Yeah, you can't go around blocking CDNs or you will have problems with lots of popular sites.

So I am still not sure exactly what the heck is going on. In some cases, it does appear that SYNs are not being responded to. I am not sure why. Then shortly after, it works…??? I added the following to my Squid config, on the General tab in the "Custom ACLS (Before_Auth)" section, and this is helping a lot...though still not good enough for "production": connect_timeout 2 forward_max_tries 2 connect_retries 2

Time to upgrade.

answering my question I used custom options - Custom ACLS (Before_Auth) and put cache_peer 138.203.144.56 parent 1080 7 no-query never_direct allow all it works now.

@BBcan177: pkg_edit.php is used in several places, you will need to provide more details to see what the issue is. When I try to use the group acl as pictured [image: filter.gif] As you can see it displays the warning and error message and the drop down is empty. I looked at the file and it looks like this: 576 - $size = ($pkga['size'] ? " size='{$pkga['size']}' " : ""); 577 - $onchange = (isset($pkga['onchange']) ? "onchange="{$pkga['onchange']}"" : ''); 578 - $input = "<select id="" . $pkga[" fieldname']="" .="" "'="" $multiple="" $size="" $onchange="" name="&quot;$fieldname&quot;">\n";579 - foreach ($pkga['options']['option'] as $opt) {580 - $selected = (in_array($opt['value'], $items) ? 'selected="selected"' : '');581 - $input .= "\t<option value="&quot;{$opt['value']}&quot;" {$selected}="">{$opt['name']}</option>\n";582 - }But of course I have no idea what the error is.ThanksJabo</select>

Its not possible to manually edit the config files and keep your changes when for example rebooting.. For haproxy you could configure most items manually by using the 'advanced' textbox on the settings tab if you really want to.. Though haproxy 1.5 packages allow for configuring certificates from its gui..

1.4 and 1.5 both support 'redirect scheme' http://cbonte.github.io/haproxy-dconv/configuration-1.4.html#redirect http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#redirect For ssl-offloading at least 1.5 is required. http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-crt You can install it by using the haproxy-1_5 or haproxy-devel package.

i had to leave it off as well. the file mods suggested in the forum did not work for me. waiting for a package upgrade

@marcelloc: @aaronouthier: So, I'm using DansGuardian and Squid together. I need to port forward ports 80 & 443 outgoing to port 8080 (DansGuardian) for a type of transparent Proxy Proxy use. SSL port will not work on dansguardian for transparent proxy. :( I am looking for help with Dansguardian SSL support with Squid3-dev on Non-transparent mode.  I am still on pfsense 2.1.5, using the DG and Squid3-dev packages as they come with the pfsense packages. The HTTPS sites are blocked succesfully and access succesfully when allowed.  The problem is that when blocked, it does not redirect to the access denied HTML template page, as done with the HTTP sites, but the browsers return a generic error connection page. Please tell me what information do you need from me, in order to be able to help me. I tried to start a thread for this, but I did not get any reply. https://forum.pfsense.org/index.php?topic=91012.msg505084#msg505084 At least tell me if this can not be solved.

Well i guess it was just too late for me to play with Squid. SNI is working indeed, the right client certificate is selected even on servers with multiple SSL certificates per vhost. Sorry for the post here :)

Anything in /var/squid/logs/cache.log?

Yes, I recreate the cache and deactivate the cron. Since that no more problem on squid except that the cache is not clearing each day ;-). I'll retry the command once I will have less traffic

1.  Squidguard requires Squid. 2.  You only need to install one instance of SquidGuard: the one that goes with your version of squid. You have three SquidGuards installed and no Squid.  No wonder it doesn't work. Here is what to do: 1.  Install Squid3. 2.  Install SquidGuard-squid3.

I've just come back to the forum hoping to find that the transparent proxy issue has been fixed, but apparently not. Worked beautifully up until 2.2 and then a massive step backwards. The issue seems to be that redirection is not working (see HERE), not that squid isn't working. Does nobody test releases on i386? Part of the attraction of pfsense is (was) that it would run perfectly on older hardware. Please let's see this resolved. Steve

system seems ok now…

You probably want to click every box that looks like it might "stealth" a proxy.

We stopped officially requiring 2.0.x compatibility for packages quite some time ago. Please upgrade to a supported release.

Yes , I just wiped all and installed a fresh copy. Hope it works better :)