Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SquidGuard package TEST

    Scheduled Pinned Locked Moved Russian
    175 Posts 14 Posters 147.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dvserg
      last edited by

      Make this for testing

      • disable all ACL's (checkbox on every acl)
      • uncheck all items on Default rule and set !all (deny all) - test this for block all traffic
      • enable ListaBranca in default and test acces to him and no-access for other
      • one by one enable ACLS and test him for access (first enable you special acls)

      You need find what ACL wrong configured.

      PS after any change before test press Apply button and see Servise string for green (in latest version SG)(mean - SG success started) below Apply button

      SquidGuardDoc EN  RU Tutorial
      Localization ru_PFSense

      1 Reply Last reply Reply Quote 0
      • D
        dvserg
        last edited by

        2 mantunespb

        installed to put happened this error in the end of the site is the same not initiated

        Warning: fopen(/usr/local/etc/squidGuard/squidguard_conf.xml): failed to open stream: No such file or directory in /etc/inc/pfsense-utils.inc on line 1094 Warning: fwrite(): supplied argument is not a valid stream resource in /etc/inc/pfsense-utils.inc on line 1095 Warning: fclose(): supplied argument is not a valid stream resource in /etc/inc/pfsense-utils.inc on line 1096 Warning: fopen(/usr/local/etc/squidGuard/squidguard_conf.xml): failed to open stream: No such file or directory in /etc/inc/pfsense-utils.inc on line 1094 Warning: fwrite(): supplied argument is not a valid stream resource in /etc/inc/pfsense-utils.inc on line 1095 Warning: fclose(): supplied argument is not a valid stream resource in /etc/inc/pfsense-utils.inc on line 1096

        Several questions

        • do you have installed squidGuard port before installation package? (must be deinstalled)
        • check /usr/local/etc/squidGuard/ path for exists

        SquidGuardDoc EN  RU Tutorial
        Localization ru_PFSense

        1 Reply Last reply Reply Quote 0
        • D
          dhipo
          last edited by

          ok /// i do this and satyed strange… but i found an tip ... andnow evething is working... we need compile the lists (blacklists ,destinations, etc) every time what anything is added or removed from blacklists or destinations... the command is ... to first time :
          /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf -C all -d

          or to updates

          /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf -u -d

          the acls are working now
          ....

          Dhix Networks
          Everything Secure

          http://www.dhix.com.br

          1 Reply Last reply Reply Quote 0
          • D
            dvserg
            last edited by

            <english problem="">I have understood that there is problems with(since) rebuilding db?
            Blacklist db rebuild once after his downloading and installation
            User db may be processed with each pressing by button 'Apply'
            (user db each time created as new but not diff)

            Please post you detail ussues - where problem?

            ps i will have test too</english>

            SquidGuardDoc EN  RU Tutorial
            Localization ru_PFSense

            1 Reply Last reply Reply Quote 0
            • D
              dhipo
              last edited by

              ok …. i will try be clear .....  on press apply button or save new Destinations is not creating the db files..
              i created manually using the comand 
              /usr/local/bin/squidguard -c /usr/local/etc/squidGuard/squidGuard.conf -C all

              but every time , when a new url ,expression or domain is added to destinations is necessary run the command
              /usr/local/bin/squidguard -c /usr/local/etc/squidGuard/squidGuard.conf -d

              if db files was not created manually the rules (ACLS) does not work ..
              but, after db creation (manually) works fast and was expected..

              Dhix Networks
              Everything Secure

              http://www.dhix.com.br

              1 Reply Last reply Reply Quote 0
              • D
                dhipo
                last edited by

                new doubt …
                Can i have an acl like this

                " pass MyList "

                without the ' !all ' at the end of line ?

                Dhix Networks
                Everything Secure

                http://www.dhix.com.br

                1 Reply Last reply Reply Quote 0
                • D
                  dvserg
                  last edited by

                  @dhipo:

                  new doubt …
                  Can i have an acl like this

                  " pass MyList "

                  without the ' !all ' at the end of line ?

                  I test bug with db nearest time  ???

