Layer7
-
dagnabit!
I tried squid before but Lordy did it slow down the whole network.
Is there a reference on squid and pfsense? I could have easily bungled the whole thing.
-
http://www.squid-cache.org/
-
Pffft!
I just downloaded ISA off of MSDN, figuring I should use it. Now, here's the irony, it doesn't run on a 64bit computer. All our servers are 64bit computers.
Squid it is.
-
Just put it in a virtual pc running 32 bit… ;)
Pffft!
I just downloaded ISA off of MSDN, figuring I should use it. Now, here's the irony, it doesn't run on a 64bit computer. All our servers are 64bit computers.
Squid it is.
-
And another thing, I'm starting to hate today real bad, I installed squid about an hour ago, and now it won't uninstall. Tried going to the command line and typed "pkg_info" but its not there, meanwhile, looking at the list of installed packages, its there and will not go away. Rebooting is not helping.
Man, you're hating me now aren't you? :)
Thank you LOADS for putting up with me today man, real nice of you.
-
No worries :)
-
I tried squid before but Lordy did it slow down the whole network.
Is there a reference on squid and pfsense? I could have easily bungled the whole thing.
http://forum.pfsense.org/index.php/topic,7186.msg59302.html#msg59302
http://doc.pfsense.org/index.php/Squid_Package_TuningTry those. I've been quite happy with squid on 1.2.3, but it did require some tweaking as per above. I think some of the noted changes are automatically adjusted in 2.0.
-
Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?
Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?
-
Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?
You might try this one. It's not really in-depth, as I recall, and he's running it on Linux rather than pfsense, but it's the only thing I know of off hand.
http://www.anandtech.com/show/3715/family-proxy
-
Nice, thanks, but would you know of any decent "tutorials" on how to work with squid? Or should I stick to what's available on their site?
There is a lot of info here on the forum, and also on the doc wiki:
http://doc.pfsense.org/index.php/Setup_Squid_as_a_Transparent_Proxy
http://doc.pfsense.org/index.php/SquidGuard_packageBut they don't cover doing what you are asking originally
Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?
What you want to do, route traffic based on hostname, is best accomplished by a lightweight reverse proxy of some kind, not necessarily squid. There are packages for haproxy, mod_security, and varnish, I believe they can all do this.
-
Layer7 is application layer….not only for routing, but defending of unwanted traffic and hacking....That is why it is so effective!
-
That is why it is so effective!
I do not agree with you but hey anybody buys what fits him.
-
That was a very informative post…:(
Could you give examples of WHY NOT?
@ermal:
That is why it is so effective!
I do not agree with you but hey anybody buys what fits him.
-
Also, a question that is begging to be answered now is whether anyone knows if PFsense 2.0 is coming out with an answer to my predicament in its release build?
What you want to do, route traffic based on hostname, is best accomplished by a lightweight reverse proxy of some kind, not necessarily squid. There are packages for haproxy, mod_security, and varnish, I believe they can all do this.
Which in a roundabout way says that PFsense will not be implementing something like this, right? : ;)
Well, I've decided to take a second swing at squid since I don't want to mess up the system by installing something else from the command line. Call me a scaredy-cat.
Off topic:
Excellent job on the guide. Its sitting right in front of me on the desk :) -
True L7 is what could make pFSense into a full blown firewall…..
-
Here's hoping because I really hate ISA.
-
ISA is one of the best security gateways around. But its a pain to setup and master…..because it is so advanced. But if you have set it up correctly, you would eliminate MSN bots, spyware and viruses coming in via the application layer...Because it goes thorugh the packet coming in, instead of just routing it. PF acts as a frontend for me, with several ISA's running behind handling different sorts of traffic. Web is one ISA, mail is another....asf. Very effective and it minimizes the attacksurface and downtime.
-
No arguing how good ISA is, I just hate it.
-
I know what you mean :o
-
OK, I'm back [queue ta da].
I've been bashing my head on this for too long.
I've setup ISA, now how the heck does it get configured as a reverse proxy without being a firewall? Also, how the heck do I forward queries from PFsense to ISA for all traffic coming in from the WAN?
I thank you for putting up with me!
