Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Installing the Dansguardian package in PFSense - One user's experience

    Scheduled Pinned Locked Moved
    Documentation
    27
    86
    151.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      baud
      last edited by

      Hello,

      Good day! Just a quick questions you gents, I'm currently running pfsense:

      2.0.1-RELEASE (amd64)
      built on Mon Dec 12 18:16:13 EST 2011
      FreeBSD 8.1-RELEASE-p6

      and I have created a separate computer/box/server that handles Dansguardian+Squid.  On my pfsense firewall, I have installed the squid package (2.7.9 pkg v.4.3.2) then I enable transparent proxy option on that one, and added this line on the custom configuration part:

      cache_peer 192.168.127.222 parent 3128 0 no-query no-digest

      then I added the squid/dansguardian ip to  the bypass proxy originating from this ip line.  I have also used "null" for the hardisk cache system so that i won't be caching the same thing twice.  Everything is working with this setup so far, the only problem I am having is that on the dansguardian/squid box, that is logged is the ip of the pfsense box and not the ips of the computers used by our users.  I do understand why this is so, but I can't seem to figure out how to have the original ips passed to the squid/dansguardian box… any ideas? Thanks!

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @baud:

        I do understand why this is so, but I can't seem to figure out how to have the original ips passed to the squid/dansguardian box… any ideas? Thanks!

        It will always log server ip as it is proxing connections.

        To have real ip on you box, you need a rule o lan using dansguardian box ip address as gateway to forward requests to it.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • B
          baud
          last edited by

          Thanks for the quick response marcelloc! as always!

          The only purpose why I need to have the original IP on the dansguardian/squid box is so I can do filter groups based on the ip addresses of user's computers.

          With regards to your suggestion on making my dansguardian/squid box as the gateway then route web traffic through there, can you explain a bit further? (ive attached a sample rule for it.. at least that's how interpret it.

          http://tinypic.com/r/iqa4hl/6
          http://tinypic.com/r/efqqkw/6

          You also mentioned on a previous post as reply to viko saying,

          "did you tried dansguardian(transparent with nat rules) -> squid."

          I'm thinking that this might be a better solution than what I currently have in mind to do.  So on the pfsense box, I can install the dansguardian package and then do all the ACL and filter groups on the firewall itself then just make an external squid box that will serve as parent for the dansguardian package in the firewall. If this is possible, I wanted to ask what do you mean "transparent with nat rules"… Can you kindly give me an example? Thanks!

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            dansguardian on pfsense filtering and using a remote squid for cache is a good option for you.

            The forward process to proxy server using rules is described in this post

            http://forum.pfsense.org/index.php/topic,54717.0.html

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • B
              baud
              last edited by

              this is brilliant marcelloc!

              I'll try this out later and will give you some feedback.

              1 Reply Last reply Reply Quote 0
              • C
                cakewipe
                last edited by

                @marcelloc:

                I could not reproduce this issue but I'll include on dansguardian gui an option to force squid startup before dansguardian.

                First, Thanks Marcelloc for your great work.
                I am having the same issue where Dansguardian is starting before squid and locking me out of the Web Interface.  I installed it just yesterday and couldn't find where the option to force squid to startup before dansguardian was.  Is this implemented?  If so, where do I set this?

                Thanks!

                1 Reply Last reply Reply Quote 0
                • R
                  rjcrowder
                  last edited by

                  @cakewipe:

                  @marcelloc:

                  I could not reproduce this issue but I'll include on dansguardian gui an option to force squid startup before dansguardian.

                  First, Thanks Marcelloc for your great work.
                  I am having the same issue where Dansguardian is starting before squid and locking me out of the Web Interface.  I installed it just yesterday and couldn't find where the option to force squid to startup before dansguardian was.  Is this implemented?  If so, where do I set this?

                  Thanks!

                  First - create a firewall rule (or add an exception to your redirect rule) so that you can get to the pfSense UI even if DG does not start…

                  As far as the order of starting, I'm not sure. I haven't seen that error in quite a while and I never figured out what was controlling the order (ideas Marcello?). One way to work around it is to create your own startup script in /usr/local/etc/rc.d to startup DG last. Name it something like zz_startdg.sh just to make sure it executes last.

                  1 Reply Last reply Reply Quote 0
                  • ?
                    Guest
                    last edited by

                    dansguardian only works for marcelloc and it's developers!

                    1 Reply Last reply Reply Quote 0
                    • R
                      rjcrowder
                      last edited by

                      Works great for me… And while I will admit that I've done some modifications and spent a fair amount of time figuring out how pfSense works, I'm not "one of its developers"... I do this purely for the fun of it!

                      I'm going to vent a little, but it baffles me that people want to use a freely distributed, freely developed product and then complain that it doesn't work! Spend the time to learn a little bit... When I first started playing with this thing, I had no idea how pfSense was structured and had little knowledge of FreeBSD, PHP, etc.  Try to debug some things on your own. If you find issues, dig in and try to resolve them rather than complaining! That's how an open source software package becomes better.

