Squid 3 reverse proxy - HTTPS==>HTTP fails

Gob

I have just noticed that tab after upgrading to the latest version of squid.
I don't really understand how that will help me in this scenario however.

Is the redirect doing a url rewrite?

marcelloc

Take a look on this topic.
http://forum.pfsense.org/index.php/topic,51812.msg315017.html#msg315017

Gob

ah, right. I have just tried the redirect solution.
Unfortunately the redirect rewrites the address in the browser, so if I have this redirect rule:

https://www.externaldomain.com redirecting to http://internaldomain.local

from outside the network I enter https://www.externaldomain.com into my browser and the browser address changes to http://internaldomain.local which does not resolve nor is accessible from outside the network.

My main requirement for the reverse proxy is to implement a mobile device management platform with multiple exchange servers.
The iOS mobile devices will only work with a HTTPS connection but the ActiveSync proxy behind pfSense that distributes the traffic to the various exchange servers will only work with HTTP.

This diagram hopefully explains a little clearer:

Capture.JPG_thumb

marcelloc

I know apache can do it easily, but have no idea how to do it with squid reverse options.

Pound proxy can help too, but there is no gui for pfsense yet.

Gob

Thanks again for you valued help Marcelloc.

Pound looks like it will do the job and be the simplest to set up. I don't want to risk breaking my production pfSense box so I will install as a standalone proxy.

Just looking through the packages I came across stunnel. do you think that would do the job or is stunnel for outbound connections only?

Gordon

marcelloc

@Gob:

Just looking through the packages I came across stunnel. do you think that would do the job or is stunnel for outbound connections only?

I have not tried stunnel package yet to see how it works.

Gob

Hi Marcelloc

I have done some more reading on squid and following the examples on the squid website it is possible to use the squid reverse proxy to work with HTTPS on the WAN and HTTP on the LAN.
After examining the /usr/local/etc/squid/squid.conf it appears that only the HTTPS webserver get an entry and not the HTTP webservers. The mappings seem to get added correctly but not the peer entries.
I manually added the following to the squid.conf and it worked perfectly.

#test
cache_peer 192.168.250.4 parent 80 0 proxy-only no-query originserver login=PASS name=rvp_test

Obviously this will get overwritten if I perform anything that regenerates the squid.conf.

Can you give me any tips on how to make it persistent or are you able to take a look at the package?

many thanks
Gordon

Gob

further to my post above…
If I enable the HTTP reverse proxy (as well as the HTTPS reverse proxy) the package manager does add all of the HTTP webservers (cache_peer) and cache_peer_access lines to squid.conf.
But the addition of the http_port lines along side the existing https_port lines seems to prevent it from working.

So ideally it would be handy to include all cache_peer and cache_peer_access lines for HTTP webservers even when the HTTP reverse proxy is not enabled.

marcelloc

@Gob:

So ideally it would be handy to include all cache_peer and cache_peer_access lines for HTTP webservers even when the HTTP reverse proxy is not enabled.

Did you tried this config? Does it creates a bogons config?

Comexans

Hi,

I am facing the same situation :
we have a webserver (http only) within our company and needed to make it accessible from internet in https.
I set the HTTPS mode for squid and create HTTP peer et corresponding mapping.
This was not working at all

I added the missing cache_peer and cache_peer_access lines as explained by Gob within /usr/local/etc/squid/squid.conf file and now the HTTPS ==> HTTP reverse proxy is working very well !

Marcelloc : is there a way to fix this in the squid3 package ?

Thanks.

marcelloc

can you try with squid3-dev package on a testing machine?

falcone

hi
i had same probleb,i enabled http and https mode,but i uncomment

Reverse Proxy settings

#http_port 213.151.40.39:80 accel defaultsite=falcone.co.il vhost
https_port 213.151.40.39:443 accel cert=/usr/pbi/squid-amd64/local/etc/squid/564b6b275c7eb.crt key=/usr/pbi/squid-amd64/local/etc/squid/564b6b275c7eb.key defaultsite=falcone.co.il vhost

after this proxy listening just on https:)

flowjo-mike

This is still an issue with that latest pfSense (2.3.2-RELEASE-p1) and Squid 0.4.23_1) Packages. Every time I make a change to anything squid/clamav/reverse proxy I have to add the entry back into squid.conf.

Is this going to be fixed?