                  About ACL
                  '!all' convert to config as 'none'
                  This is default rule for current ACL
                  'pass MyList all' mean pass 'MyList' and 'all' - passed all
                  pass MyList !sex all - mean pass MyList all and deny sex
                  pass MyList none (equiqalence !all) - mean pass only MyList and deny all other

                  SquidGuardDoc EN  RU Tutorial
                  Localization ru_PFSense

                  1 Reply Last reply Reply Quote 0
                  • D
                    dvserg
                    last edited by

                    Rename wisout .txt, replace on '/usr/local/pkg' this and test it.

                    squidguard_configurator.inc.txt

                    SquidGuardDoc EN  RU Tutorial
                    Localization ru_PFSense

                    1 Reply Last reply Reply Quote 0
                    • D
                      dhipo
                      last edited by

                      ok … i changed the squidguard_configurator file ... works good... an new discovered tip .... ACL order is too important .. look this :

                      acl 1 source is 192.168.1.0/24 "pass mylist none" -- my list have only some permited sites

                      acl2 source is 192.168.1.20 pass all

                      in this case acl2 never is used

                      but if acl2 is in top order works  like desired....

                      can an option to move order in acls added ???

                      Dhix Networks
                      Everything Secure

                      http://www.dhix.com.br

                      1 Reply Last reply Reply Quote 0
                      • D
                        dvserg
                        last edited by

                        @dhipo:

                        ok … i changed the squidguard_configurator file ... works good... an new discovered tip .... ACL order is too important .. look this :

                        acl 1 source is 192.168.1.0/24 "pass mylist none" -- my list have only some permited sites

                        acl2 source is 192.168.1.20 pass all

                        in this case acl2 never is used

                        but if acl2 is in top order works  like desired....

                        can an option to move order in acls added ???

                        Great test!! I missed this moment and this very serious. I will work about this  :-[

                        SquidGuardDoc EN  RU Tutorial
                        Localization ru_PFSense

                        1 Reply Last reply Reply Quote 0
                        • D
                          dvserg
                          last edited by

                          Do you have url's with information about squidGuard ALC's order?

                          SquidGuardDoc EN  RU Tutorial
                          Localization ru_PFSense

                          1 Reply Last reply Reply Quote 0
                          • D
                            dhipo
                            last edited by

                            no i don't found anything about acl order on internet …. but it's a try an error what i did ....

                            look ...

                            i thin in this moment we can do an ACL tester .... to show what ACL is being applied ....

                            on command line the test is ....

                            echo "http://www.example.com 100.0.2.10/ - - GET" | /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf -d

                            and will reply on last lines

                            2007-06-24 10:54:39 [15031] squidGuard 1.2.0 started (1182693279.170)
                            2007-06-24 10:54:39 [15031] squidGuard ready for requests (1182693279.178)
                            2007-06-24 10:54:39 [15031] Request(EC/none/-) http://www.example.com 100.0.2.10/- - -
                            http://127.0.0.1/sgerror.php?url=403 100.0.2.10/- - -
                            2007-06-24 10:54:39 [15031] squidGuard stopped (1182693279.178)

                            look the acl NAME there Request(EC/none/-)

                            look this … the ip tested down is an user with special access,  but with porn denied

                            echo "http://www.sex.com 192.168.19.97/ - - GET" | /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf -d

                            reply 2007-06-24 10:59:26 [15573] squidGuard ready for requests (1182693566.468)
                            2007-06-24 10:59:26 [15573] Request(especiais/porn/-) http://www.sex.com 192.168.19.97/- - -
                            http://127.0.0.1/sgerror.php?url=403 192.168.19.97/- - -
                            2007-06-24 10:59:26 [15573] squidGuard stopped (1182693566.469)

                            and now the full network range … with limited access...

                            echo "http://www.sex.com 192.168.0.0/ - - GET" | /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf -d

                            look the different acl 2007-06-24 11:04:25 [16181] Request(lojas/none/-) http://www.sex.com 192.168.0.0/- - -
                            http://127.0.0.1/sgerror.php?url=403 192.168.0.0/- - -
                            2007-06-24 11:04:25 [16181] squidGuard stopped (1182693865.587)

                            in my testings i discovered :
                            if an ACL with specific ip ( host address eg: 192.168.19.97 ) is after of a network range … the acl is never processed ..

                            then i suggest and button to move acl order like rules order in pfsense ...

