• 0 Votes
    4 Posts
    3k Views
  • Outbound proxy setup

    2
    0 Votes
    2 Posts
    688 Views
    J

    I found the solution. Maybe it will help someone:

    HAProxy is intended only for reverse proxy behaviors, so don't bother with that. Their website even explicitly says so, and recommends using Squid if you need a regular proxy server.

    So, install the Squid package in pfSense, click Save on the Local Cache tab, adjust the settings on the General tab and click Save. In my case, I needed to set the listening port on the General tab to some random sacrificial port number that I'll never use, because the real ports will be handled by my code below. Now, scroll to the bottom of the General tab, expand the Advanced area, and put exactly this text in your box labelled "Custom Options (Before Auth)", except replace the IP addresses and port numbers with your own:

    ##### START MY CODE ##### # these are the IP addresses and ports that Squid should listen on. # Remember, ignore the listening port you put in the pfSense GUI. # I did not actually need these loopback IPs in my code but I included them here in case it helps the copy/pasters. http_port 10.200.1.1:8001 http_port 127.0.0.1:8001 http_port 10.200.1.1:8002 http_port 127.0.0.1:8002 http_port 10.200.1.1:8003 http_port 127.0.0.1:8003 # Give each port a name acl portA localport 8001 acl portB localport 8002 acl portC localport 8003 # Map each port name to the IP address you want the traffic to use as it leaves Squid. These IPs must match the WAN IPs assigned to your pfSense interfaces and/or Virtual IPs. Squid will automatically put the packets onto whichever interface these IPs are assigned to. tcp_outgoing_address 111.111.111.001 portA tcp_outgoing_address 111.111.111.002 portB tcp_outgoing_address 222.222.222.001 portC ##### END MY CODE #####
  • XBOXONE WPAD only working for https traffic on Edge on system browser

    1
    0 Votes
    1 Posts
    252 Views
    No one has replied
  • Custom refresh pattern for full Docker containers downloads

    1
    0 Votes
    1 Posts
    315 Views
    No one has replied
  • Trouble actually hitting the correct applet from external connection

    Moved
    52
    0 Votes
    52 Posts
    10k Views
    M

    @johnpoz So, strike my previous comment. It looks like the nginx message is actually created by PfSense (i get the same message if i try to connect PfSense with a forced HTTPS that originates as an HTTP connection

    What I dont understand is why? SM i missing something in my settings (frontend/backend) that is causing PfSense to think im trying to connect with an insecure connection?

  • NONE 200 HTTPS:443

    7
    0 Votes
    7 Posts
    911 Views
    JonathanLeeJ

    @jonathanlee

    Screen Shot 2022-01-10 at 4.57.34 PM.png

    Kaspersky also works

  • Skype + SSL Interception + Squid in Non Transparent mode

    2
    0 Votes
    2 Posts
    1k Views
    matyi.szabolcsM

    Hi @do1984 !

    Thanks for putting the list together. Works great for me!

    if you might need a whatsapp list:

    # whatsapp .whatsapp.com .whatsapp.net web.whatsapp.com whatsapp.com c.whatsapp.net whatsapp

    Regards

  • Squid C-ICAP Virus Table & Malware Virus Test File in HTTP CAUGHT!!

    4
    0 Votes
    4 Posts
    944 Views
    JonathanLeeJ

    @jonathanlee

    443 not working.JPG

    (Image: Virus Protection working only with HTTP)

    If I download the file with HTTPS it does not catch it. However notice I am running SSL intercept with the logs seen above.

    clamavcaught.JPG

    (Caught: Only working currently for me with HTTP)

    HTTPS will bypass this even with the certificates installed and proxy running.

    Amazing to see it run half way there !!!

  • SquidGuard lite Logs Issue

    11
    0 Votes
    11 Posts
    1k Views
    JonathanLeeJ

    @jonathanlee
    FIXED!!!!

    The only fix for me was a true reinstall from factory reset mode on the Netgate 2100 max. However when restoring the config it blocked the package install so you have to kill the stuck locked PID in shell with logging in console mode for squidguard. After that just delete the missing half installed packages reboot for file check and reinstall all of them. Once this is done you have control over the logs. The only setting missing was the blacklist URL and common acl for squid guard.

    report.JPG

  • URL Redirecting is missing label for branding and warning on redirect

    Moved
    19
    0 Votes
    19 Posts
    2k Views
    johnpozJ

    @jonathanlee I would suggest you go through the hangout by jimp

    Youtube Video

    While its a bit dated now with 2.5 and 2.6 around the corner.. I am not aware of any sort of major changes.. And for sure this hangout goes over the different options of doing https proxy.

  • HAProxy 1.8.30 and http2

    1
    0 Votes
    1 Posts
    533 Views
    No one has replied
  • Haproxy settings for patroni... Where to put them

    1
    0 Votes
    1 Posts
    515 Views
    No one has replied
  • Update Accelerator

    5
    0 Votes
    5 Posts
    949 Views
    W

    @gertjan
    There is an underlying misconception why Update Accelerator integrates into Squid managed by ipFire.
    After all, pfSense does it too.
    In the pfSense documentation on Squid there is a section just dedicated to Windows Update with the patterns recommended by Squid.
    So we are not violating Windows functionality.
    What Update Accelerator does is to use Squid to download the update and then save the files in a separate folder.
    When Squid intercepts a new download, instead of looking in the cache, it fetches the file in this other folder.

    Same thing for the other updates that are not from Microsoft.

    I am not part of the development team, I just find that this is what is described in the documentation and that U.A. is activated in the Squid configuration page.

  • Squid transparent proxy freezes Netflix streams after a few minutes

    Moved
    1
    0 Votes
    1 Posts
    453 Views
    No one has replied
  • Squid Transparent Proxy for other ports

    1
    0 Votes
    1 Posts
    331 Views
    No one has replied
  • Increase HAProxy Backend Server Session Limit

    6
    0 Votes
    6 Posts
    3k Views
    N

    @crowfather

    I get that the backend limit is 1/10th the front end... but still not sure what this resolves.

    If you set the front-end to 500 does that mean the back-end is really 500 but is only showing 50. Should we be setting it to 10X the value we want or is it that it only incorrectly displays this way?

    --Nikolaos

  • HAProxy DNS Internal servers

    1
    0 Votes
    1 Posts
    401 Views
    No one has replied
  • Trouble with HA Proxy

    1
    0 Votes
    1 Posts
    553 Views
    No one has replied
  • HaProxy and Websockets

    2
    0 Votes
    2 Posts
    1k Views
    MrPeteM

    @jimfreeze Unfortunately, a bug in HAproxy 2.2 breaks websockets.

    Hopefully we can get 2.3 or future soon... or the patch integrated!
    (https://github.com/haproxy/haproxy/issues/737)

  • Squid Proxy and QUIC issues

    2
    0 Votes
    2 Posts
    2k Views
    JonathanLeeJ

    @jonathanlee

    I found a work around on Squids website block UDP port 443 and UDP 80 it works after and you can access Facebook and it filters and runs Clamav within proxy.

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.