Hello Friends...Yeah this method works. Squid is logging with mac address. But i'd like to see logs with mac on Light Squid. When i apply your method Light Squid does not show logs and also Light Squid wants me to enable "Enable Acces Logging" checkbox on Squid. If i download the log file to my computer and open with notepad i can see the logs with mac....But as i said i can not see on Light Squid....Is there any way to see the logs with mac on Light Squid?

Nobody any idea? Can't be the only one wanting that feature.

Hi, Finally I figured it out, however I'm not happy about what I've found. HAProxy is working on both interfaces after change default gateway from WAN group WGDefault where WAN1 and WAN2 belongs to Automatic. IMHO proxy shouldn't rely on that setting at all. I'm gonna check pfSense bug reports and submit one eventually.

I would certainly expect that to work, or that approach at least, as long as that user really is in that group and LDAP is returning it. Check the logs. Steve

@Gertjan Thanks Sir ,one more question i want to share scenario our website hosted on x server(it can be cent os httpd or windows iis) so that webserver frontend backend in pfsnese HA proxy .so this thing https://forum.netgate.com/topic/149300/captive-portal-err_ssl_protocol_error/6 help me in this scenario or different thing.

@Foloder So i presume portal.example.org resolves to the IP 192.168.1.101 on the client machine your testing from? Also check haproxy's stats page to verify that the server shows as 'up', it probably needs 'ssl-checks' enabled on the backend server if it isn't. Other that that the config seems fine..

Many thanks for your response PIBa... Since posting my question I have learned that re-writing the headers, using actions in HAProxy is not going to help rewrite the content of the pages themselves (my bad, I'm a noob). The calls to the MongoDB were not direct as you suggested, they were indirect responses from the parseserver app. The solution has been to simply tell the db to declare these https:// urls and that works fine. I had assumed if the db and the parse server weren't actually TLS themselves this might not work, but that was over thinking it perhaps.

Hi, Proxies need end user programs - like browsers, mail programs, etc to be aware of them. "speedtest-cli" is a simple tool, at least the one you can install on pfSense, isn't aware of proxies so it can't get out. I advise you to carefully select two meaningful words like speedtest-cli proxy, feed them into your favourite web search engine, and then do what has been said here.

HAproxy will do that.

To match AD tree, there shouldn't be OU=Info,DC=Info-Tools,DC=lan ?

@jimp said in Bypass squid proxy to some IP: For that, you will need WPAD or a similar client-based proxy configuration telling it what to use and ignore. Squid can't control that in non-transparent mode, it's 100% up to the client. Gonna look into that. Thanks

@dragoangel said in Enforce HTTPS on non standard HTTP port: @chpalmer I not like to be rude, Then don't be. Theres no sense in that. Its just a conversation and a way to learn. No reason to get heated. Yep- I was not wearing my glasses and missed that he is trying to use the same port. You said "impossible" and I agree.

@wesleylc1 do u run SquidGuard?