Today I've setup a copy of the problematic instance and I have solved the cause of the issue…

The clickable "Target Rules List" field disappears if more than 7 "Target categories" are defined.

Looks like one for an bug report...

By the way... how do I mark this thread as solved?

Lars

Created a ticket for this issue:
-> https://redmine.pfsense.org/issues/6471

So far the only way I have been able to update is to backup the system. Edit the xml backup and restore… Guess will have to wait for the package to be upgraded.

An out of state packet is one that was part of an established session but that session has since been torn down.  All of those blocks are for a FIN ACK (or FIN PUSH ACK), you will note.  The pfSense side says "I'm going to tear this connection down and close it!"  The other side says "OK", but pfSense has already torn the connection down so it sees the OK reply as an unsolicited new connection attempt and blocks it.

https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection

Awesome.. thanks Nachtfalke! I wasn't aware of that "System Patches" package.

I tried this with my SquidGuard changes today and Squid + SquidGuard were working perfect.
Everything seemed great until I did a final reboot test. Something went wrong after that to a point where Unbound and DHCP wouldn't load. I was getting some weird certificate type errors on Unbound.
I had to revert back to the other slice to recover.

I'll have a bit more of a play though and see if I can get it going.

Thanks again!

@gersonofstone:

Hi

reinstall the proxy reports

Hi, I've already re-install. Uninstall and install. But still the same. No log after June 1. :(

Confirming this worked for me as well.
my error message was:
ERROR: No forward-proxy ports configured.

Hi Blendin_Blandin,

For HTTP health checks you can do the following:

enable 'ssl' on the backend server Http check method : HEAD
Though i would probably set a very low check frequency (once a minute or so.?.) or maybe not check at al..

As for the certificate, as your passing the traffic with mode tcp so haproxy doesnt need any additional settings there, a valid certificate needs to configured for the webgui though for the name your typing in the browser.

Regards
PiBa-NL

@steve1515:

(…)
Not that I need to do this, but what if I wanted to proxy based on the 3 DNS host names instead of the IPs. Do you have a cool way to do that?  :D

If you know the FQDN of all other clients, then just put these clients into the alias. But to be honest. Because you can do it it is not always the best way to do this. In the thread there are mentioned other possibilities like WPAD and so on.

Other ways are to configure DHCP with static entries so that the three clients will always get the same IP address. This will make things easier.

Good luck!

Thanks for the answer but i am still confused.
Its Squid 3.x.x the package currently listed as just "Squid", which LightSquid is calling Squid3, or are we talking of different things here???
In the case "Squid3" means any version starting from version 3, maybe would be better to make that a bit more clear, or other ways rename the current "Squid" as "Squid3" as quoted on the note on LightSquid to avoid confusion…...

Thanks for the responses, checked the reports again today and another ip is pulling down over 4GB from windows update

@aGeekHere:

Have you increased Maximum Object Size to an insane value like 1000MB for big updates ?

Yea I have it set to 1GB but still no luck. will try the refresh patterns posted.

Regards

That is exactly my set up