Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid Transparent Proxy Issue

    Scheduled Pinned Locked Moved pfSense Packages
    17 Posts 5 Posters 21.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • jahonixJ
      jahonix
      last edited by

      From  Proxy server | General settings did you enable LAN as interface and 'Allow users on interface' is ticked?
      And just to be sure 'Transparent proxy' is enabled as well?
      Upstream Proxy is empty and what about 'Access control'?

      1 Reply Last reply Reply Quote 0
      • E
        EricTyrrell
        last edited by

        LAN is the interface and yes 'Allow users on interface' is ticked. I have no acl rules at all. Transparent proxy is definitely enabled. Everything else in the Squid config is default.

        I recently restored pfsense to factory settings. Didn't help. So I reinstalled pfsense from the live cd and it worked great. So then I started restoring previous and it broke again. So again I've reformatted and installed pfsense along with squid. I am in the process of tweaking one thing at a time to figure out what is breaking it and causing this strange behavior.

        1 Reply Last reply Reply Quote 0
        • E
          EricTyrrell
          last edited by

          So far so good except the internet definitely seems slower and on a fast machine. One more clue to the puzzle; I happened to stop the squid service from the services page to see if squid was slowing things down and it made all websites start pointing to the pfsense login again. Very strange. I turned the service back on and everything was back to normal.

          Also, the lightsquid config page says "shedule" in a few places. How do we get that fixed?

          1 Reply Last reply Reply Quote 0
          • D
            dvserg
            last edited by

            Also, the lightsquid config page says "shedule" in a few places. How do we get that fixed?

            What this mean? Can you show screenshot?
            Only create please new topic. Lightsquid different package, and I was able quickly to find a new theme.
            –-
            Must be 2 shedule items
            Refresh sheduler
            Squid rotate log sheduler

            SquidGuardDoc EN  RU Tutorial
            Localization ru_PFSense

            1 Reply Last reply Reply Quote 0
            • jahonixJ
              jahonix
              last edited by

              Hi dvserg, glad you're on this thread!

              @dvserg:

              Also, the lightsquid config page says "shedule" in a few places. How do we get that fixed?

              What this mean?

              It think Eric complains about spelling. It should be: schedule

              1 Reply Last reply Reply Quote 0
              • D
                dvserg
                last edited by

                @jahonix:

                Hi dvserg, glad you're on this thread!
                ..
                It think Eric complains about spelling. It should be: schedule

                Ohm.. This is grammatic error. :(  I learned English poorly in school.:_(
                If you can - please check Lightsquid interface for grammatic and write me - i fix this.
                ps
                Sorry to me, all.

                SquidGuardDoc EN  RU Tutorial
                Localization ru_PFSense

                1 Reply Last reply Reply Quote 0
                • jahonixJ
                  jahonix
                  last edited by

                  Dvserg, do you have an idea why Eric's traffic is redirected to the pfSense webGUI when disabling the transparent proxy?

                  1 Reply Last reply Reply Quote 0
                  • E
                    EricTyrrell
                    last edited by

                    It actually happens when I turn transparent proxy on. It also happened when I shut down the squid service though. Doesn't make sense to me.

                    1 Reply Last reply Reply Quote 0
                    • D
                      dvserg
                      last edited by

                      @jahonix:

                      Dvserg, do you have an idea why Eric's traffic is redirected to the pfSense webGUI when disabling the transparent proxy?

                      On transparent mode squid make self redirect rules
                      May be have incorrect switching from transparent to non-transparent mode
                      Try switch to transparent and them to non-transparent once more.
                      If problem also exists - paste you /tmp/rules.debug in topic or in PM
                      –-
                      Also what installed packages you have?

                      SquidGuardDoc EN  RU Tutorial
                      Localization ru_PFSense

                      1 Reply Last reply Reply Quote 0
                      • M
                        mhab12
                        last edited by

                        @EricTyrrell:

                        So far so good except the internet definitely seems slower and on a fast machine. One more clue to the puzzle; I happened to stop the squid service from the services page to see if squid was slowing things down and it made all websites start pointing to the pfsense login again. Very strange. I turned the service back on and everything was back to normal.

                        I am seeing the same issues where the internet is far slower when the proxy is enabled.  Please see my post here…
                        http://forum.pfsense.org/index.php/topic,7186.0.html

                        Also, as suggested above, I have included my rules.debug - though I am not having issues with traffic being redirected to the GUI.

