• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Squid 3.3.4 package for pfsense with ssl filtering

Cache/Proxy
72
305
301.5k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    marcelloc
    last edited by Sep 20, 2013, 4:09 AM

    @packeteer:

    It is closed.

    Next step is to check why squid is not starting…

    Treinamentos de Elite: http://sys-squad.com

    Help a community developer! ;D

    1 Reply Last reply Reply Quote 0
    • P
      packeteer
      last edited by Sep 20, 2013, 8:17 AM

      @marcelloc:

      @packeteer:

      It is closed.

      Next step is to check why squid is not starting…

      The service is running, just doesn't listen to the port.

      1 Reply Last reply Reply Quote 0
      • M
        marcelloc
        last edited by Sep 20, 2013, 11:21 PM

        @packeteer:

        The service is running, just doesn't listen to the port.

        Enable ipv6 on pfsense and then killall and start squid daemon.

        It's something on squid 3.3 version, I have a squid 3.3 version on my repo without ipv6 that works fine.

        If you do not want to enable ipv6 on your server, install squid 3.3.4 form my repo using pkg_delete and pkg_add from console/ssh

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • P
          packeteer
          last edited by Sep 21, 2013, 9:21 AM

          @marcelloc:

          @packeteer:

          The service is running, just doesn't listen to the port.

          Enable ipv6 on pfsense and then killall and start squid daemon.

          It's something on squid 3.3 version, I have a squid 3.3 version on my repo without ipv6 that works fine.

          If you do not want to enable ipv6 on your server, install squid 3.3.4 form my repo using pkg_delete and pkg_add from console/ssh

          Thank you very much! Enabling ipv6 works.

          ;D

          1 Reply Last reply Reply Quote 0
          • A
            ataru75
            last edited by Sep 21, 2013, 4:22 PM

            MULTIWAN

            Hello, you work the proxy-dev ver. 3.3.8 with the multi-WAN? Before working with version 2.7.9 using this guide http://forum.pfsense.org/index.php?topic=60977.0, now I installed version 3.3.8-dev and it does not work. With the release of squid that is found in this post (3.3.4) will it work?
            thanks
            greetings

            1 Reply Last reply Reply Quote 0
            • M
              marcelloc
              last edited by Sep 21, 2013, 9:59 PM

              Did you upgraded pfsense too?

              What version are you using?

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • D
                dld121
                last edited by Oct 10, 2013, 6:39 PM

                • If you are getting missing libs erros like Shared object "libgssapi.so.10" not found, required by "squid"',
                  Copy it from my personal repo or from any freebsd with the same version.
                  These are libs that are not included on pfsense base install bu required to sasl.
                  save it to /usr/local/lib
                  amd64
                  http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

                  i386
                  http://e-sac.siteseguro.ws/pfsense/8/All/ldd/

                • Shared object "libheimntlm.so.10" not found,

                David

                1 Reply Last reply Reply Quote 0
                • D
                  dld121
                  last edited by Oct 10, 2013, 8:50 PM

                  @marcelloc:

                  @stanthewizard:

                  sorry I don't understand

                  On console/ssh use  pkg_delete to remove squid-3.3.4 and pkg_add to get squid 3.3.5

                  i386 systems
                  pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

                  amd64 systems
                  pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/squid-3.3.5.tbz

                  Can you provide a URL that is available from the USA?  This URL returns  "Unable to get the … and Operation timed out."

                  The URL when Pinged gives me an IP address, but I cannot replace the "e-sac.siteseguro.ws" with an IP address and have it work.

                  David

                  David

                  1 Reply Last reply Reply Quote 0
                  • M
                    marcelloc
                    last edited by Oct 11, 2013, 3:08 AM Oct 11, 2013, 3:06 AM

                    @dld121:

                    Can you provide a URL that is available from the USA?

                    Unfortunately No.  :(

                    Do you have pfblocker enabled with brazil on your block list?

                    To get squid working without changing package files, just enable ipv6 on your 2.0.x version and get missing files from any freebsd 8.1 server.

                    @dld121:

                    The URL when Pinged gives me an IP address, but I cannot replace the "e-sac.siteseguro.ws" with an IP address and have it work.

                    It's a hosting server, only dns http headers will reach my files.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • M
                      mromero
                      last edited by Oct 11, 2013, 3:16 AM

                      Tested:

                      i386 systems
                      pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

                      amd64 systems
                      pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/squid-3.3.5.tbz

                      and they are dead for us as well.

