for the information, I understand.

Is there any more detail on Jahaslist? I have the following questions:

• How many total domains are in there?
• How does it compare to other URL filter lists managed by enterprise/cloud DNS providers like Umbrella, SafeDNS, zvelo etc?
• How often is it updated, and does it also block malware/phishing domains?
• Do/can domains sit in more than one category?
• Does it contain domains from well known blocked lists, like CIPA, IWF (UK) and other industry / governmental blocked lists.
• I presume it's the same Jahaslist license if we are running master/slave setup and not per server?

Other general nxfilter questions:

• How can we pull data like the top 50 allowed/blocked domains/categories per user via API to use in our own data backend?
• Is there already API to add/remove users and IP's against users without using the GUI?
• Are there any guidelines on how many DNS request per second it can handle based on a machine specification? (We're taking approx. several thousand requests per second)
• Is it safer to have a master/slave setup than multiple masters behind a load balancer?
• Can we have a custom blocked page per user?
• I presume we can have a global white/blacklist that can then be overridden at a user/policy level?

Thank you

[support200]

• How many total domains are in there?

When we ship the baselist last time, it was 5646038. However, Baselist is just a initial DB being shipped with NxFilter package. There's dynamic classification by an integrated classifier and cloud based classifier. So, it grows.

• How does it compare to other URL filter lists managed by enterprise/cloud DNS providers like Umbrella, SafeDNS, zvelo etc?

They are expensive and Jahaslist is the cheapest in the market. Many of filtering companies do outsourcing the DB but Zvelo is a service provider and Umbrella has its own. We also have our own. If it's for quality, can't say which is better and you also need to think about cost/effect factor.

• How often is it updated, and does it also block malware/phishing domains?

Dynamic classification is integrated to NxFilter and there's a bulk update once a day at least. There's Malware/Phishing category.

• Do/can domains sit in more than one category?

No. That makes things complicated. You block domains just because it's in one of 3 categories. You get unexpected result.

• Does it contain domains from well known blocked lists, like CIPA, IWF (UK) and other industry / governmental blocked lists.

CIPA is a requirement for US schools not a list. We don't use IWF list as we don't get any actual benefit from it. You can merge the list into Jahaslist using 'Classifier > Blocklist' by yourself.

• I presume it's the same Jahaslist license if we are running master/slave setup and not per server?

Yes. Clustering is free basically. You can add up to 4 slave nodes to your cluster and use the same license for all the nodes.

• How can we pull data like the top 50 allowed/blocked domains/categories per user via API to use in our own data backend?

Use Graylog like tool if you deal with such huge traffic. Integrated logging/report is designed to satisfy home users and mid-sized business users. We had to consider on the size of the package. We can't make it 1 GB package. https://tutorial.nxfilter.org/h-gray...te-logging.php

• Is there already API to add/remove users and IP's against users without using the GUI?

You need to write your own JSP page and send HTTP requests to the page. There are some example JSP files in /nxfilter/guipack/sandwatch/example

• Are there any guidelines on how many DNS request per second it can handle based on a machine specification? (We're taking approx. several thousand requests per second)

We have a usage report from a US school district. I see 23789 IPs and 30634192 unique requests a day from several days ago. If we divide it by 86400(1 day), it becomes 354 but considering that they don't use it after school, we can assume the actual number would be around 1000. They run 2 servers but we don't know their hardware specifications. All we can say is that you need to allocate at least 4GB of memory to NxFilter if it's for high volume of traffic.

• Is it safer to have a master/slave setup than multiple masters behind a load balancer?

Don't know what you mean by 'safer' here. We have users running a cluster behind a load balancer already. If you use multiple masters then you need multiple licenses.

• Can we have a custom blocked page per user?

No. Only for NxCloud.

• I presume we can have a global white/blacklist that can then be overridden at a user/policy level?

You can set Applied Policies for white/blacklist but not user level.

[support200]

From our tutorial, "The difference between Total and Unique is from NxFilter's logging system. To reduce the amount of disk access, NxFilter keeps all the log data in its memory space before it flushes out the data once a minute. If there is a request for the same domain from the same user in a minute, it only increases the count for the data. So, Total means the sum of all the requests and Unique means the count for all the unique data."

[pwjw]

Re:

The daily request number for one user allowed by NxFilter is 4,000

This is just for licensing purposes, correct? There is no hard cap of a single user only being allowed to perform 4,000 DNS queries per day?

Thanks

[support200]

We don't block DNS queries. We bypass filtering and make warnings in log view of operator GUI.

One exception is when you use 'Trial Period' on 'Operator > License Policy' and set the policy to 'Suspend Account' on trial expiration. The customers will be blocked when their trial accounts expire. We thought it's natural as your customers need to do something in trial period but you can set it to 'Do Nothing' as well.

[pwjw]

We don't block DNS queries. We bypass filtering and make warnings in log view of operator GUI.

One exception is when you use 'Trial Period' on 'Operator > License Policy' and set the policy to 'Suspend Account' on trial expiration. The customers will be blocked when their trial accounts expire. We thought it's natural as your customers need to do something in trial period but you can set it to 'Do Nothing' as well.

Sorry, what I mean is that his 4,000 figure is to do with how it counts the request for licensing purposes. Once we have a valid license subscription, we can query 1 million per day from the same user if we wanted? There is no limit?

[support200]

Suppose that you have 1000 user license. Then you can query 1000 * 4000 queries in total. And you create an operator and you assign 10 users to him. Then he can query 10 * 4000 a day. That's how you control licensing for your customers. If you use an unlimited license then there's no limit in total.

[pwjw]

Yeah, I am talking about the unlimited license. If we have that, we don't need to worry about any per user or any limits at all?

[support200]

Yes. You can assign any number of users to your customers.

[pwjw]

Yes. You can assign any number of users to your customers.

And those users have no limit on the amount of DNS requests per day right?

[support200]

The limit is for operators not for each user. If you assign 100 users to an operator, the operator's network can make 100 * 4000 queries a day.

[pwjw]

The limit is for operators not for each user. If you assign 100 users to an operator, the operator's network can make 100 * 4000 queries a day.

This is really confusing. Why is there any limit? The software is open source and if I purchase an unlimited license for Jahaslist... why does the system care?

For example, we have some customers that perform 10 million queries per day. They may be from a single IP or 20 IP's but its the same customer.

What I don't want is any limit at all for the customer to use our service. We charge them appropriately.

Can you please explain exactly what an "operator" is and why it matter when we purchase an unlimited license?

Thanks