Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 3.3.4 package for pfsense with ssl filtering

    Scheduled Pinned Locked Moved Cache/Proxy
    305 Posts 72 Posters 308.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Legion
      last edited by

      Interestingly it's timing out for me too Marcello. And it's worked for me before, many times. I'm at work, in Oz, corporate firewall but it's not blocking.

      1 Reply Last reply Reply Quote 0
      • G
        gemmiu
        last edited by

        Sorry for my bad english.

        Can someone explain, how to block https urls with squid3 + squidguard?

        Http urls are blocked correctly, but https urls won't be blocked :(

        Thank you so much.

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          • Create a Certificate authority on pfsense

          • Export ca certificate on gui and import on each client you what to filter ssl without certificate error messages

          • Enable ssl interception/transparent proxy on squid3-dev gui.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • M
            mromero
            last edited by

            Marcelloc I am telling you it is DEAD. We have tried going outside pFsense, direct to our ISP, and also on our VPN.

            It is unreachable.

            The PBI manager within pFsense works fine.

            Why not update the Squid 3.3.8.package so we can access it from within pFsense rather than from a third-party website?

            @Legion:

            Interestingly it's timing out for me too Marcello. And it's worked for me before, many times. I'm at work, in Oz, corporate firewall but it's not blocking.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @mromero:

              Why not update the Squid 3.3.8.package so we can access it from within pFsense rather than from a third-party website?

              As I told you on other post.

              • Install squid3-dev

              • Enable ipv6 on system advanced

              • fetch missing libs from any freebsd 8.3

              I've asked core team to include these libs on official repo, this way, postfix, freeradius2, squid3 and other package I do not remember now can be installed automatically via gui. But I had no success on it.

              The libs are there to help people not  to mess things up.

              Last point. It's a dev package, not a release or stable one. So people who tries it must know how to workaround things.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • N
                Nachtfalke
                last edited by

                Hi,

                I am planning tu use squid3 for transparent proxy for http and ssl intercepting proxy (443) on a Multi-WAN environment.
                So my question ist not directly related to the package but how do you use loadbalancing for ports 80/443 if these connections alsways have the same source like 127.0.0.1 ?

                To make it a little bit clearer
                I am not asking how to configure a pfsense with Multi-WAN and squid to use all WAN connections and not only one.
                I am interested in how to make it work that port 80 and port 443 can be loadbalanced even if the source is always squid/pfsense itself (127.0.0.1) and so I can not balance based on the source-IP. Policy based routing for these two ports will not make sense and sticky connections - I think they will always use one WAN for these two ports.

                I explained a little bit more here:
                http://forum.pfsense.org/index.php/topic,68120.0.html

                I would really appreciate any help so that I can configure my test machine and do some tests ;-)

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  Maybe with a lot of acls based on source ip acls to define tcp_outgoing address.

                  I'm seeing some posts related to problems with 127.0.0.1 load balance on 2.1

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by

                    @marcelloc:

                    Maybe with a lot of acls based on source ip acls to define tcp_outgoing address.

                    I'm seeing some posts related to problems with 127.0.0.1 load balance on 2.1

                    Interesting point. tcp_outgoing_address and ACL with source IP and source port 443 could do the trick. 3 tcp_outgoing each for every of the 3 WAN connection. Port 80 can be probably done with the gateway groups of pfsense in Manual Outbound NAT. Will give that a try.

                    1 Reply Last reply Reply Quote 0
                    • I
                      ipis
                      last edited by

                      Hi marcelloc. Does this version capable of blocking https sites in transparent mode?

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        @ipis:

                        Hi marcelloc. Does this version capable of blocking https sites in transparent mode?

                        Yes.

                        1 Reply Last reply Reply Quote 0
                        • I
                          ipis
                          last edited by

                          Thanks natchflake. I'm trying to download squid-3.3.5 from the above address given by marcelloc using also the procedure as instructed, but i'wasn't able to download it. It says Unable to fetch the file. Can I download it manually and save it in any pfsense folder using file manager packages? IF yes how can i install it once i've save it? for example i saved it to /usr/local..