                      If that's not where you're at, then maybe you should purchase a commercial product. Then you can call someone in India who will tell you to "reboot and see if that fixes it..."

                      1 Reply Last reply Reply Quote 0
                      • H
                        Hugovsky
                        last edited by

                        Works great for me too. Using it with 300+ users and fiber. Thanks to Marcelloc and to all that contribute. Awesome job.

                        1 Reply Last reply Reply Quote 0
                        • N
                          NemesisXIII
                          last edited by

                          I was able to get it reasonably configured and it seems to work for most everything I want but I have a persistent problem with Google.  I am unable to filter google's search results to be safe only.  It seems they changed all their search to https only and it is preventing me from enforcing safe mode (Searches for naughty words still show thumbnails of naughty content even though none of it is clickable.)  In my search I have found multiple modify statements none of which work.  Has anyone been able to find a way to enforce safe search or prevent searches of certain keywords from being successful?
                          The best I've been able to manage is that http://216.239.32.20/ is the google search IP address and searches on it are properly caught by dansguardin(and properly safe search enforced); however any regular browser bar search or putting google.com into the address bar brings me back to my original problem of being unable to modify the ssl and search queries.

                          Thanks for any help.

                          1 Reply Last reply Reply Quote 0
                          • R
                            rjcrowder
                            last edited by

                            You can enter DNS overrides in the DNS settings to force resolution of google.com to nosslsearch.google.com (216.239.32.20).

                            1 Reply Last reply Reply Quote 0
                            • R
                              Ricardozam
                              last edited by

                              Hello

                              I'm new to pfSense and although I have managed to put into operation

                              pfSense 2.1-RELEASE (i386)
                              built on Wed Sep 11 18:16:50 EDT 2013
                              FreeBSD 8.3-RELEASE-p11

                              with squid3 2.0.6 pkg v3.1.20

                              on this box
                              CPU Type Intel (R) Core (TM) 2 Duo CPU E7500@2.93GHz
                              2 CPUs: 1 package (s) x 2 core (s)
                              2GB Memory
                              100GB HD

                              with up to 100 users for two weeks without problems

                              I would like to advise me if it is possible to have Dansguardian v2.12.0.3 pkg v.0.1.8 with this setup and maintain a fully functional squid3 cache

                              Thanks for your advice on this regards.

                              1 Reply Last reply Reply Quote 0
                              • Q
                                q54e3w
                                last edited by

                                I've followed this guide but can't for the life of me get traffic to flow. The dansguardian and squid logs show zero activity so something pretty fundamental is wrong.
                                My first pfsense box 192.168.10.1 runs openvpn, suricata and firewall.
                                I've got a second pfsense box 192.168.10.2 running dansguardian and squid only which was intended to replace an untangle setup.
                                The only difference I can see from this guide is I'm using a bridged connection to group my onboard wan, lan*3 ports plus my quad i350 and dual x520 with the first box. To reduce complexity I've reduced this down to a sole wan & lan bridged connection but no joy. Everything worked correctly prior to introducing dansguardian and squid so the bridge setup is sound.
                                Is the bridge setup likely to cause problems?

                                1 Reply Last reply Reply Quote 0
                                • A
                                  aGeekhere
                                  last edited by

                                  Hi all,

                                  I would like to add Dansguardian to my squid3-dev squidgarden for Transparent Proxy with ssl filtering.
                                  squidgarde is working and filtering (just need to workout how to allow update services like windows update and adobe creative cloud, if anyone had any advice on this I would be much appreciated) UPDATE solved windows updates https://forum.pfsense.org/index.php?topic=73640.45

                                  The problem is that Dansguardian does not want to filter anything (http or https, i turned off squidgarden  to test this).

                                  I have tried creating  a NAT rule for Dansguardian  and put it on the TOP of the list
                                  LAN TCP * * LAN net 80 (HTTP) 192.168.1.1 8080 dans

                                  Dansguardian setup
                                  Listen interface: LAN
                                  port: 8080
                                  Proxy IP: 192.168.1.1
                                  Proxy Port: 3128
                                  SSL man in the middle Filtering using my certificate

                                  Squid setup
                                  http Proxy interface lan
                                  http Proxy port 3128
                                  Transparent Proxy interface lan
                                  Bypass proxy for these destination IPs 192.168.1.1
                                  SSL Intercept interface(s) lan
                                  SSL Proxy port blank

                                  Anyone have any suggestions?

                                  Never Fear, A Geek is Here!

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jazzisjazz
                                    last edited by

                                    Howdy, I am trying to set up Dansguardian.

                                    I hav a pfsense box with 1.8ghz amd 754 sempron, 2gigs memory, 32gb ssd.
                                    2.1.5 is installed.

                                    I have configured already to used opendns.

                                    It works but I don't know if it could negatively affect another installed package.

                                    I decided to try following your notes to install/configure Dansguardian.

