Transparent mode won't filter HTTPS unless you install a pfSense CA cert on every client on your LAN.  Is this the case with your config?

To locate source on LAN, you need to look at Squid logs…

https://forum.pfsense.org/index.php?topic=100167.msg559137#msg559137

To filter HTTPS, you will have to install a pfSense CA trusted certificate on every client that will use the proxy.  Since this is inconvenient, so it is better to set squid from transparent mode to explicit mode and then implement WPAD so that your clients an find the proxy automatically.  Some clients will have to be configured manually.

Also just to add something. I have 2 pfsense setups on my vm.

pf1 192.168.1.1 has 2 isp being load balance
pf2 192.168.1.2 is getting internet from 192.168.1.1 and has squid installed

First idea would be to post this in the Cache/Proxy forum where it belongs.  Your issue has nothing to do with the firewall, per se.

Connection refused means exactly that.  The service you're trying to connect to refused the connection.  Check your squid access.log as well as your web server's logs for further clues.

I just did the same exact update.  Fixed OP's problem by

Service -> Proxy server -> Access control

Reverse the order of the IP's listed under "External Cache-Managers" (maybe not needed)

Click save (I think Squid config file will update to the new version)

Restart squid service.

Squid started working.

Squid seems to be blocking something. Is it true that Squid blocks by default

Squid is a web cache.  It doesn't block anything by default.  Transparent mode doesn't work with HTTPS unless you have installed a trusted certificate on every client computer that will use the proxy.

Considering that Dans has been abandoned upstream for years, I doubt there will ever be a fix.  That's why I would avoid using Dans if it's giving you problems.

Doktornotor may have fixed that package to remove the need for the manual symlink.  I would completely uninstall the package, remove the symlink and then install it again.  You may have to manually clean up old traces of Sarg.

With the config as posted i would expect the servers to be 'up'..

There seem to be missing a few things that i suspect are configured:

If these assumptions are right then a few things are missing from the server lines:
-  check-ssl ssl verify none

OK, good that it works now. :)

@gaf2014:

@lockye:

The reason I use the transparent proxy is because I have content filtering setup, it blocks all the annoying commercials even on the roku.

Hi lockye,

have you ever tried to use a NAT rule in your inbound Interface?
For me it's working. All devices that don't like SSL interception are in the Group "grp_no_https_interception". That's all.
You also need to have a firewall rule in place to allow the traffic.

hello, can you give rule firewall rule to allow the traffic  ;D (im try make firewall rule same as nat forward but cant bypass https connection)

@reinaldo.gomes:

Have you ever tried the floating rules? There you can target the firewall itself as the source. I haven't tried this yet, but soon I'll have to.

Yes I did. If you've read post # 2 of this thread, the details of the rule I've made are there.

Must be a feature to prevent people from junkware-plagued shit. Wouldn't touch the thing with 10ft pole.

@cmb991:

DNS filtering using that would be awesome, we already have it installed.  but there isn't anyway to do categories…

Some others have asked to get that incorporated into the package which I should be able to do at some point…. In the meantime, just download the Feed that you use into  /var/db/pfblockerng and extract the archive. The extraction should create the subfolders for the Feed in that base folder.

Then add a new DNSBL Alias, and in the 'Source Fields', map to the category folders that you would like to use… Add a new Source line for each category.

You could also rig a cron task to download once/day and extract to the same folder.