You see any errors in the cache log? That image appears to be called from some local location data:image/png;base64,iVBORw0K...... I'm not sure that would be cached at all anyway. Steve

@vacquah While it works, the Synology does not seem to automatically update the certs even though it is supposed to. I do get a reminder so can manually get it to update. On the synology side you need to set it up with the certificates part on the control panel. There are plenty of web hits on how to do this part. The HAProxy part is basically how I have it in a few posting before this. You need to be careful of the order of things as I had my pfSense path first and it was matching that and going there and never got to the synology match. After a reordering it worked as it should.

That package has ZERO to do with passive.. Its Active Client Proxy.. Ie client using active connection to server outside pfsense. When connection in passive mode the internal IP address is given to the client thru the WAN interface Yeah setup your server to give out your actual public.. here https://docs.netgate.com/pfsense/en/latest/nat/ftp-without-a-proxy.html BTW - not related to your ftp problem, but you should be on p3

Ok. So I got the system to work by disabling the firewall on pfsense itself. That led me to the firewall on pfSense and added 7445 on the actual server firewall. I just assumed that by enabling LightSquid it would have added that rule. Thanks, and I hope that helps someone else having the issue.

@sarasaunders Thanks to you for help, we will get back to you after our tests.

@tleadley This has never been answered, it was a configuration error with a hairpin DNS. It was corrected by creating the correct rules to forward to the appropriate server behind our DMZ interface. We also switched to HAproxy which gave us the ablility to host multiple sites with multiple certs! We can mark this solved!

If squid starts and then dies due to some reason, it should be logged in Status - System Logs. What do you get if you shell in and run: squid -k parse or squid -k reconfigure

@aGeekhere I don't have time to finish reading the post right now but it looks like a lot of good info. I don't remember seeing that page. The reason WPAD won't do us much good is because we have to be able to filter all internet access, including public WiFi.

@wontbeherelong Does it work when accessed outside of haproxy directly on your lan network? 'http://<IP-of-your-plex-server>/plex/'

Read my guide https://forum.netgate.com/topic/100342/guide-to-filtering-web-content-http-and-https-with-pfsense-2-3/176

Pretty much defaults. At first I thought it might be an infected device but I see similar traffic on different devices with different OS's. I'm running transparent http/https splice all

You're welcome, glad you have it working now. -Rico

@KOM All is working. I figured it out. There were some private IP addresses in use upstream that were the same as those configured on my LAN interface. I connected to a different network and all is fine now. Thanks.

@Soarin They break because the webserver which listens on :9220 doesn't know the the client is connecting to :443 and then when it includes 'absolute links' or tries to redirect from one page to another it will send the wrong location to the client.. Which then tries to follow that and fails to connect to :9220 which isnt available from 'outside'.. Best way to solve this is to make the webserver / webapplication 'aware' that the client uses https://domain:443/ as with phpmyadmin the "PmaAbsoluteUri" setting does, or convince the webserver/webapplication to only send 'relative' paths and not absolute ones... For the 'wrong' redirect's you could probably configure haproxy to replace the wrong 'Location:' header with the correct one.. If 'absolute links' which point to :9220 are in the 'body' of the webserver replies / the webpage served, then your basically out of luck as haproxy will not replace that content inside the body of a reply.. (unless you go for some custom heavy duty Lua scripting....)

Yes it is possible. People can help you but they will not do it all for you. Go ahead and try it, and come back here if you have questions or problems. Have you seen the official Netgate video on squid and squidguard?