                                    WAN interface pointing at the ISP and
                                    a LAN interface with the IP address 192.168.1.1.

                                    Installed Dansguardian.

                                    Setup
                                    Go to: Services>Dansguardian
                                    Click on Enable Dansguardian
                                    Listen interface - LAN
                                    Listen Port - 8080 typed in
                                    Proxy IP - 192.168.1.1 (My PFSense box)
                                    Proxy Port - 3128 typed in
                                    Saved that.

                                    DG is running Status>Services - checked.

                                    I did not understand the following paragraph:

                                    At this point I found there was nothing listening on port 3128 (sockstat -4l) which I didn't expect because I thought the package installed Squid so either I missed something or I was just wrong, either way, I decided I'd install squid from the package.

                                    What test/command did you run to"find nothing listening"?

                                    Installed Squid

                                    System>Packages>Available Packages and select Squid
                                    After squid installed I did not find a configuration page like I did for Dansguardian
                                    under Services

                                    Squid configuration (optional)
                                    Visible host name - "your host name"

                                    save

                                    so I just saved.

                                    Go back to Services>Dansguardian and click save in order to recycle DG
                                    clicked save to recycle dansGuardian.

                                    Changed settings in Firefox
                                    Firefox proceed as follows:

                                    Tools>Options
                                    Network Tab>Settings>Manual Proxy configuration

                                    HTTP Proxy - 10.0.2.1 (IP of your dansguardian/PFsense machine)
                                    Port - 8080

                                    Tick - Use this proxy for all protocols.

                                    Now try to access both a good site and a bad site:

                                    Can't access a good or bad site - so far

                                    google.com - Good
                                    tits.com - Bad (or any other bad site)

                                    Where have I gone wrong?

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      forca
                                      last edited by

                                      nice howto!! just tried out with pfs-2.0.2 on alix2d3, works fine as transparent or no transparent mode!!
                                      this version of DG works:
                                      http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.2.tbz
                                      http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.0_2-i386.pbi

                                      But what about DG within last stable (2.2.2) and brandnew (nightly build from today)? It crashes always (even on first start) with illegal instruction (dansguardian. Illegal instruction (core dumped)) :(
                                      this version of DG (used in last stable 2.2.2) crashes:
                                      http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi

                                      Is there a way or a trick to get it working properly?

                                      As fallback, i could stay at 2.0.2…but i would like to use the last release

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        forca
                                        last edited by

                                        @forca:

                                        nice howto!! just tried out with pfs-2.0.2 on alix2d3, works fine as transparent or no transparent mode!!
                                        this version of DG works:
                                        http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.2.tbz
                                        http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.0_2-i386.pbi

                                        But what about DG within last stable (2.2.2) and brandnew (nightly build from today)? It crashes always (even on first start) with illegal instruction (dansguardian. Illegal instruction (core dumped)) :(
                                        this version of DG (used in last stable 2.2.2) crashes:
                                        http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi

                                        Is there a way or a trick to get it working properly?

                                        As fallback, i could stay at 2.0.2…but i would like to use the last release

                                        sorry, my bad…
                                        on 2.0.2 is also http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi installed and works fine
                                        on 2.2.2 http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi crashes

                                        Any ideas?

                                        1 Reply Last reply Reply Quote 0
                                        • F
                                          forca
                                          last edited by

                                          @forca:

                                          @forca:

                                          nice howto!! just tried out with pfs-2.0.2 on alix2d3, works fine as transparent or no transparent mode!!
                                          this version of DG works:
                                          http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.2.tbz
                                          http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.0_2-i386.pbi

                                          But what about DG within last stable (2.2.2) and brandnew (nightly build from today)? It crashes always (even on first start) with illegal instruction (dansguardian. Illegal instruction (core dumped)) :(
                                          this version of DG (used in last stable 2.2.2) crashes:
                                          http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi

                                          Is there a way or a trick to get it working properly?

                                          As fallback, i could stay at 2.0.2…but i would like to use the last release

                                          sorry, my bad…
                                          on 2.0.2 is also http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi installed and works fine
                                          on 2.2.2 http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi crashes

                                          Any ideas?

                                          some news:
                                          …seems to be a i386-problem. Just tried on apu1 with amd64-arch, dansguardian seems to work on last stable 2.2.2 version

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            simonbrads
                                            last edited by

                                            @forca:

                                            But what about DG within last stable (2.2.2) and brandnew (nightly build from today)? It crashes always (even on first start) with illegal instruction (dansguardian. Illegal instruction (core dumped)) :(
                                            this version of DG (used in last stable 2.2.2) crashes:
                                            http://files.pfsense.org/packages/8/All/dansguardian-2.12.0.3_2-i386.pbi

                                            Same here. I just:

                                            • Upgraded to pfSense 2.2.2-RELEASE

                                            • Installed squid 2.7.9 pkg v.4.3.6

                                            • Installed DansGuardian 2.12.0.3_2 pkg v.0.1.12

                                            DG crashes straight away. :'(

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post