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcelloc
                        last edited by Oct 11, 2013, 3:38 AM

                        Check your firewall rules and blocked ips.

                        I've just tested and it's working.

                        Use default package binaries with ipv6 enabled.

                        fetch missing files from any freebsd 8.1 for pfsense 2.0.x

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • L
                          Legion
                          last edited by Oct 11, 2013, 4:30 AM

                          Interestingly it's timing out for me too Marcello. And it's worked for me before, many times. I'm at work, in Oz, corporate firewall but it's not blocking.

                          1 Reply Last reply Reply Quote 0
                          • G
                            gemmiu
                            last edited by Oct 11, 2013, 12:30 PM

                            Sorry for my bad english.

                            Can someone explain, how to block https urls with squid3 + squidguard?

                            Http urls are blocked correctly, but https urls won't be blocked :(

                            Thank you so much.

                            1 Reply Last reply Reply Quote 0
                            • M
                              marcelloc
                              last edited by Oct 11, 2013, 1:05 PM

                              • Create a Certificate authority on pfsense

                              • Export ca certificate on gui and import on each client you what to filter ssl without certificate error messages

                              • Enable ssl interception/transparent proxy on squid3-dev gui.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • M
                                mromero
                                last edited by Oct 11, 2013, 4:13 PM

                                Marcelloc I am telling you it is DEAD. We have tried going outside pFsense, direct to our ISP, and also on our VPN.

                                It is unreachable.

                                The PBI manager within pFsense works fine.

                                Why not update the Squid 3.3.8.package so we can access it from within pFsense rather than from a third-party website?

                                @Legion:

                                Interestingly it's timing out for me too Marcello. And it's worked for me before, many times. I'm at work, in Oz, corporate firewall but it's not blocking.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  marcelloc
                                  last edited by Oct 11, 2013, 7:00 PM Oct 11, 2013, 6:54 PM

                                  @mromero:

                                  Why not update the Squid 3.3.8.package so we can access it from within pFsense rather than from a third-party website?

                                  As I told you on other post.

                                  • Install squid3-dev

                                  • Enable ipv6 on system advanced

                                  • fetch missing libs from any freebsd 8.3

                                  I've asked core team to include these libs on official repo, this way, postfix, freeradius2, squid3 and other package I do not remember now can be installed automatically via gui. But I had no success on it.

                                  The libs are there to help people not  to mess things up.

                                  Last point. It's a dev package, not a release or stable one. So people who tries it must know how to workaround things.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    Nachtfalke
                                    last edited by Oct 17, 2013, 7:07 PM

                                    Hi,

                                    I am planning tu use squid3 for transparent proxy for http and ssl intercepting proxy (443) on a Multi-WAN environment.
                                    So my question ist not directly related to the package but how do you use loadbalancing for ports 80/443 if these connections alsways have the same source like 127.0.0.1 ?

                                    To make it a little bit clearer
                                    I am not asking how to configure a pfsense with Multi-WAN and squid to use all WAN connections and not only one.
                                    I am interested in how to make it work that port 80 and port 443 can be loadbalanced even if the source is always squid/pfsense itself (127.0.0.1) and so I can not balance based on the source-IP. Policy based routing for these two ports will not make sense and sticky connections - I think they will always use one WAN for these two ports.

                                    I explained a little bit more here:
                                    http://forum.pfsense.org/index.php/topic,68120.0.html

                                    I would really appreciate any help so that I can configure my test machine and do some tests ;-)

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcelloc
                                      last edited by Oct 17, 2013, 7:46 PM

                                      Maybe with a lot of acls based on source ip acls to define tcp_outgoing address.

                                      I'm seeing some posts related to problems with 127.0.0.1 load balance on 2.1

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • N
                                        Nachtfalke
                                        last edited by Oct 17, 2013, 8:44 PM

                                        @marcelloc:

                                        Maybe with a lot of acls based on source ip acls to define tcp_outgoing address.

                                        I'm seeing some posts related to problems with 127.0.0.1 load balance on 2.1

                                        Interesting point. tcp_outgoing_address and ACL with source IP and source port 443 could do the trick. 3 tcp_outgoing each for every of the 3 WAN connection. Port 80 can be probably done with the gateway groups of pfsense in Manual Outbound NAT. Will give that a try.

                                        1 Reply Last reply Reply Quote 0
                                        • I
                                          ipis
                                          last edited by Oct 19, 2013, 2:08 PM

                                          Hi marcelloc. Does this version capable of blocking https sites in transparent mode?

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.