Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid transparent proxy + SquidGuard error "transaction-end-before-headers"

    Scheduled Pinned Locked Moved Cache/Proxy
    23 Posts 10 Posters 34.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tchadrack
      last edited by tchadrack

      Same error here, squid-4.10

      I found some release notes about squid version 4.11, here:

      http://ftp.meisei-u.ac.jp/mirror/squid/squid-4.11-RELEASENOTES.html#toc3.2

      Section 3.2 Changes to existing tags:

      Unused connections received in http_port or https_port or transactions terminated before reading[parsing] request headers are logged with URI error:transaction-end-before-headers.

      1 Reply Last reply Reply Quote 0
      • C
        CaliPilot @xalex1977
        last edited by CaliPilot

        @xalex1977 larksuite.com is running on a CDN. We faced the same issues like you, with other and more dramatic consequences (squid crashes and so on). We pinned it down to DNS. We changed from Google-DNS to the local ones from our ISPs, we made DNS-Resolver work (and played with minimum TTLs), fixed our Windows-DNS Servers and disabled the name caches (which doesn't work, we clean them now manually every 5 Minutes via a script) and we disabled name-caching on our clients. Key is that your DNS between Pfsense, internal DNS and your clients is always sync. Squid is a b*tch if one of your boxes is responding with the wrong host or ips.

        We made for critical sites (like SAP C4C) static host overrides because they drive crazy with changing their IP every few minutes. All in all i'm very happy right now with or setup!

        Another trick we learned that you can use an Alias in Squid to Bypass traffic like for services hosted by Apple (iTunes, App-Store and so on). Key is that you add all known cnames from that cdn-hosted site to your Alias and add that Alias to Squid in the "bypass proxy for these destination IPs".

        aa591f58-c505-454d-8c89-31663061aa2c-image.png

        f2eaac79-8a45-477e-84c0-300bcc99375e-image.png

        7abdf363-36ba-4bc4-ad93-b607a97419a9-image.png

        I'm not a hardcore linux or network specialist but if you check your config, fix your dns and have everything in place it works pretty well. It is some work in the beginning (GotoMeeting, Teams and Apple stuff) and sometimes it's challenging but it will work!

        Chris

        X D 2 Replies Last reply Reply Quote 1
        • X
          xalex1977 @CaliPilot
          last edited by

          @CaliPilot hi, unfortunately larksuite has a lot of third level domains and it is impossible for me to create aliases;
          we use the windows active directory server dns, I would not want disabled Windows-DNS Servers name caches and name-caching on our clients, it is too uncomfortable.

          Will this problem not be corrected with a new version of Squid?

          Thanks

          1 Reply Last reply Reply Quote 0
          • C
            coffeelover
            last edited by

            The error in your log seems to be a CONNECT issue.
            The Browser opens a CONNECT session to the target site and will only accept a socket address, not a URL.
            The Rewrite URL from squidguard https://site.com/sgerror.php is parsed as a socket address like host:port

            We have squid with SSL MITM, ClamAV and Squidguard with correct url redirect working with the following setting:

            squid mitm: splice whitelist, bump otherwise

            additional advanced options:
            url_rewrite_access deny CONNECT
            url_rewrite_access allow all

            This will deny CONNECT sessions for non-whitelisted sites and will let the redirect work.

            As redirect function in squidguard you need to set "ext url move", not redirect.

            K 1 Reply Last reply Reply Quote 1
            • K
              kasalencar @xalex1977
              last edited by

              @xalex1977 também tenho esse mesmo problema! Estou com pfsnse 2.5.0 + Proxy Transparente + interceptação SSL. Notei que esses erros está diretamente relacionado ao dispositivo que acessam via wifi. Não sei se tem algo relacionado ou só consciência.

              X 1 Reply Last reply Reply Quote 0
              • K
                kasalencar @coffeelover
                last edited by

                Amigo onde você insere essa informação adicional?
                Seria no campo "Opções personalizadas (SSL / MITM)" ???

                1 Reply Last reply Reply Quote 0
                • X
                  xalex1977 @kasalencar
                  last edited by xalex1977

                  @kasalencar i have version 2.4.5-RELEASE-p1 + squid in transparent mode (SSL/MITM Mode Splice All) + squidguard and i still have the problem 😢

                  K 1 Reply Last reply Reply Quote 0
                  • K
                    kasalencar @xalex1977
                    last edited by

                    @xalex1977 Eu notei que no acontece esse erro em páginas bloqueadas pelo SquidGuard e o dispositivo não possuí o certificado emitido pelo firewall.

                    Após o usuário recarregar a consulta, a página mostrada é a do Squid com mensagem de block.

                    1 Reply Last reply Reply Quote 0
                    • V
                      vaughng
                      last edited by

                      Can confirm this is a DNS issue. Fixed by enabling "DNS Query Forwarding" under Services > DNS Resolver.

                      1 Reply Last reply Reply Quote 1
                      • D
                        dkzsys @CaliPilot
                        last edited by

                        @CaliPilot

                        Hi Chris,

                        I seem to be having issue even after configuring the firewall alias. I have created a post and would very much appreciate some input from you. https://forum.netgate.com/topic/182891/squid-proxy-bypass-proxy-for-these-destination-ips-not-working-transparent-http-proxy-mode-https-ssl-interception

                        Thank you.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.