Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 6.5 !! Nov 6th

    Scheduled Pinned Locked Moved Cache/Proxy
    squid updatebug fixesupstream fix
    82 Posts 12 Posters 18.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee @lg1980
      last edited by

      @lg1980 how can I test the package?

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • J
        jc1976
        last edited by

        all these updates are great but what happens when it's finally done?

        Netgate said squid will no longer be available in the package manager with the next major release of pfsense, so it seems squids days are numbered, at least for pfsense, which really sucks..

        there's haproxy, but that lacks av integration.. people might say "it doesn't matter b/c internet traffic is encrypted.. yes, but if you're behind a proxy, then it works well!

        so what are we supposed to do?

        JonathanLeeJ 1 Reply Last reply Reply Quote 0
        • JonathanLeeJ
          JonathanLee @jc1976
          last edited by

          @jc1976 You just manually install it if you use it like us. It will be back alot of users use this.

          Make sure to upvote

          J 1 Reply Last reply Reply Quote 0
          • J
            jc1976 @JonathanLee
            last edited by

            @JonathanLee

            ok, but if netgate removes it from the package manager and we have to manually install it, does that mean the gui portion of it will be removed and all configuring will need to be done via cli?

            JonathanLeeJ L 3 Replies Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee @jc1976
              last edited by JonathanLee

              @jc1976 You would have to do it in cmd line after, and use the old packages to install manually

              Make sure to upvote

              1 Reply Last reply Reply Quote 0
              • JonathanLeeJ
                JonathanLee @jc1976
                last edited by

                @jc1976

                https://forum.netgate.com/topic/185029/resolved-quest-for-older-package-wget

                I would not use it but if you need it like me..

                I did it with Snort to stop the core dumps

                Just know that Netgate recommended it be removed.

                Make sure to upvote

                1 Reply Last reply Reply Quote 0
                • L
                  lg1980 @JonathanLee
                  last edited by

                  @JonathanLee said in Squid 6.5 !! Nov 6th:

                  result for use with arm processor

                  Oh man ! it still doesn't compile binaries for the ARM version, I don't have Netgate hardware here to test.

                  This is only to AMD64 version architeture.

                  1 Reply Last reply Reply Quote 0
                  • L
                    lg1980 @jc1976
                    last edited by

                    @jc1976 said in Squid 6.5 !! Nov 6th:

                    ok, but if netgate removes it from the package manager and we have to manually install it, does that mean the gui portion of it will be removed and all configuring will need to be done via cli?

                    No, personally, and even to maintain pf2ad, I will maintain in a parallel repository (in this case it will be unofficial) Squid and all the tools, as well as the web interface (as it is), with the necessary updates for each package

                    1 Reply Last reply Reply Quote 1
                    • M
                      Michele Trotta
                      last edited by

                      Hi Luiz,

                      I'm starting from a clean installation of pfsense 2.7.2 and running the command fetch -q -o - https://gitlab.labexposed.com/-/snippets/15/raw/main/repo-squid66.sh | sh

                      I installed the packages as shown in the image.

                      8cd4ad25-5608-4f27-9092-c2c179288137-image.png

                      After configuring Squid and SquidGuard I have the following errors:

                      • in real time

                      da569d1d-38ed-49d5-8c25-213097cc1693-image.png

                      -on the client

                      3b0f1455-495f-4247-95d2-24e529de70da-image.png

                      where the ip 172.17.78.81 is the proxy

                      Is there anything I can do ?

                      JonathanLeeJ 3 Replies Last reply Reply Quote 0
                      • JonathanLeeJ
                        JonathanLee @Michele Trotta
                        last edited by

                        @Michele-Trotta interesting…. What does Squids official website say about that error?

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • M
                          Michele Trotta
                          last edited by

                          Hi everyone, since version 2.7.1 pfsense Squid is deprecated and that's why all these strange errors occur.
                          I was hoping for Luiz's patch. Before abandoning pfsense+squid I will do some more tests because it is an excellent solution.
                          If you have other solutions to try let me know.
                          Greetings
                          Michele

                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                          • JonathanLeeJ
                            JonathanLee @Michele Trotta
                            last edited by JonathanLee

                            @Michele-Trotta hello everyone on this post is already aware. This post is for work arounds. Squid itself has many new security updates already available. I am sure you are aware. Thanks, this post is just the open source community coming together to help find ways to make it work. Solutions are needed and being tested in here with high hopes of bring the latest Squid version online for die hard users. Just some open source discussion at its finest. Seems it still has some bugs with that error you see above.

                            Leading to Ecap over icap I wonder if that would improve security as it can work directly with DoH I am told.

                            DoH is a big issue with dns based security….. it’s pure https based DNS you can’t force it and it’s reaction based when you block it, ever worse is QUIC. The latest Squid updates have QUIC protocol tools to detect and inspect. That’s https over udp, and it’s a big issue within dns based cyber security detection also. That’s why Squid can’t and won’t die. It’s because Squid has solutions for all the new protocols.

                            We make solutions not problems.

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • JonathanLeeJ
                              JonathanLee @Michele Trotta
                              last edited by

                              @Michele-Trotta Squid has custom options you can check them on there website, I wonder if something is automatically activated when the new version is installed…

                              Make sure to upvote

                              1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee @Michele Trotta
                                last edited by

                                @Michele-Trotta check this out…

                                IMG_0114.png

                                https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit

                                You might have a certificate issue

                                Make sure to upvote

                                1 Reply Last reply Reply Quote 0
                                • M
                                  Michele Trotta
                                  last edited by

                                  Hi,

                                  I added a new certificate and assigned it to squid.

