Squid 3.3.4 package for pfsense with ssl filtering

Nachtfalke

Hi nachtfalke

Sorry I'm mean this url http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

I wasn't able to get the missing libs. to make squid working and squidguard too

Did you see the post marcelloc posted on top of your post?

ipis

Hi, while i continue reading

I'v found this instructed by marcelloc to other member.

. cd /usr/local/lib
. fetch url_for_libs

Download all libs from my ldd folder.

What doe's he mean by the "fetch url_for_libs" ?

Because what I tried is this on console "fetch //http://e-sac.siteseguro.ws/pfsense/8/All/ldd/"

and it says not found. Did I do it correctly?

ipis

Sorry I didn't see it earlier.

Thanks Nachtfalke and marcelloc :)

marcelloc

@ipis:

Sorry I'm mean this url http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.5.tbz

No need to fetch 3.3.5. Use default 3.3.8 from oficial repository.

ipis

Guys what i did was this to be exact

(8) shell
cd /usr/local/lib
fetch -o /usr/local/lib/libasn1.so.10 http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10

But it says not found.

I feel ashamed cause i wasn't able to install them while others can :(

ipis

Is there a way to copy the missing libs directly to the pfsense without fetching?

marcelloc

@ipis:

Is there a way to copy the missing libs directly to the pfsense without fetching?

Unfortunately no. I've asked core team to copy these libs to official repo but I had no luck with that.

These are missing so libs for gssapi. Other packages(freeradius2, postfix) need this libs too.

ipis

I hope all missing libs are included soon. I really wan't to block certain secured sites on my work. And I think this version is amazing.

Does anyone has a workaround in fetching libs?

Nachtfalke

@ipis:

I hope all missing libs are included soon. I really wan't to block certain secured sites on my work. And I think this version is amazing.

Does anyone has a workaround in fetching libs?

Just try with this command:

cd /usr/local/lib

and in this folder:


fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libgssapi.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libheimntlm.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libhx509.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libkrb5.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libroken.so.10

Perhaps you have to check the file permissions after you copied the files.

Or download the libs via your webbrowser and copy these files to pfsense using the GUI:
DIAGNOSTICS –> Command Prompt

ipis

Thanks Nachtfalke

How stupid i'am. I a'm using the word "ALL" instead of "All" plus. I erase all my config to squid, I uncheked everything before re-fetching. Thanks again :)

ipis

Hi. Its already working fine but I've noticed that the other browser like google chrome. I've noticed that it wont trust the certificate when entering into secured sites. It says the Certificate is not trusted and theres no option for the user to continue and accept it. Unlike to other browser theres an optio to get the certificate and continue to the website. Or to trust the cerficate.. Is this normal, or theres a way to overcome this? Thanks

marcelloc

@ipis:

Is this normal, or theres a way to overcome this? Thanks

Yes, to avoid these erros, play with squid cert options and include pfsense CA as a trusted CA on each browsers. This way you will not get any ssl error for https sites.

Services that use same ssl port(tor, ultrasurf) will always fail.

ipis

Thanks marcelloc. I've fixed the certificated error. also I re-enabled the transparent ssl and it helps :)

ipis

Hi, I have a question. I just visited a government agency website, its an organization that handles employers contribution. or employees contribution. Ive noticed that after accepting the certificate and continuing to website. The website did not respond and it says webpage not avalable. According to other forums ubuntu to be exact, theres a site that sometimes block this kind of interception, i mean we will not be availbe to continue that's why they added some code.

Can we adopt their code to our pfsense? I think their added it in squid.conf

marcelloc

@ipis:

Can we adopt their code to our pfsense? I think their added it in squid.conf

If you find what code is it, I can add to squid.conf.

ipis

Hi marcerlloc, check this pic that ive uploaded

1.jpg_thumb

2.jpg_thumb

ipis

Hi, marcelloc i successfully entered that website. But this website www.sss.gov.ph
prevents my network

marcelloc

These pics shows stardard ssl squid configuration.

ipis

You mean it doesn't have something to do with the website? Maybe I mis configured. On the other hand, I've noticed something when connecting to facebook. It seems like the page is broken, I couldn't see the pictures and other posts. I've tried to disable my squid guard and let the squid3-dev handle the internet, but the outcome is the same. But when i tried not to proxy the internet, only using the direct firewall rules on lan, the page seems fixed. Is there a workaround on this?

marcelloc

Can you test on firefox with firebug extension enabled on network tab?