Squid3 - New GUI with sync, normal and reverse proxy
-
Other thread is probably better, I lost track of which thread it was and there were similar posts in each, other has a more accurate subject and relevance.
-
Can anyone provide some help with the Reverse Proxy?
My posts might have been overlooked in a couple pages back.
Does anyone else have the Reverse Proxy working?
-
nutt318 - perhaps you should start a new thread with a separate subject, it will get more attention that way.
-
Hi :), been testing squid3 on embedded and full version 2.0.1 and I noticed its not caching items, /var/squid/cache dir remains the same size (works fine on full but not on nanobsd)
BTW, I think COSS filesystem is very useful, specially for SSD/flash storage and embedded in general, lowers wear on cells, its best used mixed with AUFS, with COSS caching smaller objects and the rest for AUFS.
Thank you :)
-
Hello,
and first thanks for the great work on this mandatory feature in pfsense (also mandatory in serious network :p)It seems however that we are plenty to have the problem that the reverse setup of squid send traffic always to the default site defined on general tab (https talking…)
I've tried with empty and * on URI field, no luck.My setup is:
WORLD ---- PFSENSE/SQUID ---- extranet1.mydomain.com
|
-- extranet2.mydomain.comI've also tried to replace url_regex with dstdomain, squid won't start.
In the log i've:
… X.X.X.X TCP_MISS/404 588 GET https://extranet2.mydomain.com/ - FIRST_UP_PARENT/Extranet2 text/htmlThe only thing i could do to make it work is to change default site to send traffic to other host (so i think firewalling and basic syntax for my squid setup is OK)
Any ideas ?
Thanks again for the all work !!!
-
I did some update to the package without version change, please try to reinstall or uninstall/reinstall and test again.
att,
Marcello Coutinho -
i want work on squidguard sync too .. can you send me way to do this …like squid ?
-
i want work on squidguard sync too .. can you send me way to do this …like squid ?
You will need to code it on squidguard inc file and create/or use squid_sync xml file.
If you don't know how pfsense gui works, it will be not that easy.
take a look on ipguard package files, it's a small package with sync code.
att,
Marcello Coutinho -
obrigado Marcello..
onde vc está no Br ?
-
-
seems that squid doesn't accept any entry in "custom options, i get errors:
php: /pkg_edit.php: The command '/usr/local/sbin/squid -k reconfigure -f /usr/local/etc/squid/squid.conf' returned exit code '1', the output was 'FATAL: Bungled squid.conf line 83: http_port 8080 transparent; Squid Cache (Version 3.1.20): Terminated abnormally. CPU Usage: 0.018 seconds = 0.009 user + 0.009 sys Maximum Resident Size: 5176 KB Page faults with physical i/o: 0'
I tried with this setup here: http://forum.pfsense.org/index.php/topic,42413.0.html.
I stripped the ident-entries, because they don't work too :(
-
seems that squid doesn't accept any entry in "custom options, i get errors:
the output was 'FATAL: Bungled squid.conf line 83: http_port 8080 transparent;Is it your custom option? http_port 8080 transparent?
-
yes it is. But other custom options generate the same kind of errors, so i suppose, custom options don't work here. :(
-
-
None of any entry works. All entries result in a "bungled squid config". It doesnt work. :(
-
what do you have on squid.conf file after applying your config?
The squid gui includes http_port config.