                                  3f79fd53-ee8d-4e0a-b7a3-4412cf48b57a-immagine.png

                                  the result is always the same
                                  c5bccb08-0fde-4cf9-a02b-6ee4bd51db0e-immagine.png

                                  where 172.17.78.81 is proxy

                                  and on client

                                  86f58f93-5fe0-41c3-a3a4-0f7dd005a558-immagine.png

                                  What other tests can I do?

                                  Thank you

                                  JonathanLeeJ 2 Replies Last reply Reply Quote 0
                                  • JonathanLeeJ
                                    JonathanLee @Michele Trotta
                                    last edited by

                                    @Michele-Trotta

                                    Try to change settings in this area and see if the error goes away..

                                    Screenshot 2024-01-24 at 07.57.55.png

                                    Also try to make the SSL certificate with OpenSSL in command line and import that one into pfSense so its made with Squids application

                                    "Step 1. Configuring the root Certificate Authority (rootCA)
                                    This is probably the part that is most confusing for people and why their setups have failed, Squid need to have a CA assigned to it so that it is able to decrypt parts of the HTTPS header so that it can determine what to do whit that traffic, otherwise all traffic is passed.

                                    I used the built-in openssl tool of pfSense to generate this rootCA, for this you need to ssh in to your firewall or connect to it over console, when at the console menu select option 8 Shell, when you are at the shell prompt you need to manually edit the openssl to give you the necessary prompts and questions for you to configure the rootCA

                                    vi /etc/ssl/openssl.cnf

                                    under the [ REQ ] option change the following line from: prompt=no to prompt=yes
                                    under the [ V3_REQ ] option change the following line from: basicConstraints=CA:FALSE to basicConstraints=CA:TRUE
                                    Then save and quit (to save and quit vi editor use :wq!).
                                    Now we would make a known location in the filesystem to save our rootCA and key file as they need to be imported into pfSense GUI at a later stage, I like to use /tmp for any temporary files

                                    Command:
                                    mkdir /tmp/Proxyfiles

                                    Now move to the folder you created whit:
                                    cd /tmp/Proxyfiles

                                    When you are in this folder you are ready to start the openssl tool and start to create your rootCA, you start whit generating your KEY file by running the command:

                                    openssl genrsa -out myProxykey.key 2048

                                    This will create an rsa key file named myProxykey.key that we use to sign our rootCA whit in the next command for generating the pem file for the rootCA
                                    Create a pem file signed whit key using command:

                                    openssl req -x509 -new -nodes -key myProxykey.key -sha256 -days 365 -out myProxyca.pem

                                    This will prompt you to answer some questions to generate the needed pem file in my case it is as below, you need to change this for where you are

                                    US []:NO - Country code
                                    Somewhere []:Oslo - State or province
                                    Somecity []:Oslo - Your city or town
                                    CompanyName []:IT-Monkey - Name of your company or business, "make something up if you are a home user"
                                    Organizational Unit Name (eg, section) []:IT-Department - What part of the company issued the cert, can also be left blank
                                    Common Name (eg, YOUR name) []:Admin - Your name or identity in the company
                                    Email Address []:admin@it-monkey.local - Your contact email

                                    At this point you should have 2 files in your /tmp/Proxyfiles directory

                                    myProxyca.pem
                                    myProxykey.key

                                    This can be double checked whit command:

                                    ls -la

                                    If both are there then you are ready to download them and exit the shell environment and continue to the GUI of pfSense, if not you need to look over any error or try again.

                                    To download these files I like to use WinSCP as its fast to navigate and find the files you want to move you can also do this from pfSense Diagnostic -> Command Prompt option and select the file path of:

                                    /tmp/Proxyfiles/myProxyca.pem
                                    /tmp/Proxyfiles/myProxykey.key

                                    In the download box, this is somewhat slower to navigate but works just fine.

                                    Now as you have these files on your desktop or computer you need to open them in a text editor, I prefer Notepad++ as it's able to adjust the formatting layout of the text but any text editor will work as you will need to copy paste the information in these files to fields in the pfSense GUI.
                                    Navigate to System -> Cert. Manager -> CA's
                                    Here you want to add a new CA

                                    Descriptive name: SquidCA
                                    Method: Import an existing Certificate Authority
                                    Certificate data: Copy \ Paste the info from myProxyca.pem file
                                    Certificate Private Key: Copy \ Paste the info from myProxykey.key file
                                    Save and apply
                                    "

                                    Ref:
                                    https://forum.it-monkey.net/index.php?topic=23.0

                                    Make sure to upvote

                                    1 Reply Last reply Reply Quote 0
                                    • JonathanLeeJ
                                      JonathanLee
                                      last edited by

                                      How as this compiled ? With Clang? I want to compile one for me I am using the arm processor

                                      Make sure to upvote

                                      1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @Michele Trotta
                                        last edited by

                                        @Michele-Trotta what is the IP address of your firewall is it 172.17.78.81?

                                        Is that cider network included in the allow use of proxy area under access control list in Squid?

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jc1976
                                          last edited by

                                          can the proxy portion of this be handled by haproxy instead of squid?
                                          if squid is gonna be such a pain about this then...?

                                          all of my research said it can absolutely be done. you won't get the inline virus scanning of clamav but i'd think you could piggy-back another device running linux and clamav (or any antivirus package) to perform the scanning we want before sending it on to the requesting client on the backend..

                                          yes?/no?

                                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                          • JonathanLeeJ
                                            JonathanLee @jc1976
                                            last edited by

                                            @jc1976 If you want to run another device you can also run squid on another device haproxy can't do web caching or certificated ssl inspecting

                                            Make sure to upvote

                                            J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.