Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Alternative for MS TMG 2010 = pfSense ???

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    90 Posts 9 Posters 61.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      canefield
      last edited by

      Hi,

      I understand it is a 'hell of a job' to make somekind of instructions. The thing is we as IT want to implement a solution based on Linux. Then convince other staff-members and management to switch to a stable and proper security system, then that is already inplace.
      So at first we cannot effort commercial support.

      Some of you that have time, please help us making a better world with pfSense.

      KR,
      Canefield

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @canefield:

        The thing is we as IT want to implement a solution based on Linux.

        Pfsense is based on FreeBSD, so it's a Unix/BSD solution.  ;)

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • T
          toomeek
          last edited by

          Why just don't use every possible solution?
          pfSense -> TMG -> network
          ?
          One time I was at a conference on advanced applications in the server environment they recommended "use every possible solution, there is no obstacle to cooperate Linux/Unix/Windows together to achieve same goal".

          1 Reply Last reply Reply Quote 0
          • D
            dhatz
            last edited by

            It really depends on scale.

            TMG offers you a tightly integrated system, which can be very convenient if you're an all-Microsoft shop, and requires only very basic knowledge to get running. On the other hand, e.g. varnish running on Linux/BSD is primarily aimed to high-performance setups, does a great deal more, but has a much steeper learning curve.

            1 Reply Last reply Reply Quote 0
            • C
              canefield
              last edited by

              Hey all,

              Could somebody give me any example? I suppose people already worked with Squid-Reverse or Varnish proxy isn't it?

              Thanks in advance,
              Canefield

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                What point on varnish config did You got working?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • C
                  canefield
                  last edited by

                  Marcello,

                  Also Varnish didn't work for me! Based on LB and host-header as well as solo host-header I didn't could get it work. But as far I understand from you it is better to use Squid isn't?

                  Please provide me with some config that works and how to implement that.

                  Thanks a lot,
                  Canefield

                  1 Reply Last reply Reply Quote 0
                  • C
                    canefield
                    last edited by

                    Anybody?

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      Canefield,

                      I'll publish this week an updated GUI for squid3/squid-reverse with reverse proxy resigned.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        canefield,

                        I've just published squid3 with better reverse gui, take a look and see if you can configure your server with this package

                        squid3 - New GUI with sync, normal and reverse proxy

                        att,
                        Marcello Coutinho

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • C
                          canefield
                          last edited by

                          Marcello,

                          First of all thanks for all your precious time and effort so far.

                          I've still got problems configuring Squid 3 as a reverse proxy. Somehow I can't manage it to work properly.
                          As you illustrated in the forst postings I did exactly the same and added NAT and Firewall rules. I'm using port 8080 and 8443.

                          How come…?!?!

                          Thanks a lot,
                          Canefield

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @canefield:

                            As you illustrated in the forst postings I did exactly the same and added NAT and Firewall rules. I'm using port 8080 and 8443.

                            When using proxy, you do not need nat, just firewall rules on wan allowing access to wan address at port 8080/8443.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • C
                              canefield
                              last edited by

                              Marcello,

                              I've now followed your published configuration; so I started over again. So I installed Squid3 went to Reverse Proxy and added everything exactly as you posted.

                              Then I made two rules in the WAN (Firewall->Rules->WAN) to allow listening on port 80 and 443.
                              My intention is to publish several sites/domains. First of all I want to publish the CAS-servers; so the Exchange webmail services (https://webmail.domain.com/owa and all other related URLs (autodiscover, rpc, etc.)).
                              All servers are configured on the default ports.

                              Furthermore, do I have to configure an alternative port for the webGUI? I'm now accessing it internally via https.

                              You probably see my configuration mis-match.
                              See the pictures as attached.

                              Thanks already,
                              Canefield

                              pfs-rp.jpg_thumb
                              pfs-rp.jpg

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                @canefield:

                                Furthermore, do I have to configure an alternative port for the webGUI? I'm now accessing it internally via https.

                                Yes, you need to change pfsense gui port to other then 443.

                                Your wan firewall rule should be
                                source any
                                source port any
                                destination wan address
                                destination port 80

                                source any
                                source port any
                                destination wan address
                                destination port 443

                                on system -> advanced, change pfsense prot to other then 443 and disable web gui redirect rule

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • C
                                  canefield
                                  last edited by

                                  Marcello,

                                  I did everything you mentioned but without any result.
                                  So my firewall rules are been changed and the webGUI to 9443.