-
Here we go:
# Do not edit manually ! http_port 192.168.1.1:8080 icp_port 7 pid_filename /var/run/squid.pid cache_effective_user proxy cache_effective_group proxy error_default_language de icon_directory /usr/local/etc/squid/icons visible_hostname pfsense cache_mgr hier@da.de access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log none sslcrtd_children 0 logfile_rotate 0 shutdown_lifetime 3 seconds uri_whitespace encode acl dynamic urlpath_regex cgi-bin \? cache deny dynamic cache_mem 8 MB maximum_object_size_in_memory 32 KB memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA cache_dir ufs /var/squid/cache 1000000 16 256 minimum_object_size 0 KB maximum_object_size 4 KB offline_mode offcache_swap_low 90 cache_swap_high 95 # No redirector configured #Remote proxies # Setup some default acls acl allsrc src all acl localhost src 127.0.0.1/32 acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 1025-65535 acl sslports port 443 563 acl manager proto cache_object acl purge method PURGE acl connect method CONNECT acl allowed_subnets src 192.168.1.0/24 acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl" http_access allow manager localhost # Allow external cache managers acl ext_manager src 127.0.0.1 acl ext_manager src 192.168.1.1 acl ext_manager src http_access allow manager ext_manager http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports # Always allow localhost connections http_access allow localhost request_body_max_size 0 KB delay_pools 1 delay_class 1 2 delay_parameters 1 -1/-1 -1/-1 delay_initial_bucket_level 100 delay_access 1 allow allsrc # Reverse Proxy settings # Package Integration redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf redirector_bypass on redirect_children 3 # Custom options # http_port 8080 intercept; ident_lookup_access allow all; ident_timeout 3 seconds; # Always allow access to whitelist domains http_access allow whitelist # Setup allowed acls http_access allow allowed_subnets # Default block all to be sure http_access deny allsrc
and here the log-entry:
php: /pkg_edit.php: The command '/usr/local/sbin/squid -k reconfigure -f /usr/local/etc/squid/squid.conf' returned exit code '1', the output was '2012/07/18 16:32:18| aclParseAclList: ACL name 'all;' not found. FATAL: Bungled squid.conf line 84: ident_lookup_access allow all; Squid Cache (Version 3.1.20): Terminated abnormally. CPU Usage: 0.018 seconds = 0.018 user + 0.000 sys Maximum Resident Size: 4112 KB Page faults with physical i/o: 0'
Do you need more info?
-
-
duh! That was it. Thx for your help!!
-
Hello, just reinstalled squid3 and it is still not caching. logs give TCP_MISS/200
thank you
-
my HD died in the router. on a fresh reinstall i can install the squid3 package but i get this in the system log.
php: /pkg_mgr_install.php: XML error: Mismatched tag at line 348 in /usr/local/pkg/squid.xml
the package doesnt have any menu item options either.
corrupt package?
-
the line in the xml refers to :
<default_value>en</default_value>
as part of
<field><fielddescr>Language</fielddescr>
<fieldname>error_language</fieldname>
<description>Select the language in which the proxy server will display error messages to users.</description>
<type>select</type>
<default_value>en</default_value></field> -
a pull request has been submited by phil that should fix that. We are waiting on a dev to pull in that request.
-
the line in the xml refers to :
<default_value>en</default_value>
It's fixed now, wait 15 minutes and reinstall
att,
Marcello Coutinho -
Thanks!
-
Apologies to all - my little "fix" for the default language had a bit of extra cut-and-paste somehow. I noticed it soon after it got committed, but unfortunately it took quite a while for anyone with the necessary privs to commit the better version. I'll stare a lot harder at seemingly mindless fixes in future!
-
Apologies to all - my little "fix" for the default language had a bit of extra cut-and-paste somehow. I noticed it soon after it got committed, but unfortunately it took quite a while for anyone with the necessary privs to commit the better version. I'll stare a lot harder at seemingly mindless fixes in future!
Its working now. Thank you all for your help. ;D
-
I would like to report a bug in the Squid Reverse Proxy. Under the HTTPS settings the default port used is 443 if you leave the feild empty. However if you look at squid.conf in /usr/local/etc/squid the listening port is still 80. So you have to manually put in 443 for the listening port.
Even though I found this bug I'm still having issues with getting the HTTPS reverse proxy working correctly.
I'm getting a squid error page saying Access Denied. Access control configuration prevents your request from being allowed at this time.
Not sure of the problem but it looks like others are having problems with the reverse proxy on HTTPS as well.
http://forum.pfsense.org/index.php/topic,51945.0.html -
Folks, is there any reason why in proxy_monitor.sh you're using a series of pipes (btw both awk seem redundant)
NUM_PROCS=`ps auxw | grep "[s]quid -D"|awk '{print $2}'| wc -l | awk '{ print $1 }'` rather than a simpler pgrep -f "process" | wc -l ?[/s]
-
Please re-install as I have modified the code using the pgrep a couple of days ago.
-
Please re-install as I have modified the code using the pgrep a couple of days ago.
Hi, I'm not running squid on pfsense, but I just happened to notice the commits at:
https://github.com/bsdperimeter/pfsense-packages/blob/master/config/squid3/proxy_monitor.sh
(which is the latest code afaik) -
sorry .. looking at the wrong line of code. That package (squid3) is for 1.2.3. The one that is on 2.1 and I think 2.0 is under the directory squid-reverse. So, you are talking about making it:
NUM_PROCS=`pgrep -f "squid -f" | wc -l | awk '{ print $1 }'`
The awk has to be in there to format the number returned properly as output without the awk yields spaces or tabs before the number returned.
or evenNUM_PROCS=`ps auxw | grep -c "[s]quid -f"' This has only 1 pipe like your example.[/s]
-
@marcelloc - I corrected the conf_mount_rw and conf_mount_ro calls so that after a squid3 installation on nanobsd-like systems the filesystem ends up read-only. (Previously it was accidentally left read-write at the end of the install).
