Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid port 3128 and Firewall Rules

    Scheduled Pinned Locked Moved Firewalling
    squidfirewall rulesdefault denyacllan
    27 Posts 2 Posters 6.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee
      last edited by

      one more note, EZ rules are ignored and the condition continues too.

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • JonathanLeeJ
        JonathanLee
        last edited by JonathanLee

        Screenshot 2023-10-21 at 11.41.10 AM.png
        2nd rule did nothing to resolve this

        Make sure to upvote

        1 Reply Last reply Reply Quote 0
        • JonathanLeeJ
          JonathanLee
          last edited by JonathanLee

          this was also tested

          Screenshot 2023-10-21 at 11.39.55 AM.png

          Make sure to upvote

          1 Reply Last reply Reply Quote 0
          • JonathanLeeJ
            JonathanLee
            last edited by JonathanLee

            this was also tested

            Screenshot 2023-10-21 at 11.42.21 AM.png

            Make sure to upvote

            M 1 Reply Last reply Reply Quote 0
            • M
              mcury Rebel Alliance @JonathanLee
              last edited by

              @JonathanLee If that is not a TCP:S, it should be an out of state connection.
              Could be asymmetric route but I don't think that is the case.

              All you need is to allow clients to connect to their gateway IP address (pfsense), on port 3128.

              Port 3128 will handle SSL connections too. I don't remember ever having to use port 3129.

              dead on arrival, nowhere to be found.

              JonathanLeeJ 3 Replies Last reply Reply Quote 1
              • JonathanLeeJ
                JonathanLee @mcury
                last edited by

                @mcury I wonder why it keeps doing it, it does it for every single lan device in the logs all day. But everything is working on the user end.

                Make sure to upvote

                1 Reply Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee @mcury
                  last edited by

                  @mcury I even have any flag set for all the rules tested

                  Screenshot 2023-10-21 at 11.45.20 AM.png

                  Make sure to upvote

                  M 1 Reply Last reply Reply Quote 0
                  • JonathanLeeJ
                    JonathanLee @mcury
                    last edited by

                    @mcury Maybe they are my URL blocks that still try to connect?

                    Make sure to upvote

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      mcury Rebel Alliance @JonathanLee
                      last edited by

                      @JonathanLee Leave only one rule, clients to default gateway, TCP port 3128.
                      Leave this rule with default settings.

                      Try this:

                      a7333a87-54fd-4f1c-9ba4-ce1e61b399df-image.png

                      There, where you see Firewall Optimization Options, change to conservative.

                      Note that this option will increase memory usage of the firewall.

                      dead on arrival, nowhere to be found.

                      JonathanLeeJ 1 Reply Last reply Reply Quote 1
                      • M
                        mcury Rebel Alliance @JonathanLee
                        last edited by

                        @JonathanLee said in Squid port 3128 and Firewall Rules:

                        Maybe they are my URL blocks that still try to connect?

                        I can't see how could be that.

                        dead on arrival, nowhere to be found.

                        1 Reply Last reply Reply Quote 0
                        • JonathanLeeJ
                          JonathanLee @mcury
                          last edited by

                          @mcury Done set it back to how I had it.

                          Screenshot 2023-10-21 at 11.52.33 AM.png

                          Rules normalized

                          Screenshot 2023-10-21 at 11.51.48 AM.png

                          Changed to conservative optimization

                          Make sure to upvote

                          M 1 Reply Last reply Reply Quote 1
                          • M
                            mcury Rebel Alliance @JonathanLee
                            last edited by

                            @JonathanLee said in Squid port 3128 and Firewall Rules:

                            Changed to conservative optimization

                            I think that will do it..

                            dead on arrival, nowhere to be found.

                            JonathanLeeJ 1 Reply Last reply Reply Quote 0
                            • JonathanLeeJ
                              JonathanLee
                              last edited by JonathanLee

                              Screenshot 2023-10-21 at 11.54.31 AM.png

                              Dang still blocks

                              Screenshot 2023-10-21 at 11.55.25 AM.png

                              Make sure to upvote

                              M 1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee @mcury
                                last edited by

                                @mcury any other ideas?

                                Make sure to upvote

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mcury Rebel Alliance @JonathanLee
                                  last edited by mcury

                                  @JonathanLee Its blocking out connections, from pfsense to the host, with a default deny ipv4 rule?

                                  Check with cat /tmp/rules.debug in the shell, search for that rule.

                                  Do you have any floating rules ?

                                  dead on arrival, nowhere to be found.

                                  JonathanLeeJ 2 Replies Last reply Reply Quote 0
                                  • JonathanLeeJ
                                    JonathanLee @mcury
                                    last edited by JonathanLee

                                    @mcury Yes I have floating rules for traffic shaping

                                    Screenshot 2023-10-21 at 12.04.45 PM.png

                                    Make sure to upvote

                                    1 Reply Last reply Reply Quote 0
                                    • JonathanLeeJ
                                      JonathanLee @mcury
                                      last edited by

                                      @mcury said in Squid port 3128 and Firewall Rules:

                                      cat /tmp/rules.debug

                                      Screenshot 2023-10-21 at 12.06.25 PM.png

                                      Rule

                                      Make sure to upvote

                                      M 1 Reply Last reply Reply Quote 0
                                      • M
                                        mcury Rebel Alliance @JonathanLee
                                        last edited by mcury

                                        @JonathanLee

                                        # default deny rules
                                        #---------------------------------------------------------------------------
                                        block in log inet all ridentifier 1000000103 label "Default deny rule IPv4"
                                        block out log inet all ridentifier 1000000104 label "Default deny rule IPv4"
                                        

                                        I suppose you have transparent proxy also enabled ? For systems that can't set a proxy by hand ?
                                        If that is the case, disable transparent proxy for one second to see if it is not related to the rdr pass you have up there

                                        dead on arrival, nowhere to be found.

                                        JonathanLeeJ 1 Reply Last reply Reply Quote 1
                                        • JonathanLeeJ
                                          JonathanLee @mcury
                                          last edited by

                                          @mcury Yes I do have both, my XBOX uses the transparent side

                                          Make sure to upvote

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            mcury Rebel Alliance @JonathanLee
                                            last edited by

                                            @JonathanLee said in Squid port 3128 and Firewall Rules:

                                            @mcury Yes I do have both, my XBOX uses the transparent side

                                            Have you bypassed all other hosts that don't need transparent proxy in the Squid settings ?

                                            Disable transparent proxy for one sec and test.

                                            If it works, enable it again and try to bypass clients that are pointing to the proxy (explicit) in the transparent settings.

                                            dead on arrival, nowhere to be found.

                                            JonathanLeeJ 2 Replies Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.