Squid3 - New GUI with sync, normal and reverse proxy

marcelloc

seems that squid doesn't accept any entry in "custom options, i get errors:
the output was 'FATAL: Bungled squid.conf line 83: http_port 8080 transparent;

Is it your custom option? http_port 8080 transparent?

_igor_

yes it is. But other custom options generate the same kind of errors, so i suppose, custom options don't work here. :(

marcelloc

@_igor_:

yes it is.

try ** http_port 8080 intercept** on squid 3.1

_igor_

None of any entry works. All entries result in a "bungled squid config". It doesnt work. :(

marcelloc

what do you have on squid.conf file after applying your config?

The squid gui includes http_port config.

_igor_

Here we go:

# Do not edit manually !
http_port 192.168.1.1:8080
icp_port 7

pid_filename /var/run/squid.pid
cache_effective_user proxy
cache_effective_group proxy
error_default_language de
icon_directory /usr/local/etc/squid/icons
visible_hostname pfsense
cache_mgr hier@da.de
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
sslcrtd_children 0
logfile_rotate 0
shutdown_lifetime 3 seconds
uri_whitespace encode

acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic
cache_mem 8 MB
maximum_object_size_in_memory 32 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir ufs /var/squid/cache 1000000 16 256
minimum_object_size 0 KB
maximum_object_size 4 KB
offline_mode offcache_swap_low 90
cache_swap_high 95

# No redirector configured

#Remote proxies

# Setup some default acls
acl allsrc src all
acl localhost src 127.0.0.1/32
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535 
acl sslports port 443 563  
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT

acl allowed_subnets src 192.168.1.0/24
acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
http_access allow manager localhost

# Allow external cache managers
acl ext_manager src 127.0.0.1
acl ext_manager src 192.168.1.1
acl ext_manager src 
http_access allow manager ext_manager

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings

# Package Integration
redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
redirector_bypass on
redirect_children 3

# Custom options
# http_port 8080 intercept;
ident_lookup_access allow all;
ident_timeout 3 seconds;

# Always allow access to whitelist domains
http_access allow whitelist
# Setup allowed acls
http_access allow allowed_subnets
# Default block all to be sure
http_access deny allsrc

and here the log-entry:

php: /pkg_edit.php: The command '/usr/local/sbin/squid -k reconfigure -f /usr/local/etc/squid/squid.conf' returned exit code '1', the output was '2012/07/18 16:32:18| aclParseAclList: ACL name 'all;' not found. FATAL: Bungled squid.conf line 84: ident_lookup_access allow all; Squid Cache (Version 3.1.20): Terminated abnormally. CPU Usage: 0.018 seconds = 0.018 user + 0.000 sys Maximum Resident Size: 4112 KB Page faults with physical i/o: 0'

Do you need more info?

marcelloc

Custom options

http_port 8080 intercept;

ident_lookup_access allow all;
ident_timeout 3 seconds;

Note that only your custom options has ";" at the end.

Remove it and test again.

_igor_

duh! That was it. Thx for your help!!

nesense

Hello, just reinstalled squid3 and it is still not caching. logs give TCP_MISS/200

thank you

al_reidy

my HD died in the router. on a fresh reinstall i can install the squid3 package but i get this in the system log.

php: /pkg_mgr_install.php: XML error: Mismatched tag at line 348 in /usr/local/pkg/squid.xml

the package doesnt have any menu item options either.

corrupt package?

al_reidy

the line in the xml refers to :

<default_value>en</default_value>

as part of

<field><fielddescr>Language</fielddescr>
<fieldname>error_language</fieldname>
<description>Select the language in which the proxy server will display error messages to users.</description>
<type>select</type>
<default_value>en</default_value></field>

podilarius

a pull request has been submited by phil that should fix that. We are waiting on a dev to pull in that request.

marcelloc

@al_reidy:

the line in the xml refers to :

<default_value>en</default_value>

It's fixed now, wait 15 minutes and reinstall

att,
Marcello Coutinho

podilarius

Thanks!

phil.davis

Apologies to all - my little "fix" for the default language had a bit of extra cut-and-paste somehow. I noticed it soon after it got committed, but unfortunately it took quite a while for anyone with the necessary privs to commit the better version. I'll stare a lot harder at seemingly mindless fixes in future!

al_reidy

@phil.davis:

Apologies to all - my little "fix" for the default language had a bit of extra cut-and-paste somehow. I noticed it soon after it got committed, but unfortunately it took quite a while for anyone with the necessary privs to commit the better version. I'll stare a lot harder at seemingly mindless fixes in future!

Its working now. Thank you all for your help. ;D

nutt318

I would like to report a bug in the Squid Reverse Proxy. Under the HTTPS settings the default port used is 443 if you leave the feild empty. However if you look at squid.conf in /usr/local/etc/squid the listening port is still 80. So you have to manually put in 443 for the listening port.

Even though I found this bug I'm still having issues with getting the HTTPS reverse proxy working correctly.

I'm getting a squid error page saying Access Denied. Access control configuration prevents your request from being allowed at this time.

Not sure of the problem but it looks like others are having problems with the reverse proxy on HTTPS as well.
http://forum.pfsense.org/index.php/topic,51945.0.html

dhatz

Folks, is there any reason why in proxy_monitor.sh you're using a series of pipes (btw both awk seem redundant)

NUM_PROCS=`ps auxw | grep "[s]quid -D"|awk '{print $2}'| wc -l | awk '{ print $1 }'`

rather than a simpler pgrep -f "process" | wc -l ?[/s]

podilarius

Please re-install as I have modified the code using the pgrep a couple of days ago.

dhatz

@podilarius:

Please re-install as I have modified the code using the pgrep a couple of days ago.

Hi, I'm not running squid on pfsense, but I just happened to notice the commits at:

https://github.com/bsdperimeter/pfsense-packages/blob/master/config/squid3/proxy_monitor.sh
(which is the latest code afaik)