SquidGuard and blank redirects?

dvserg

What squid mode (transparent?) and webGUI port you have?

ciarocci

I have the same problem. I am using squid in transparent mode. By webGUI port, do you mean the port squid is answering on or the actual port the pfSense webGUI is running on? If the former, squid is running on port 3128. If the latter, I'm using port 80 to access my webGUI.

Chris

dvserg

Problem exists. >:(
About fix - will posting here.
ps Sorry, if fix will delay - i'm have New Year & Chrismas.

ciarocci

Is there a workaround for this such as changing the webGUI port or not using transparent mode or both?

xen

If you set management port other than 80 you have to edit /usr/local/pkg/squidguard_configurator.inc…

find:

define('REDIRECT_BASE_URL', 'http://127.0.0.1/sgerror.php');

and

define('REDIRECT_TRANSPARENT_BASE_URL', '/sgerror.php');

lines and change them with

define('REDIRECT_BASE_URL', 'http://127.0.0.1:XXXX/sgerror.php');
define('REDIRECT_TRANSPARENT_BASE_URL', ':XXXX/sgerror.php');

XXXX means your managament port...

that will solve your problem..

note: you have to change that port settings when you change your management port...

ciarocci

I am currently using port 80 for my management port. Are you saying simply changing the port and changing the config file for squidguard will stop the blank redirects? That doesn't make sense to me. Right now the ports match, and after the modification the ports will still match. How does that change anything? You might have to explain it to me like I'm stupid (or ignorant would be a better word). :-) I'm still unclear on why the port used to manage my firewall has anything to do with the port squidguard uses. Doesn't squidguard speak to squid which is running on port 3128? I don't seem to have even a basic understanding on how the management port comes into play. The only thing that seems to match is squid is capturing packets destined to port 80 outside of the LAN.

Chris

dvserg

This blank-page-bug exists - that's all what i can say.
Maybe problem with 127.0.0.1 & transparent mode of squid
On transparent mode all connections to 80 port (but not LAN-IP) redirect to 3128 port of squid, 127.0.0.1:80 too.

Now i see one way - use LAN ip as redirect address
http://LanIP/sgerror.php

Now i can't test this - up to 09/01 I have Selebrations :-
May-be any body will test this for me?

This sources (! store you old files !)
http://diskatel.narod.ru/pfSense/packages/squidguard.inc
http://diskatel.narod.ru/pfSense/packages/squidguard_configurator.inc
In squidGuard.cfg must be used Lan IP as redirection path.

xen

when i try to manage my box over 80, i got some issues(on transparent mode)… then i change the managament port and i realise that squidguard_configurator.inc doesnt care the box's management port... that makes the sgerror.php page unreachable. first of all you have to access this file to redirect to another page. thats what im saying.

by the way , serg's new scripts are working and recognizing management port without modification. it still shows a blank page. you can make a custom error page on your server and use it as default redirection url. sgerror.php can redirect to another page.

dvserg

Test error request-pages - generated 'sgerror'
http://youPfSense/sgerror.php?url=403
http://youPfSense/sgerror.php?url=404
http://youPfSense/sgerror.php?url=410
Must showing standard browser error page on you language.

xen

i already tried that. on my pfsense, sgerror doesnt generate error pages.

dvserg

@xen:

i already tried that. on my pfsense, sgerror doesnt generate error pages.

1 - if make 'disabled' squidGuard - only with squid?
2 - or test this: http://youpfsense/sgerror.php?url=http://www.google.com

I have IE 6 for test. You have FFox?

dvserg

Firefox not parsed error code - ignored all header information :(
What different with IE?

"HTTP/1.0 404 not Found"
–------------
FireFox not have internal error pages (as IE)? Ok - i make this for F/F
Please check this:
http://diskatel.narod.ru/pfSense/packages/sgerror.php

ps On IE must continue showing 'friendly error-code IE pages'.

ciarocci

Any further news on this? I got lost towards the end of the conversation and couldn't help any further. Is there something I can do to help this get resolved? I'm very interested in the filtering (in fact that is why I chose pfSense as a firewall), and need to get it working. Thanks.

Chris

dvserg

replace /usr/local/www/sgerror.php to this
http://diskatel.narod.ru/pfSense/packages/sgerror.php
and check. I found and fix this trouble on FireFox.

ciarocci

Let me rephrase my question. Is there anything a person who doesn't know what you're talking about can do to help out? Basically, I have no clue how to do what you are asking. If you could guide me on how to replace that file I certainly will give it a try.

Chris

dvserg

Chris, if you have time - wait next update.
May-be this will 14-15 jan.
Thanks.

ciarocci

Will do. I thought if you hadn't already confirmed the problem was fixed I could help do that. But if you're already planning on the update because it's fixed I'll certainly wait until then. Thanks.

Chris

flachance

dvserg,

Just to let you know, your updated sgerror.php does not work for me on Firefox or IE. In fact, there is now nothing that gets displayed. The browser is just forever spinning its wheels and then eventually gives the following error message:

ERROR
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://192.168.1.1/sgerror.php 

The following error was encountered: 

Connection to 192.168.1.1 Failed 
The system returned: 

    (60) Operation timed outThe remote host or network may be down. Please try the request again. 

Your cache administrator is xxx@xxx. 

--------------------------------------------------------------------------------

Generated Sat, 12 Jan 2008 16:51:54 GMT by localhost (squid/2.6.STABLE5)

And of course, I forgot to make a backup of the file before I overwrote it with your version.

Based on the message above, I figured that since I modified my pfsense install to use port 8080 and HTTPS, SquidGuard cannot execute sgerror.php as it tries to do it over port 80. I'd say that something has to change in the source code of SquidGuard that manages the re-direct when a banned site is hit. The page displays if I use https://192.168.1.1:8080/sgerror.php.

Where is the source for SquidGuard if I wanted to take a look?

Thanks

dvserg

Current 'stable' source sgerror on:
http://www.pfsense.com/packages/config/squidGuard/sgerror.php
Now sources on www.pfsense.com can't work with non-80 port's pfSense
It will be in nearest update.
Anonce nearest update:

controls from page 'Sources' will adding to 'ACL', 'Sources' removed
changes for transparent-proxy and non-80 port support
more options in sgerror.php: blank page; blank image (for banners); fix+additional http code pages gen (3xx, 4xx, 5xx + self message);

Sources also in /usr/local/pkg/
File squidguard_configurator.inc

dvserg

Updated squidGuard sources
!Attention!
Before reInstallation - remember you Sources page content
This page elements moved to ACL and need apply you Sources defines to this page manually (i not make conversion).
–-
What new:

added error page generation, now you can use error code with Reasone message
example:
'[redirection field] 404 This page contains porn elements'
added non-80 GUI port supporting

Please, testing it.
Best regards
Serg.