                          Thanks

                          1 Reply Last reply Reply Quote 0
                          • N
                            Nachtfalke
                            last edited by

                            @ipis:

                            Thanks natchflake. I'm trying to download squid-3.3.5 from the above address given by marcelloc using also the procedure as instructed, but i'wasn't able to download it. It says Unable to fetch the file. Can I download it manually and save it in any pfsense folder using file manager packages? IF yes how can i install it once i've save it? for example i saved it to /usr/local..

                            Thanks

                            Hi,

                            please try to install squid3-dev form pfsense package manager. This will give you all you need. After that you have to fetch some single files from command shell. This should be enough.

                            This post should explain it:
                            http://forum.pfsense.org/index.php/topic,62256.msg371582.html#msg371582

                            At the moment I do not find the post where marcelloc posted all the missing libs/files you need to fetch manually.

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              for amd64

                              
                              fetch -o /usr/local/lib/libasn1.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libasn1.so.10
                              fetch -o /usr/local/lib/libgssapi.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libgssapi.so.10
                              fetch -o /usr/local/lib/libheimntlm.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libheimntlm.so.10
                              fetch -o /usr/local/lib/libhx509.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libhx509.so.10
                              fetch -o /usr/local/lib/libkrb5.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libkrb5.so.10
                              fetch -o /usr/local/lib/libroken.so.10 http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/libroken.so.10
                              
                              

                              for i386

                              fetch -o /usr/local/lib/libasn1.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10
                              fetch -o /usr/local/lib/libgssapi.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libgssapi.so.10
                              fetch -o /usr/local/lib/libheimntlm.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libheimntlm.so.10
                              fetch -o /usr/local/lib/libhx509.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libhx509.so.10
                              fetch -o /usr/local/lib/libkrb5.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libkrb5.so.10
                              fetch -o /usr/local/lib/libroken.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libroken.so.10
                              

                              You can also fetch from any frebsd 8.3

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • I
                                ipis
                                last edited by

                                Hi nachtfalke

                                Sorry I'm mean this url http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

                                I wasn't able to get the missing libs.  to make squid working and squidguard too

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  @ipis:

                                  Hi nachtfalke

                                  Sorry I'm mean this url http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

                                  I wasn't able to get the missing libs.  to make squid working and squidguard too

                                  Did you see the post marcelloc posted on top of your post?

                                  1 Reply Last reply Reply Quote 0
                                  • I
                                    ipis
                                    last edited by

                                    Hi, while i continue reading

                                    I'v found this instructed by marcelloc to other member.

                                    . cd /usr/local/lib
                                    . fetch url_for_libs

                                    Download all libs from my ldd folder.

                                    What doe's he mean by the  "fetch url_for_libs" ?

                                    Because what I tried is this on console "fetch //http://e-sac.siteseguro.ws/pfsense/8/All/ldd/"

                                    and it says not found. Did I do it correctly?

                                    1 Reply Last reply Reply Quote 0
                                    • I
                                      ipis
                                      last edited by

                                      Sorry I didn't see it earlier.

                                      Thanks Nachtfalke and marcelloc :)

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        @ipis:

                                        Sorry I'm mean this url http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

                                        No need to fetch 3.3.5. Use default 3.3.8 from oficial repository.

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • I
                                          ipis
                                          last edited by

                                          Guys what i did was this to be exact

                                          • (8) shell
                                          • cd /usr/local/lib
                                          • fetch -o /usr/local/lib/libasn1.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10

                                          But it says not found.

                                          I feel ashamed cause i wasn't able to install them while others can  :(

                                          1 Reply Last reply Reply Quote 0
                                          • I
                                            ipis
                                            last edited by

                                            Is there a way to copy the missing libs directly to the pfsense without fetching?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.