• Advice for CA Import and Squid SSL Filtering… [SOLVED]

    2
    0 Votes
    2 Posts
    672 Views
    O

    Apologies all… Google Foo was not playing well this morning...

    Thread with info I need is here:  https://forum.pfsense.org/index.php?topic=83236.0

  • Blocking Android and iOS devices from visiting porn sites

    11
    0 Votes
    11 Posts
    6k Views
    KOMK

    The main problem with OpenDNS is that you can't segregate between blocked and non blocked clients

    You can in a way via firewall rules.  Non-blocked clients can get direct access out via port 53 to whatever DNS they choose.  Blocked clients will have their DNS requests captured and handled by pfSense.

  • Cannot publish subpages with HAProxy

    11
    0 Votes
    11 Posts
    3k Views
    D

    on the backend i have added the following line to

    "Backend pass thru"
    reqrep ^([^\ :])\ /Automation/(.)    \1\ /\2

    This seems to work is it possable to drop off the last forward slash / ?

    Cheers

    Rich

  • Squid logs still displaying : pinger Initilising ICMP pinger

    3
    0 Votes
    3 Posts
    2k Views
    KOMK

    By default, I think squidGuard is configured to deny all so you would have to go to Target Categories, expand the list and then make sure that Default access [all] is set to Allow.

  • Possible bug in pfsense 2.3.2 with squidguard

    1
    0 Votes
    1 Posts
    809 Views
    No one has replied
  • Squid - 2.3 fixes: CP authentication + outdated SSL proxy directives

    6
    0 Votes
    6 Posts
    3k Views
    marcellocM

    The script for cp authentication integration is updated on latest package version for pfSense 2.3.x.

  • SquidGuard, err_tunnel_connection_failed"

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • Error squidguard install

    1
    0 Votes
    1 Posts
    599 Views
    No one has replied
  • Squid + wccp

    1
    1 Votes
    1 Posts
    538 Views
    No one has replied
  • Squid proxy 4 is now in RELEASE CANDIDATE cycle

    3
    0 Votes
    3 Posts
    2k Views
    K

    I tested this using the freebsd http://pkg.freebsd.org/freebsd:10:x86:64/latest/All/squid-devel-4.0.13.txz on pfsense 2.3.2 http and SSL filtering transparent and non transparent mode, works fine have to edit the squid.conf also. With squidguard i got short of file descriptor currently have this kern.maxfiles: 15260 with only 1 user got short of file descriptor so i move back to 3.5.19 official pfsense repo.  Same config with storeid_rewriter helper.

  • Squid and 2 separated WANS

    4
    0 Votes
    4 Posts
    798 Views
    K

    you cant load balance internal traffic from 127.0.0.0/8, best solution therefore is to use a parent proxy inside any of your lan and load balance that trafiic. REmember not to intercept that traffic from your parent proxy else you will be going to an infinite loop.

  • System: Group manager - Access Squid3 and SquidGuard

    2
    0 Votes
    2 Posts
    940 Views
    jimpJ

    You also need to grant them access to "WebCfg - Package: Edit" or they can't submit info.

  • Squid Usage

    2
    0 Votes
    2 Posts
    878 Views
    R

    Little bit more.

    I'd like squid to do this.

    http port 80 redirect to https 443 and serve up https pages.  On the backend I want to use simple http and squid do all the encrypting.

  • HTTPS Filtering, once and for all!

    13
    0 Votes
    13 Posts
    8k Views
    C

    Well… HTTP proxy can run in both explicit and transparent mode and this has nothing to do with SSL-Bump.
    These are 2 different aspects and the only relationship is when you want/need to deal with HTTPS in transparent mode or if you want/need to analyse HTTPS content.

    However, what needs to be understood is that from browser view point, proxy is either defined (whatever the way you define it) or not. If proxy is defined, then this is an explicit proxy. If not, this is transparent proxy. Which means that if proxy side, one can have both in parallel, client side (browser) you have only 3 choices with no overlap:

    explicit proxy no proxy -> with transparent proxy intercepting no proxy... without proxy  ;D

    If SSL-bump is configured (whatever proxy mode, explicit or transparent), trusting certificate generated to intercept HTTPS flow is mandatory to prevent warning messages.
    This often means to deploy, client side, CA public key to be trusted.

    Keep in mind we are only discussing technical aspects here, not all the legal aspects with HTTPS flow being broken and intercepted.

    While designing your proxy, you have to determine whether your goal is to filter access (e.g. prevent facebook access) which doesn't require any SSL-bump, even for HTTPS, but does require explicit proxy or if you need/want to intercept HTTPS, which means SSL-Bump thus certificate.

  • Reduce squidGuard Load Times

    4
    0 Votes
    4 Posts
    4k Views
    KOMK

    Yeah I have no idea about that, sorry.

  • Cisco asa + squid + wccp

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • How to disable SSL filtering in transparent mode while SSL enable

    7
    0 Votes
    7 Posts
    2k Views
    K

    Exactly thats why I am posting this :). If you have a better solution then post it

  • Squid Guard Groups ACL bug

    1
    0 Votes
    1 Posts
    856 Views
    No one has replied
  • Connect squid squidguard and ssl_bump

    3
    0 Votes
    3 Posts
    2k Views
    A

    nice one sir :)

  • LightSquid report hard to believe

    1
    0 Votes
    1 Posts
    925 Views
    No one has replied
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.