Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 3 - Exchange 2013 SP1

    Scheduled Pinned Locked Moved pfSense Packages
    33 Posts 2 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      stanthewizard
      last edited by

      64

      1 Reply Last reply Reply Quote 0
      • S
        stanthewizard
        last edited by

        No idea what is the issue ? :o

        1 Reply Last reply Reply Quote 0
        • T
          trendchiller
          last edited by

          autodiscover omly works with SSL (with the package) and the analyzer first tries 80 and then as a fallback solution 443, so by design there is no port 80 autodiscover…
          does it not work at all without port 80 ?

          1 Reply Last reply Reply Quote 0
          • S
            stanthewizard
            last edited by

            impossible to negociate on port 80 (ok) or 443

            I have unchecked booth mapi and autodiscover
            with my own rules it works

            very strange isn't it ?

            BTW … thanks for your reply

            1 Reply Last reply Reply Quote 0
            • T
              trendchiller
              last edited by

              could you post (or send me) your squid.conf file ? (/usr/pbi/squid-i386/etc/squid/squid.conf)

              1 Reply Last reply Reply Quote 0
              • S
                stanthewizard
                last edited by

                YES

                This file is automatically generated by pfSense

                Do not edit manually !

                http_port 127.0.0.1:3128
                icp_port 0
                dns_v4_first off
                pid_filename /var/run/squid.pid
                cache_effective_user proxy
                cache_effective_group proxy
                error_default_language fr
                icon_directory /usr/pbi/squid-amd64/etc/squid/icons
                visible_hostname localhost
                cache_mgr admin@localhost
                access_log /var/squid/log/access.log
                cache_log /var/squid/log/cache.log
                cache_store_log none
                netdb_filename /var/squid/log/netdb.state
                pinger_enable on
                pinger_program /usr/pbi/squid-amd64/libexec/squid/pinger

                logfile_rotate 1
                debug_options rotate=1
                shutdown_lifetime 3 seconds
                uri_whitespace strip

                acl dynamic urlpath_regex cgi-bin ?
                cache deny dynamic

                cache_mem 8 MB
                maximum_object_size_in_memory 32 KB
                memory_replacement_policy heap GDSF
                cache_replacement_policy heap LFUDA
                cache_dir ufs /var/squid/cache 100 16 256
                minimum_object_size 0 KB
                maximum_object_size 4 KB
                offline_mode off
                cache_swap_low 90
                cache_swap_high 95
                cache allow all

                No redirector configured

                #Remote proxies

                Setup some default acls

                From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.

                acl localhost src 127.0.0.1/32

                acl allsrc src all
                acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 50080 3128 3127 1025-65535
                acl sslports port 443 563 50080

                From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.

                #acl manager proto cache_object

                acl purge method PURGE
                acl connect method CONNECT

                Define protocols used for redirects

                acl HTTP proto HTTP
                acl HTTPS proto HTTPS
                http_access allow manager localhost

                http_access deny manager
                http_access allow purge localhost
                http_access deny purge
                http_access deny !safeports
                http_access deny CONNECT !sslports

                Always allow localhost connections

                From 3.2 further configuration cleanups have been done to make things easier and safer.

                The manager, localhost, and to_localhost ACL definitions are now built-in.

                http_access allow localhost

                request_body_max_size 0 KB
                delay_pools 1
                delay_class 1 2
                delay_parameters 1 -1/-1 -1/-1
                delay_initial_bucket_level 100
                delay_access 1 allow allsrc

                Reverse Proxy settings

                http_port 127.0.0.1:80 accel defaultsite=mydomain.etc vhost
                https_port 127.0.0.1:443 accel cert=/usr/pbi/squid-amd64/etc/squid/533e8cd7ce7f0.crt key=/usr/pbi/squid-amd64/etc/squid/533e8cd7ce7f0.key defaultsite=mydomain.etc vhost
                http_port 192.168.1.200:80 accel defaultsite=mydomain.etc vhost
                https_port 192.168.1.200:443 accel cert=/usr/pbi/squid-amd64/etc/squid/533e8cd7ce7f0.crt key=/usr/pbi/squid-amd64/etc/squid/533e8cd7ce7f0.key defaultsite=mydomain.etc vhost
                cache_peer 192.168.0.8 parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_pfs
                #Syno HTTPS (8151)
                cache_peer 192.168.0.100 parent 8151 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_hqcdiskstation_8151