Now this message appears in /tmp/PHP_errors.log
[03-Aug-2012 04:16:47 UTC] PHP Warning: copy(/root/2.1-BETA0.captiveportal.inc.backup): failed to open stream: Read-only file system in /usr/local/pkg/squid.inc on line 1640
This is the code:
if (!file_exists('/root/'.$pfsense_version.'.captiveportal.inc.backup')) { copy ($cp_file,'/root/'.$pfsense_version.'.captiveportal.inc.backup'); } if($found_rule > 0){ file_put_contents($cp_file,$new_cp_inc, LOCK_EX); }
I am not sure what you want to do, perhaps put the backup in /tmp? (lost after a reboot on nanobsd), perhaps also only do the backup if a rule is found? Maybe something like this:
if($found_rule > 0){ if (!file_exists('/tmp/'.$pfsense_version.'.captiveportal.inc.backup')) { copy ($cp_file,'/tmp/'.$pfsense_version.'.captiveportal.inc.backup'); } file_put_contents($cp_file,$new_cp_inc, LOCK_EX); }
This code is not in the older squid(2), so this problem is just in squid3.
-
I am not sure what you want to do, perhaps put the backup in /tmp? (lost after a reboot on nanobsd), perhaps also only do the backup if a rule is found? Maybe something like this:
well, it will need a mount_rw before this test and a mount_ro after.
-
Hi,
i'm using without any probs the squid3 (3.1.20 pkg 2.0.5_3) package on pfsense 2.0.1. thanks for this.
is it possible to use squid on 2 diffent ports on the same ip. for now it's '8080', additionally i want to use '3128'. 8080 should use the wan1 and 3128 should use the wan2 connection. is this in any way possible?
greets
-
you can try this config on custom options.
find the listening args you need and place there.
-
I don't understand what the point is of having XMLRPC sync without being able to listen on a CARP IP address.
- can anyone tell me if there is a way to get this pkg to listen on a CARP IP (or even just listen on all interfaces!), and
- what is an example use case for synchronized configs otherwise?
(Also see http://redmine.pfsense.org/issues/2591 and http://redmine.pfsense.org/issues/2592.)
Thanks,
-Adam -
Unless the cache and connection state are shared between squid instances, you don't want it binding on a CARP VIP. It makes little sense to have the traffic leave from a shared IP and shared pf states when the actual connections in squid are independent, even if the config is synchronized.
The point of syncing the config is so the slave can take over, and it can, you just can't seamlessly fail over 100% in squid. Even if the states were to sync over it doesn't matter, the squid process itself would have no knowledge of the connection.
-
- can anyone tell me if there is a way to get this pkg to listen on a CARP IP (or even just listen on all interfaces!), and
Listen squid on loopback(lo0) and create nat rules from carp address to 127.0.0.1
2.1 gui framework has the listen all as well listen on virtual ips, so squid3 on pfsense 2.1 will have this option and no need to workaround with nats.
-
Unless the cache and connection state are shared between squid instances, you don't want it binding on a CARP VIP. It makes little sense to have the traffic leave from a shared IP and shared pf states when the actual connections in squid are independent, even if the config is synchronized.
The point of syncing the config is so the slave can take over, and it can, you just can't seamlessly fail over 100% in squid. Even if the states were to sync over it doesn't matter, the squid process itself would have no knowledge of the connection.I don't particularly care about seamless failover, I just want to avoid using PAC. If I have a redundant pair of firewalls, I use the CARP VIP as my default gateway from the inside. The way it's set up right now, I have to point all the clients at one firewall or the other's physical (LAN) IP address. So if that firewall dies, I lose the ability to browse the web without manually reconfiguring each client…? Whereas if squid was bound to the CARP VIP, any in-flight HTTP transactions would fail, but at least I wouldn't have to go around and reconfigure every client. Is there some other mechanism I don't know about?
Listen squid on loopback(lo0) and create nat rules from carp address to 127.0.0.1
2.1 gui framework has the listen all as well listen on virtual ips, so squid3 on pfsense 2.1 will have this option and no need to workaround with nats.That approach hadn't occurred to me - trying it now to see if it works, but I don't expect problems.
However, as to the second point: I am using 2.1-BETA, and I do not see any such option. ("squid3" package, version "beta 3.1.20 pkg 2.0.5_3")-Adam