                            Dhix Networks
                            Everything Secure

                            http://www.dhix.com.br

                            1 Reply Last reply Reply Quote 0
                            • D
                              dvserg
                              last edited by

                              http://www.sdconsult.no/linux/SquidGuard/doc.html

                              How squidGuard decides what to do
                              For each request squidGuard will:
                              try to find a matching client group based on the client IP-address and optional domainname and user ID information. Note: The client groups are matched in the order they are defined. Thus a client group that is a subset of a more general group must come first of the two to take effect. If the client does not match a group then the default acl will be used.
                              Note: The client information must match at least one of each defined type within the actual group to qualify (i.e. ip AND domain AND user).
                              select the corresponding active acl. If no corresponding acl is active or defined the default acl is selected.
                              try to match the URL to each destination group in the listed order in the pass rule in the actual acl and for each destination group in the priority order domainlist, urllist and expressionlist.
                              Note: It is sufficient that the URL matches one of the defined types within the actual group to qualify (i.e. domainlist OR urllist OR expressionlist).
                              if a negative group ("!group") is matched, return the redirect URL for that destination group if defined or alternatively the redirect URL in the actual acl if defined or else the redirect URL in the default acl as the last resort.
                              when a positive group ("group") is matched the stop searching.
                              apply the rewrite rules for the matched destination group if any and then apply rewrite rules for the acl if any or else the rewrite rules for the default acl if any.
                              if the URL was changed by a rewrite rule return the new URL and the suplied information.
                              Otherwise return an empty line indicating no change to Squid.

                              May be source order have effect? Analyze pls this url.. (my translator give stuppid text)

                              SquidGuardDoc EN  RU Tutorial
                              Localization ru_PFSense

                              1 Reply Last reply Reply Quote 0
                              • D
                                dhipo
                                last edited by

                                is this ….

                                The order of "ACL" is important ...
                                look this note:

                                Note: The client groups are matched in the order they are defined.

                                we need an control to ordering "ACL"s

                                Dhix Networks
                                Everything Secure

                                http://www.dhix.com.br

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dvserg
                                  last edited by

                                  @dhipo:

                                  is this ….
                                  The order of "ACL" is important ...
                                  look this note:
                                  Note: The client groups are matched in the order they are defined.
                                  we need an control to ordering "ACL"s

                                  Client group this is Sources blocks
                                  Do you have possible test config with swithching sources blocks? (manually swap and restart squid). I will be able to test tomorrow :-\

                                  SquidGuardDoc EN  RU Tutorial
                                  Localization ru_PFSense

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dhipo
                                    last edited by

                                    no …. source or destinations order is NOT important ....

                                    important is the ACL order ....  blocking is made based on order of ACL...

                                    Dhix Networks
                                    Everything Secure

                                    http://www.dhix.com.br

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      dhipo
                                      last edited by

                                      i did test order of acl and this is real …. .ACL order is important...

                                      Dhix Networks
                                      Everything Secure

                                      http://www.dhix.com.br

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        dvserg
                                        last edited by

                                        @dhipo:

                                        i did test order of acl and this is real …. .ACL order is important...

                                        I now have test via remote access on my work next simple config

                                        
                                        src_myip_on = myip
                                        src_myip_off = myip
                                        
                                        acl {
                                          default .... none // all block
                                          src_myip_on ... all // all pass
                                          src_myip_off ... none //all block
                                        }
                                        

                                        –- A --- beginner
                                        sources  (1)src_myip_on (2)src_myip_off
                                        ACLS (1)default (2)src_myip_on (3)src_myip_off
                                        result MyIP Access = pass

                                        --- B --- swapping acls
                                        sources  (1)src_myip_on (2)src_myip_off
                                        ACLS (1)default (2)src_myip_off (3)src_myip_on
                                        result MyIP Access = pass (!!)

                                        -- C -- swapping sources
                                        sources  (1)src_myip_off (2)src_myip_on
                                        ACLS (1)default (2)src_myip_on (3)src_myip_off
                                        result MyIP Access = blocked (!!)

                                        SquidGuardDoc EN  RU Tutorial
                                        Localization ru_PFSense

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          dhipo
                                          last edited by

                                          you are right ….. the sources order change the result of policy ....  i hate this.... only about lucky .... but my order of sources was right and when i changed policies stop to work.....

                                          great work ..... SOURCES MUST BE ORDERED TO WORK ....

                                          Dhix Networks
                                          Everything Secure

                                          http://www.dhix.com.br

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            dvserg
                                            last edited by

                                            In sources table no way to mooving table line up/down
                                            I have idea add one checkbox field with 3 positions (–/move up/move down)

                                            Any other idea?

                                            SquidGuardDoc EN  RU Tutorial
                                            Localization ru_PFSense

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.