                #Syno HTTP (8150)
                cache_peer 192.168.0.100 parent 8150 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_hqcdiskstation_8150

                #rdweb_80
                cache_peer 192.168.0.10 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_rdweb_80

                #rdweb_443
                cache_peer 192.168.0.10 parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_rdweb_443

                #tkobservium_80
                cache_peer 192.168.0.27 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_tkobservium_80

                #rdc_443
                cache_peer 192.168.0.10 parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_rdc_443

                #osxserver_80
                cache_peer 192.168.0.18 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_osxserver_80

                #osxserver_443
                cache_peer 192.168.0.18 parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_osxserver_443

                #lamp_80
                cache_peer 192.168.0.28 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_lamp_80

                #exch2013_443
                cache_peer 192.168.0.8 parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_exch2013_443

                #ras_443
                cache_peer 192.168.0.23 parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin ssl sslflags=DONT_VERIFY_PEER front-end-https=auto name=rvp_ras_443

                #exch2013_80
                cache_peer 192.168.0.8 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_exch2013_80

                #fan_80
                cache_peer 192.168.0.29 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU round-robin name=rvp_fan_80

                ignore_expect_100 on
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/owa.$
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/exchange.                $
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/public.$
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/exchweb.                $
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/ecp.$
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/OAB.                $
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/Microsoft-Server-ActiveSync.$
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/rpc/rpcproxy.dll.                $
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/rpcwithcert/rpcproxy.dll.$
                acl OWA_URI_pfs url_regex -i ^https://mydomain.etc/EWS.                $
                acl rvm_hqcdiskstation8151 url_regex -i ^https://synologyssl.mydomain.etc.$
                acl rvm_hqcdiskstation8150 url_regex -i ^http://synology.mydomain.etc.                $
                acl rvm_tkobservium_80 url_regex -i tkobservium.mydomain.etc
                acl rvm_rdweb_443 url_regex -i ^https://rdweb.mydomain.etc/.$
                acl rvm_rdc_443 url_regex -i ^https://rdc.mydomain.etc/rpcwithcert/rpcproxy.dll.                $
                acl rvm_rdc_443 url_regex -i ^https://rdc.mydomain.etc/rpc/rpcproxy.dll.$
                acl rvm_rdweb_80 url_regex -i http://rdweb.mydomain.etc
                acl rvm_osxserver_443 url_regex -i ^https://osxserver.mydomain.etc.                $
                acl rvm_osxserver_80 url_regex -i ^http://osxserver.mydomain.etc/.$
                acl rvm_lamp_80 url_regex -i lamp.mydomain.etc
                acl rvm_exch2013_443 url_regex -i mydomain.etc/mapi/.                $
                acl rvm_ras_443 url_regex -i ^https://ras.mydomain.etc/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}.$
                acl rvm_exch2013_443 url_regex -i ^https://autodiscover.mydomain.etc/.                $
                acl rvm_exch2013_80 url_regex -i ^http://autodiscover.mydomain.etc/.*$
                acl rvm_fan_80 url_regex -i fan.mydomain.etc
                cache_peer_access OWA_HOST_pfs allow OWA_URI_pfs
                cache_peer_access OWA_HOST_pfs deny allsrc
                never_direct allow OWA_URI_pfs
                http_access allow OWA_URI_pfs
                cache_peer_access rvp_hqcdiskstation_8151 allow rvm_hqcdiskstation8151
                cache_peer_access rvp_hqcdiskstation_8150 allow rvm_hqcdiskstation8150
                cache_peer_access rvp_tkobservium_80 allow rvm_tkobservium_80
                cache_peer_access rvp_rdweb_443 allow rvm_rdweb_443
                cache_peer_access rvp_rdc_443 allow rvm_rdc_443
                cache_peer_access rvp_rdweb_80 allow rvm_rdweb_80
                cache_peer_access rvp_osxserver_443 allow rvm_osxserver_443
                cache_peer_access rvp_osxserver_80 allow rvm_osxserver_80
