SQUID + Filter + HAVP + LoadBalancing + FailOver

onkeldave83

YES I CAN!!!! I have it complete!

explain for all other:

i used shema 2 for havp:

Scheme: {inet}->[HAVP]->[Squid cache]->{clients}
Setup

Squid:

Disable upstream proxy (also will auto-disabled by HAVP)

HAVP:

Select Proxy mode field as Parent for Squid and Save
Scan Squid cache with Antivirus: File scanner for removing cached viruses.
If you are planning to use Transparent Proxy mode: Squid transparent on

(do not delete exists Squid Custom Options)

Scheme: {inet}->[Squid cache]->[HAVP]->{clients}
Setup

Squid:

Transparent Proxy off/unchecked
Disable X-Forward unchecked
Disable VIA unchecked

HAVP:

If you want transparent proxy, Select "Transparent" for HAVP Proxy Mode.
HAVP Parent proxy field (lan ip:squid port) ex. 192.168.0.1:3128
HAVP forwarded ip checked

with shema two of havp anti virus proxy you can realized
HAVP, Squid as Parent for Havp Proxy, Proxyfilter and Lightsquid (Proxy Reporter) with LoadBalancing and Failover Technique ;)

This is Godmode for every Admin^^

onkeldave83

i use havp transparent mode (you have to fill in squid as parent in config)
squid not transparent
i used the floating rule but only on wan1 with load-balancing and failover group but without port!!!!! when you used a port range (f.e. http) you cant download with fullspeed of loadbalancing (f.e. with jdownloader ;))
costum options in squid like: tcp_outgoing_address 127.0.0.1;!

x) the only disadvantage -> viruses are blocked but only when receive thorw client! you have to scan the cache of proxy sometimes ;)

when anyone have a question to realize this - ASK IN THIS THREAT

:)

hugo

Hello

i use havp transparent mode (you have to fill in squid as parent in config)

you set havp - proxy mode to "parent for squid" or to "transparent"

squid not transparent

you unchecked "transparent proxy" in Squid, right?

i used the floating rule but only on wan1 with load-balancing and failover group but without port!!!!! when you used a port range (f.e. http) you cant download with fullspeed of loadbalancing (f.e. with jdownloader ;))

what exactly you set,

costum options in squid like: tcp_outgoing_address 127.0.0.1;!

It's not working for me, when i try the eicar-test page

http://www.eicar.org/85-0-Download.html

the virus is not detected by HAVP. So the proxy seems to work but not ClamAV. If i use HAVP with the transparent mode the virus is detected but Load Balancing doesn't work.

onkeldave83

hello hugo,

i set havp as transparent! shema two ;)
squid not transparent!
you set in havp config squid as parent (f.e. 192.168.1.2:3128)

yes squid not transparent, but allow users check!

i set:

Apply the action immediately on match.
ON WAN INTERFACE
DIRECTION OUT
PROTOCOL TCP
(you can definie a destination port to http, but there is the problem that you only can use both gateways with port 80 - i dont use this! i want on all ports two gateways for downloading much faster)
Source Adress : Wan1 Adress
Advanced: GATEWAY : Your Balancing or Failover group

sry not costum options, in squid3 is it: "Integrations Options"
costum options are under this point ;)

f.e. with squidguard
tcp_outgoing_address 127.0.0.1;redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf;redirector_bypass on;redirect_children 3

WORK!!!
good luck, answer if you complete this setttings to success

hugo

Hello onkeldave83

i set:

Apply the action immediately on match.

ON WAN INTERFACE

DIRECTION OUT

PROTOCOL TCP
(you can definie a destination port to http, but there is the problem that you only can use both gateways with port 80 - i dont use this! i want on all ports two gateways for downloading much faster)

Source Adress : Wan1 Adress

Advanced: GATEWAY : Your Balancing or Failover group

this rule doesn't work for me. i don't know what`s problem. maybe i figured out later in a vm instance.

onkeldave83

good morning hugo,

you have set squid3 proxy on lan interface with Integrations Options ? (there is a little trick, you have to install first squid 2.7, delete squid 2.7 and install squid3 ;))
and have set havp as transparent with parent detials ?
add the floating rule on wan1 default on wan1 address and gateway options to loadbalancing ?
this have to work when we have the same versions ;)

eicar test worked, porn phrases are blocked in google search from squidguard and all things i want are chached :)

hugo

when i install squid3, i cant get it running

php: /pkg_edit.php: The command '/usr/local/sbin/squid' returned exit code '1', the output was '2012/04/25 10:35:34| Warning: empty ACL: acl throttle_exts urlpath_regex -i "/var/squid/acl/throttle_exts.acl" 2012/04/25 10:35:34| ERROR: Error Directory /usr/local/etc/squid/errors/German: (2) No such file or directory FATAL: Error Directory /usr/local/etc/squid/errors/German: (2) No such file or directory Squid Cache (Version 3.1.19): Terminated abnormally. CPU Usage: 0.068 seconds = 0.017 user + 0.051 sys Maximum Resident Size: 5036 KB Page faults with physical i/o: 0'

wow it will need some time to fix it. it's there a way to reset all squid configs?

onkeldave83

good morning hugo,
yes this is a problem!

delete both packages - squid 2 and squid3 in packagae manager in pfsense

first you install squid2
second you uninstall squid2
last you install squid3

this was my solution to get squid3 working ;)

or you can make factory defaults, but this is like format c: - its only for noobs ;)

hugo

Morning onkeldave83,

i fixed by creating the missing dir

/usr/local/etc/squid/errors/German

and now its work. After a reboot, i found the havp service stopped and new chown errors in the system log.

php: : The command 'chown -R -v havp /usr/local/etc/freshclam.conf' returned exit code '1', output: havp: Invalid argument'