                                  Network
                                  LAN; IP: 192.168.120.254 /24
                                  WAN; IP: 192.168.2.254 /24, GW: 192.168.2.253 (DMZ)

                                  Reverse Proxy
                                  If I understand it correctly you enable listening on port 80 and/or 443 via tab 'General'. So with the firewall rule all requests are allowed and transfered to the WAN address (192.168.2.254 in my case) and Squid3 (reverse) will apply to those. Furthermore in the tab 'Web Servers' I configure all my internal web servers and related. As I make up out of your example my internal web server is listening to port 8443, correct? In my case my servers are listening to all default ports, so 80 and 443. Should I change here the port from 8443 to 443? Then in the tab 'Mappings' I can combine web servers in groups and select all needed. Right? Than one thing I do not understand is the URIs. What does this do and how to configure. You gave an example of *;<emtpy>, but what can I do with it?

                                  Could you give me an working example of let's say four servers; two listening on port 443 and two on port 80. The first two (listening on port 443) are Exchange servers (owa, autodiscover, outlook anywhere, mail tips, etc.) and the other two (listening on port 80) just hosting plaintext website. The first one 'www.domain.com' and the second one 'extranet.example.com'. No screenshots are needed, in text is fine too. You ofcource may decide, but I thougt screenshots will cost you a lot of your precious time. Thanks for all the time and effort already.

                                  LAN-network
                                  From my pfSense I can't resolve internal DNS names. Where to configure internal DNS servers per network/adapter? I will have several more adapters in place with all another subnet and servers.

                                  Many thanks,
                                  Canefield</emtpy>

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    canefield,

                                    Try first one server before you reach full config.

                                    @canefield:

                                    Should I change here the port from 8443 to 443?

                                    Yes. it must be your web server listening port

                                    @canefield:

                                    Then in the tab 'Mappings' I can combine web servers in groups and select all needed. Right?

                                    yes, show sites/urls you need to balance/publish and then select webservers that will receive this requests

                                    @canefield:

                                    Than one thing I do not understand is the URIs. What does this do and how to configure. You gave an example of *;<emtpy>, but what can I do with it?</emtpy>

                                    • means what path of this site you will forward to internal host, * means all urls/dirs.
                                      the <empty value="">must be a site fqdn when you have multiple websites do forward.
                                      example:
                                    • www.mydomain.com
                                    • forum.mydomain.com

                                    @canefield:

                                    Could you give me an working example of let's say four servers; two listening on port 443 and two on port 80. The first two (listening on port 443) are Exchange servers (owa, autodiscover, outlook anywhere, mail tips, etc.) and the other two (listening on port 80) just hosting plaintext website. The first one 'www.domain.com' and the second one 'extranet.example.com'. No screenshots are needed, in text is fine too. You ofcource may decide, but I thougt screenshots will cost you a lot of your precious time. Thanks for all the time and effort already.

                                    The code from squid-reverse has options for only one owa server, I did not had time to test it with two owas.
                                    I don't have a working example with multiple hosts with squid3, just that screenshot you saw.

                                    @canefield:

                                    LAN-network
                                    From my pfSense I can't resolve internal DNS names. Where to configure internal DNS servers per network/adapter? I will have several more adapters in place with all another subnet and servers.

                                    dns server is used by pfsense, not by interface. You need one dns server that can do internal and external name resolution.
                                    To clarify this idea, internet users will dnslookup your external dns to www.mydomain.com. when this package arrives on your pfsense, it will do another dnslookup to find your internal dns if you specified a hostname instead of an ip address.</empty>

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      canefield
                                      last edited by

                                      Marcello,

                                      Thanks again…I'm trying to configure it right now. As there some kind of 'live' log to see if the traffic is accepted and past further on?
                                      I'm looking at 'Status->System Logs->Firewall', but can't see a thing regarding my request on port 443.

                                      What I have done first is entered the IP in the OWA-part of the reverse proxy, but without any result so far.

                                      Thanks,
                                      Canefield

                                      Edit: I've did your config just now withour result...WHY?!?!

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        @canefield:

                                        Thanks again…I'm trying to configure it right now. As there some kind of 'live' log to see if the traffic is accepted and past further on?
                                        I'm looking at 'Status->System Logs->Firewall', but can't see a thing regarding my request on port 443.

                                        If you enabled squid logs, it will be on /var/logs/squid/access.log

                                        using ssh to connect to pfsense(system-> advanced) you can use
                                        tail -f /var/logs/squid/access.log

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          canefield
                                          last edited by

                                          Marcello,

                                          I've did your config just now withour result…WHY?!?!

                                          Thx,
                                          Canefield

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @canefield:

                                            I've did your config just now withour result…WHY?!?!

                                            I have no idea :(, I've published the screenshots and the package just after testing and making sure it was working.

                                            You will need to improve your skills with opensource and start using console/ssh as well tcpdump. This way you can see package flow and log files.

                                            The screenshots shows pfsense published on 8443 and squid reverse-proxying it on wan at port 443.

                                            att,
                                            Marcello Coutinho

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.