Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Layer7

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    48 Posts 8 Posters 18.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Steve Mustafa
      last edited by

      Yes they are. Does that carry any significance?

      [edit]
      Silly me, of course it does!
      How should I do this?

      1 Reply Last reply Reply Quote 0
      • S
        Supermule Banned
        last edited by

        Then how do you plan to route the traffic when it enters the PFSense???

        Edit: Ok….then PFSense would not be able to handle the traffic.....it has to be header based routing and that takes L7 capability.

        Squid could be an option for solving this, but I am not that much into Squid.

        I use ISAserver from Microsoft to handle my L7 traffic. I only use PFSense as a frontend....

        But this will change the moment PF can handle L7 and publish all what is behind ....

        @Steve:

        Yes they are. Does that carry any significance?

        1 Reply Last reply Reply Quote 0
        • S
          Steve Mustafa
          last edited by

          I'm realizing just how stupid I can be by the second.

          I don't want to have to do port forwarding but I will if I must.  Suggestions?

          [Edit]

          Aha, so I was given good advice (re L7)!

          Well, then my question is now whether PFsense's L7 implementation (which I currently see as "block" only) will encompass this?

          1 Reply Last reply Reply Quote 0
          • S
            Supermule Banned
            last edited by

            Thats the only current way to do it at the moment.

            @Steve:

            I'm realizing just how stupid I can be by the second.

            I don't want to have to do port forwarding but I will if I must.  Suggestions?

            1 Reply Last reply Reply Quote 0
            • S
              Steve Mustafa
              last edited by

              dagnabit!

              I tried squid before but Lordy did it slow down the whole network.

              Is there a reference on squid and pfsense? I could have easily bungled the whole thing.

              1 Reply Last reply Reply Quote 0
              • S
                Supermule Banned
                last edited by

                http://www.squid-cache.org/

                1 Reply Last reply Reply Quote 0
                • S
                  Steve Mustafa
                  last edited by

                  Pffft!

                  I just downloaded ISA off of MSDN, figuring I should use it. Now, here's the irony, it doesn't run on a 64bit computer. All our servers are 64bit computers.

                  Squid it is.

                  1 Reply Last reply Reply Quote 0
                  • S
                    Supermule Banned
                    last edited by

                    Just put it in a virtual pc running 32 bit… ;)

                    @Steve:

                    Pffft!

                    I just downloaded ISA off of MSDN, figuring I should use it. Now, here's the irony, it doesn't run on a 64bit computer. All our servers are 64bit computers.

                    Squid it is.

                    1 Reply Last reply Reply Quote 0
                    • S
                      Steve Mustafa
                      last edited by

                      And another thing, I'm starting to hate today real bad, I installed squid about an hour ago, and now it won't uninstall.  Tried going to the command line and typed "pkg_info" but its not there, meanwhile, looking at the list of installed packages, its there and will not go away. Rebooting is not helping.

                      Man, you're hating me now aren't you? :)

                      Thank you LOADS for putting up with me today man, real nice of you.

                      1 Reply Last reply Reply Quote 0
                      • S
                        Supermule Banned
                        last edited by

                        No worries :)

                        1 Reply Last reply Reply Quote 0
                        • C
                          clarknova
                          last edited by

                          @Steve:

                          I tried squid before but Lordy did it slow down the whole network.

                          Is there a reference on squid and pfsense? I could have easily bungled the whole thing.

                          http://forum.pfsense.org/index.php/topic,7186.msg59302.html#msg59302
                          http://doc.pfsense.org/index.php/Squid_Package_Tuning

                          Try those. I've been quite happy with squid on 1.2.3, but it did require some tweaking as per above. I think some of the noted changes are automatically adjusted in 2.0.

                          db

                          1 Reply Last reply Reply Quote 0
                          • S
                            Steve Mustafa
                            last edited by

                            Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?

                            Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?

                            1 Reply Last reply Reply Quote 0
                            • C
                              clarknova
                              last edited by

                              @Steve:

                              Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?

                              You might try this one. It's not really in-depth, as I recall, and he's running it on Linux rather than pfsense, but it's the only thing I know of off hand.

                              http://www.anandtech.com/show/3715/family-proxy

                              db

                              1 Reply Last reply Reply Quote 0
                              • jimpJ
                                jimp Rebel Alliance Developer Netgate
                                last edited by

                                @Steve:

                                Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?

                                There is a lot of info here on the forum, and also on the doc wiki:
                                http://doc.pfsense.org/index.php/Setup_Squid_as_a_Transparent_Proxy
                                http://doc.pfsense.org/index.php/SquidGuard_package

                                But they don't cover doing what you are asking originally

                                @Steve:

                                Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?

                                What you want to do, route traffic based on hostname, is best accomplished by a lightweight reverse proxy of some kind, not necessarily squid. There are packages for haproxy, mod_security, and varnish, I believe they can all do this.

                                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                Need help fast? Netgate Global Support!

                                Do not Chat/PM for help!

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Supermule Banned
                                  last edited by

                                  Layer7 is application layer….not only for routing, but defending of unwanted traffic and hacking....That is why it is so effective!

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    eri--
                                    last edited by

                                    That is why it is so effective!

                                    I do not agree with you but hey anybody buys what fits him.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by

                                      That was a very informative post…:(

                                      Could you give examples of WHY NOT?

                                      @ermal:

                                      That is why it is so effective!

                                      I do not agree with you but hey anybody buys what fits him.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        Steve Mustafa
                                        last edited by

                                        @Steve:

                                        Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?

                                        What you want to do, route traffic based on hostname, is best accomplished by a lightweight reverse proxy of some kind, not necessarily squid. There are packages for haproxy, mod_security, and varnish, I believe they can all do this.

                                        Which in a roundabout way says that PFsense will not be implementing something like this, right? : ;)

                                        Well, I've decided to take a second swing at squid since I don't want to mess up the system by installing something else from the command line.  Call me a scaredy-cat.

                                        Off topic:
                                        Excellent job on the guide. Its sitting right in front of me on the desk :)

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Supermule Banned
                                          last edited by

                                          True L7 is what could make pFSense into a full blown firewall…..

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            Steve Mustafa
                                            last edited by

                                            Here's hoping because I really hate ISA.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.