                cache_peer_access rvp_lamp_80 allow rvm_lamp_80
                cache_peer_access rvp_exch2013_443 allow rvm_exch2013_443
                cache_peer_access rvp_ras_443 allow rvm_ras_443
                cache_peer_access rvp_exch2013_443 allow rvm_exch2013_443
                cache_peer_access rvp_exch2013_80 allow rvm_exch2013_80
                cache_peer_access rvp_fan_80 allow rvm_fan_80
                cache_peer_access rvp_hqcdiskstation_8151 deny allsrc
                cache_peer_access rvp_shqcsubsonic_80 deny allsrc
                cache_peer_access rvp_hqcdiskstation_8150 deny allsrc
                cache_peer_access rvp_tkobservium_80 deny allsrc
                cache_peer_access rvp_rdweb_443 deny allsrc
                cache_peer_access rvp_rdc_443 deny allsrc
                cache_peer_access rvp_rdweb_80 deny allsrc
                cache_peer_access rvp_osxserver_443 deny allsrc
                cache_peer_access rvp_osxserver_80 deny allsrc
                cache_peer_access rvp_lamp_80 deny allsrc
                cache_peer_access rvp_exch2013_443 deny allsrc
                cache_peer_access rvp_newznab2_80 deny allsrc
                cache_peer_access rvp_ras_443 deny allsrc
                cache_peer_access rvp_exch2013_443 deny allsrc
                cache_peer_access rvp_exch2013_80 deny allsrc
                cache_peer_access rvp_fan_80 deny allsrc
                never_direct allow rvm_hqcdiskstation8151
                never_direct allow rvm_hqcdiskstation8150
                never_direct allow rvm_tkobservium_80
                never_direct allow rvm_rdweb_443
                never_direct allow rvm_rdc_443
                never_direct allow rvm_rdweb_80
                never_direct allow rvm_osxserver_443
                never_direct allow rvm_osxserver_80
                never_direct allow rvm_lamp_80
                never_direct allow rvm_exch2013_443
                never_direct allow rvm_ras_443
                never_direct allow rvm_exch2013_443
                never_direct allow rvm_exch2013_80
                never_direct allow rvm_fan_80
                http_access allow rvm_hqcdiskstation8151
                http_access allow rvm_hqcdiskstation8150
                http_access allow rvm_tkobservium_80
                http_access allow rvm_rdweb_443
                http_access allow rvm_rdc_443
                http_access allow rvm_rdweb_80
                http_access allow rvm_osxserver_443
                http_access allow rvm_osxserver_80
                http_access allow rvm_lamp_80
                http_access allow rvm_exch2013_443
                http_access allow rvm_TK13_NEWZNAB2
                http_access allow rvm_ras_443
                http_access allow rvm_exch2013_443
                http_access allow rvm_exch2013_80
                http_access allow rvm_fan_80

                Custom options before auth

                auth_param basic program /usr/pbi/squid-amd64/libexec/squid/basic_ncsa_auth /var/etc/squid.passwd
                auth_param basic children 5
                auth_param basic realm Please enter your credentials to access the proxy
                auth_param basic credentialsttl 5 minutes
                acl password proxy_auth REQUIRED

                Custom options after auth

                Default block all to be sure

                http_access deny allsrc

                1 Reply Last reply Reply Quote 0
                • T
                  trendchiller
                  last edited by

                  would you mind posting the lines you changed in your squid-reverse.inc for review ?
                  i could add them to the official package…

                  1 Reply Last reply Reply Quote 0
                  • S
                    stanthewizard
                    last edited by

                    With pleasure

                    But you're going to laugh … I don't find that file  ;D

                    1 Reply Last reply Reply Quote 0
                    • T
                      trendchiller
                      last edited by

                      or just send me the file you have on your pfsense as a pn ;-)
                      one never finds things when searching ;-)

                      1 Reply Last reply Reply Quote 0
                      • T
                        trendchiller
                        last edited by

                        with the next release of the squid package, AutoDiscover HTTP is included ;-)
                        so, no need to send the file anymore ;-)

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.