Hi @do1984 !

Thanks for putting the list together. Works great for me!

if you might need a whatsapp list:

# whatsapp .whatsapp.com .whatsapp.net web.whatsapp.com whatsapp.com c.whatsapp.net whatsapp

Regards

@jonathanlee

443 not working.JPG

(Image: Virus Protection working only with HTTP)

If I download the file with HTTPS it does not catch it. However notice I am running SSL intercept with the logs seen above.

clamavcaught.JPG

(Caught: Only working currently for me with HTTP)

HTTPS will bypass this even with the certificates installed and proxy running.

Amazing to see it run half way there !!!

@jonathanlee
FIXED!!!!

The only fix for me was a true reinstall from factory reset mode on the Netgate 2100 max. However when restoring the config it blocked the package install so you have to kill the stuck locked PID in shell with logging in console mode for squidguard. After that just delete the missing half installed packages reboot for file check and reinstall all of them. Once this is done you have control over the logs. The only setting missing was the blacklist URL and common acl for squid guard.

report.JPG

@jonathanlee I would suggest you go through the hangout by jimp

Youtube Video

While its a bit dated now with 2.5 and 2.6 around the corner.. I am not aware of any sort of major changes.. And for sure this hangout goes over the different options of doing https proxy.

@gertjan
There is an underlying misconception why Update Accelerator integrates into Squid managed by ipFire.
After all, pfSense does it too.
In the pfSense documentation on Squid there is a section just dedicated to Windows Update with the patterns recommended by Squid.
So we are not violating Windows functionality.
What Update Accelerator does is to use Squid to download the update and then save the files in a separate folder.
When Squid intercepts a new download, instead of looking in the cache, it fetches the file in this other folder.

Same thing for the other updates that are not from Microsoft.

I am not part of the development team, I just find that this is what is described in the documentation and that U.A. is activated in the Squid configuration page.

@crowfather

I get that the backend limit is 1/10th the front end... but still not sure what this resolves.

If you set the front-end to 500 does that mean the back-end is really 500 but is only showing 50. Should we be setting it to 10X the value we want or is it that it only incorrectly displays this way?

--Nikolaos

@jimfreeze Unfortunately, a bug in HAproxy 2.2 breaks websockets.

Hopefully we can get 2.3 or future soon... or the patch integrated!
(https://github.com/haproxy/haproxy/issues/737)

@jonathanlee

I found a work around on Squids website block UDP port 443 and UDP 80 it works after and you can access Facebook and it filters and runs Clamav within proxy.

@jonathanlee

Firewalls and AntiVirus is a thing of beauty when it works correctly. It is art.

This can decode and inspect every single https, http URL not only that the URLs that are cookie related. This inspects for spyware viruses check for issues. Amazing. What a work of art. Google started working Facebook does not like this running for some reason last website issue for me. Bing, Google, News sites, all work just not Facebook.

squid.JPG

@reeko said in SSL Intercept:

Blocking things with DNS is not efficient at all

I have no idea why you would think that.. Its pretty simple to grab lists or create lists of blocked stuff.

But here you go if your wanting to try it.
https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
Intercept HTTPS CONNECT messages with SSL-Bump

Clients do not send connect messages when in "transparent' mode of interception of the traffic..

You could try this
https://turbofuture.com/internet/Intercepting-HTTPS-Traffic-Using-the-Squid-Proxy-in-pfSense

Good luck.. Maybe someone else will chime that does this.. Its not a common practice for sure. I haven't actually used proxy to try and do such filtering in many years. Not a fan of any sort of messing with any ssl traffic. If was going to do it, would use explict pointing to the proxy and use sslbump..

You will have to trust your CA you create - there is no way to use a cert from 3rd party for such a thing because there is no way to create certs on the fly for www.somedomain.tld from already trusted CA.. So devices that can not be set to trust your CA will not work..

@periko said in Unofficial E2guardian package for pfSense:

Hello marcelloc or other e2guardian users, does e2guardian is already support for pfsense 2.5.2?
Regards!!!

I've been using it on 2.5.2 for months now, no issues.