                        # System Aliases 
                        loopback = "{ lo0 }"
                        lan = "{ rl0  }"
                        wan = "{ xl0  }"
                        enc0 = "{ enc0 }"
                        # User Aliases 
                        
                        set loginterface xl0
                        set loginterface rl0
                        set optimization normal
                        
                        scrub all random-id  fragment reassemble
                        
                        nat-anchor "pftpx/*"
                        nat-anchor "natearly/*"
                        nat-anchor "natrules/*"
                        # FTP proxy
                        rdr-anchor "pftpx/*"
                        
                        # Outbound NAT rules
                        nat on $wan from 10.21.1.0/24 port 500 to any port 500 -> (xl0) port 500
                        nat on $wan from 10.21.1.0/24 port 5060 to any port 5060 -> (xl0) port 5060
                        nat on $wan from 10.21.1.0/24 to any -> (xl0)
                        
                        #SSH Lockout Table
                        table <sshlockout> persist
                        
                        # Load balancing anchor - slbd updates
                        rdr-anchor "slb"
                        
                        # FTP Proxy/helper
                        table <vpns> {   }
                        no rdr on rl0 proto tcp from any to <vpns> port 21
                        rdr on rl0 proto tcp from any to any port 21 -> 127.0.0.1 port 8021
                        
                        # Setup Squid proxy redirect
                        rdr on rl0 proto tcp from any to !(rl0) port 80 -> 127.0.0.1 port 80
                        
                        # IMSpector rdr anchor
                        rdr-anchor "imspector"
                        # UPnPd rdr anchor
                        rdr-anchor "miniupnpd"
                        
                        # Setup squid pass rules for proxy
                        pass in quick on rl0 proto tcp from any to !(rl0) port 80 flags S/SA keep state
                        pass in quick on rl0 proto tcp from any to !(rl0) port 3128 flags S/SA keep state
                        
                        anchor "ftpsesame/*" 
                        anchor "firewallrules"
                        
                        # We use the mighty pf, we cannot be fooled.
                        block quick proto { tcp, udp } from any port = 0 to any
                        block quick proto { tcp, udp } from any to any port = 0
                        
                        # snort2c
                        table <snort2c> persist
                        block quick from <snort2c> to any label "Block snort2c hosts"
                        block quick from any to <snort2c> label "Block snort2c hosts"
                        
                        # loopback
                        anchor "loopback"
                        pass in quick on $loopback all label "pass loopback"
                        pass out quick on $loopback all label "pass loopback"
                        
                        # package manager early specific hook
                        anchor "packageearly"
                        
                        # carp
                        anchor "carp"
                        
                        # permit wan interface to ping out (ping_hosts.sh)
                        pass quick proto icmp from 205.158.217.134 to any keep state
                        
                        # NAT Reflection rules
                        
                        # allow access to DHCP server on LAN
                        anchor "dhcpserverlan"
                        pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
                        pass in quick on $lan proto udp from any port = 68 to 10.21.1.1 port = 67 label "allow access to DHCP server on LAN"
                        pass out quick on $lan proto udp from 10.21.1.1 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
                        block in log quick on $wan proto udp from any port = 67 to 10.21.1.0/24 port = 68 label "block dhcp client out wan"
                        
                        pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
                        
                        # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
                        antispoof for rl0
                        
                        anchor "spoofing"
                        # Support for allow limiting of TCP connections by establishment rate
                        anchor "limitingesr"
                        table <virusprot>
                        block in quick from <virusprot> to any label "virusprot overload table"
                        # pass traffic from firewall -> out
                        anchor "firewallout"
                        pass out quick on xl0 all keep state label "let out anything from firewall host itself"
                        pass out quick on rl0 all keep state label "let out anything from firewall host itself"
                        pass out quick on $enc0 keep state label "IPSEC internal host to host"
                        # make sure the user cannot lock himself out of the webGUI or SSH
                        anchor "anti-lockout"
                        pass in quick on rl0 from any to 10.21.1.1 keep state label "anti-lockout web rule"
                        
                        # SSH lockout
                        block in log proto tcp from <sshlockout> to any port 22 label "sshlockout"
                        
                        anchor "ftpproxy"
                        anchor "pftpx/*"
                        
                        # User-defined aliases follow
                        
                        # User-defined rules follow
                        block in quick on $lan proto tcp from any to any port = 80  label "USER_RULE"
                        pass in quick on $lan from 10.21.1.0/24 to any keep state  label "USER_RULE: Default LAN -> any"
                        
                        # VPN Rules
                        
                        pass in quick on rl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
                        pass in quick on rl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
                        pass in quick on xl0 inet proto tcp from port 20 to (xl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection"
                        # enable ftp-proxy
                        
                        # IMSpector
                        anchor "imspector"
                        
                        # uPnPd
                        anchor "miniupnpd"
                        
                        #---------------------------------------------------------------------------
                        # default rules (just to be sure)
                        #---------------------------------------------------------------------------
                        block in log quick all label "Default block all just to be sure."
                        block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></snort2c></snort2c></snort2c></vpns></vpns></sshlockout>
                        
                        1 Reply Last reply Reply Quote 0
                        • H
                          heiko
                          last edited by

                          Please see also this ticket http://cvstrac.pfsense.com/tktview?tn=1557, i can duplicate this behaviour.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mhab12
                            last edited by

                            Eric & Heiko:

                            What type of hardware are you using when you can see the decrease in speed?

                            1 Reply Last reply Reply Quote 0
                            • H
                              heiko
                              last edited by

                              this one…

                              http://www.ipc2u.de/catalog/M/MB/33531.html

                              with 1 GB RAM and 40 GB HDD

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.