Squid port 3128 and Firewall Rules

[JonathanLee]

this was also tested

[JonathanLee]

this was also tested

[mcury]

@JonathanLee If that is not a TCP:S, it should be an out of state connection.
Could be asymmetric route but I don't think that is the case.

All you need is to allow clients to connect to their gateway IP address (pfsense), on port 3128.

Port 3128 will handle SSL connections too. I don't remember ever having to use port 3129.

[JonathanLee]

@mcury I wonder why it keeps doing it, it does it for every single lan device in the logs all day. But everything is working on the user end.

[JonathanLee]

@mcury I even have any flag set for all the rules tested

[JonathanLee]

@mcury Maybe they are my URL blocks that still try to connect?

[mcury]

@JonathanLee Leave only one rule, clients to default gateway, TCP port 3128.
Leave this rule with default settings.

Try this:

There, where you see Firewall Optimization Options, change to conservative.

Note that this option will increase memory usage of the firewall.

[mcury]

@JonathanLee said in Squid port 3128 and Firewall Rules:

Maybe they are my URL blocks that still try to connect?

I can't see how could be that.

[JonathanLee]

@mcury Done set it back to how I had it.

Rules normalized

Changed to conservative optimization

[mcury]

@JonathanLee said in Squid port 3128 and Firewall Rules:

Changed to conservative optimization

I think that will do it..

[JonathanLee]

Dang still blocks

[JonathanLee]

@mcury any other ideas?

[mcury]

@JonathanLee Its blocking out connections, from pfsense to the host, with a default deny ipv4 rule?

Check with cat /tmp/rules.debug in the shell, search for that rule.

Do you have any floating rules ?

[JonathanLee]

@mcury Yes I have floating rules for traffic shaping

[JonathanLee]

@mcury said in Squid port 3128 and Firewall Rules:

cat /tmp/rules.debug

Rule

[mcury]

@JonathanLee

# default deny rules
#---------------------------------------------------------------------------
block in log inet all ridentifier 1000000103 label "Default deny rule IPv4"
block out log inet all ridentifier 1000000104 label "Default deny rule IPv4"

I suppose you have transparent proxy also enabled ? For systems that can't set a proxy by hand ?
If that is the case, disable transparent proxy for one second to see if it is not related to the rdr pass you have up there

[JonathanLee]

@mcury Yes I do have both, my XBOX uses the transparent side

[mcury]

@JonathanLee said in Squid port 3128 and Firewall Rules:

@mcury Yes I do have both, my XBOX uses the transparent side

Have you bypassed all other hosts that don't need transparent proxy in the Squid settings ?

Disable transparent proxy for one sec and test.

If it works, enable it again and try to bypass clients that are pointing to the proxy (explicit) in the transparent settings.

[JonathanLee]

@mcury How do you bypass for example one host like 192.168.1.17 from the SSL intercept but still make it use the the transparent proxy?

[mcury]

@JonathanLee said in Squid port 3128 and Firewall Rules:

How do you bypass for example one host like 192.168.1.17 from the SSL intercept but still make it use the the transparent proxy?

1- Disable transparent proxy
2- You would have to create the transparent NAT manually, using a ! in the source, with that IP address.
3- That NAT would have to redirect outbound TCP 443 connections to 127.0.0.1 3128.

Test like that, if doesn't work, try to change the port in the 3rd step to 3129.

I think that will do it.

Note that you would also need to create one for port 80.