Squid 3.3.4 package for pfsense with ssl filtering

[marcelloc]

@itman6770:

hi
i want to install squid tahat support icap and integrate with anti virus.but i dont now.
can you help?

It's still under development on squid3-dev

[packeteer]

I was wondering if Dansguardian is suppose to be working on this version of squid?

I am on PFSense 2.1(AMD64). DG works with Squid3 but not the dev version.

For some reason DG is unable to connect with Squid3dev.

Squid3dev works perfectly on its own.

[marcelloc]

I use dansguardian with squid3-dev.

What errors are you getting?

[packeteer]

@marcelloc:

I use dansguardian with squid3-dev.

What errors are you getting?

Dansguardian: error connecting to proxy. Same error as Legion on page 2.

I have it upstream to a proxy server on port 3128.

works fine with squid3.

Thnx

[marcelloc]

Check if squid is listening(netstat -an | grep -i listen) on the port you have configured on dansguardian.

[packeteer]

@marcelloc:

Check if squid is listening(netstat -an | grep -i listen) on the port you have configured on dansguardian.

It is closed.

[marcelloc]

@packeteer:

It is closed.

Next step is to check why squid is not starting…

[packeteer]

@marcelloc:

@packeteer:

It is closed.

Next step is to check why squid is not starting…

The service is running, just doesn't listen to the port.

[marcelloc]

@packeteer:

The service is running, just doesn't listen to the port.

Enable ipv6 on pfsense and then killall and start squid daemon.

It's something on squid 3.3 version, I have a squid 3.3 version on my repo without ipv6 that works fine.

If you do not want to enable ipv6 on your server, install squid 3.3.4 form my repo using pkg_delete and pkg_add from console/ssh

[packeteer]

@marcelloc:

@packeteer:

The service is running, just doesn't listen to the port.

Enable ipv6 on pfsense and then killall and start squid daemon.

It's something on squid 3.3 version, I have a squid 3.3 version on my repo without ipv6 that works fine.

If you do not want to enable ipv6 on your server, install squid 3.3.4 form my repo using pkg_delete and pkg_add from console/ssh

Thank you very much! Enabling ipv6 works.

;D

[ataru75]

MULTIWAN

Hello, you work the proxy-dev ver. 3.3.8 with the multi-WAN? Before working with version 2.7.9 using this guide http://forum.pfsense.org/index.php?topic=60977.0, now I installed version 3.3.8-dev and it does not work. With the release of squid that is found in this post (3.3.4) will it work?
thanks
greetings

[marcelloc]

Did you upgraded pfsense too?

What version are you using?

[dld121]

• If you are getting missing libs erros like Shared object "libgssapi.so.10" not found, required by "squid"',
  Copy it from my personal repo or from any freebsd with the same version.
  These are libs that are not included on pfsense base install bu required to sasl.
  save it to /usr/local/lib
  amd64
  http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

  i386
  http://e-sac.siteseguro.ws/pfsense/8/All/ldd/

• Shared object "libheimntlm.so.10" not found,

[dld121]

@marcelloc:

@stanthewizard:

sorry I don't understand

On console/ssh use  pkg_delete to remove squid-3.3.4 and pkg_add to get squid 3.3.5

i386 systems
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

amd64 systems
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/squid-3.3.5.tbz

Can you provide a URL that is available from the USA?  This URL returns  "Unable to get the … and Operation timed out."

The URL when Pinged gives me an IP address, but I cannot replace the "e-sac.siteseguro.ws" with an IP address and have it work.

David

[marcelloc]

@dld121:

Can you provide a URL that is available from the USA?

Unfortunately No.  :(

Do you have pfblocker enabled with brazil on your block list?

To get squid working without changing package files, just enable ipv6 on your 2.0.x version and get missing files from any freebsd 8.1 server.

@dld121:

The URL when Pinged gives me an IP address, but I cannot replace the "e-sac.siteseguro.ws" with an IP address and have it work.

It's a hosting server, only dns http headers will reach my files.

[mromero]

Tested:

i386 systems
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

amd64 systems
pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/squid-3.3.5.tbz

and they are dead for us as well.

[marcelloc]

Check your firewall rules and blocked ips.

I've just tested and it's working.

Use default package binaries with ipv6 enabled.

fetch missing files from any freebsd 8.1 for pfsense 2.0.x

[Legion]

Interestingly it's timing out for me too Marcello. And it's worked for me before, many times. I'm at work, in Oz, corporate firewall but it's not blocking.

[gemmiu]

Sorry for my bad english.

Can someone explain, how to block https urls with squid3 + squidguard?

Http urls are blocked correctly, but https urls won't be blocked :(

Thank you so much.

[marcelloc]

• Create a Certificate authority on pfsense

• Export ca certificate on gui and import on each client you what to filter ssl without certificate error messages

• Enable ssl interception/transparent proxy on squid3-dev gui.