Transparent Proxy issue?

KOM

I'm just some random Internet guy, so giving me access to your box probably isn't good for security.

I would make a backup of your configuration and then do a reinstall. That shouldn't take very long and it may get you past a glitch.

I still cant' get past how SquidGuard is not running, but you get access denied errors that look exactly like SquidGuard's default error msg page.

You have tried with different browser or client computer to rule out an weird caching issues?

What happens if you completely uninstall SquidGuard?

zaf

If I uninstall it I get still the same result, so I really don't think its squid guard, I believe its an issue with transparent proxy!

Thanks

KOM

But like I said, Squid by itself doesn't do any filtering. None at all. It's a caching proxy and that's all.

zaf

ok lets take the squid guard out of equation.

so what I want is transparent proxy with lightsquid and I still get the same result?

Thanks

Tikimotel

You had setup not-transparent mode first right?
Perhaps the switching to transparent mode did not complete the firewall rule changes to accommodate the squid proxy rules to redirect to the proxy-port.

Does /tmp/rules.debug contain something like this?


# Setup Squid proxy redirect
no rdr on em1 proto tcp from any to { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } port 80
rdr on em1 proto tcp from any to !(em1) port 80 -> 127.0.0.1 port 3128

zaf

correct I had not set transparent first, but it was installed as the first package out of three I have installed.

sorry im not familiar with command and im new to pfsense, how do I check the /tmp/rules.debug?

please can you explain in steps..

Thanks for all your help so far!

zaf

Tikimotel can you please respond?

Thanks

Tikimotel

Sorry, for the late response..

The tmp/rules.debug can be viewed via WinSCP or using the command "cat /tmp/rules.debug" in pfsense GUI: diagnostics->command.

I've checked the "squid.inc" file in the package, and that will normally create the appropriate rules on pressing "save".
I'm not sure on how to fix that manually if it turns out to be wrong.

zaf

Hi Tikimotel,

here is the out put of the command, what does this mean?

Setup Squid proxy redirect

rdr on de1 proto tcp from any to !(de1) port 80 -> 127.0.0.1 port 3128

Thanks

KOM

Redirect on interface de1, protocol TCP, from Source "Any" to Destination "NOT LAN Address", and send it to localhost on port 3128. Basically it means that anyone on your LAN sending anything to port 80 (HTTP) but not directed to your pfSense box will be redirected to your pfSense box port 3128.

It's the redirect rule that turns Transparent mode on or off.

Tikimotel

rdr on de1 proto tcp from any to !(de1) port 80 -> 127.0.0.1 port 3128

redirect all traffic using tcp protocol on port 80, from any source other than the de1 and redirect that to the localhost using the proxy port.

So it only half of what is needed.
You'll need both lines from my example for transparent mode to work, both are set by the squid GUI.

Do you have "Allow users on interface" enabled?

Tikimotel

I've unchecked this "Allow users on interface" and saved.
Now I get a denied message, too.

Please check "Allow users on interface", or add the allowed subnets manually in the tab "ACLs"

Have you added anything to the "Authentication" tab?
Can you try and set "Authentication method" to "none", or add the subnets to "Subnets that don't need authentication" field below that.

zaf

So it only half of what is needed.
You'll need both lines from my example for transparent mode to work, both are set by the squid GUI.

Do you have "Allow users on interface" enabled?

see attached, so how I do I add the other line?7

Thanks

proxy.PNG_thumb

zaf

authentication tab is set to none?

authen.PNG_thumb

zaf

the strange thing is when I turn transparent proxy on, google page works (hit and miss), but if I try another site say bbc.co.uk it say page cannot be displayed?

:-\

really confusing the hell out of me!

Tikimotel

The second is depending on your connection type, PPPoE for instance has a different rule than Ethernet connected.

Have you tried to remove the pkg config, uninstall the package and then fully re-install the package?

Login the terminal/ssh or local on the box.
Use the option 12 (developer shell)
And issue the "playback" command to remove pkg config.
(playback removepkgconfig squid/squid3/squid3-dev)
The logout of the terminal shell.
The package config is the removed from the config.XML, so re-installing squid package from the GUI will be like the very first install, no old settings are restored.

I'm currently running "squid3-dev" on pfSense v2.1.4 (64-bit) from what I can tell from your images you are running a previous squid package version?
I don't know if the missing libs is fixed yet in the "squid3-dev" installer, but you can look up these libs in the forum topic there.
https://forum.pfsense.org/index.php?topic=62256.165

Marcello has done a lot of work in the squid3-dev package, and for my use case it works great. (it works for me )
https://forum.pfsense.org/index.php?topic=48347.0

My 2cents to get SquidGuard to cooperate with squid3-dev
https://forum.pfsense.org/index.php?topic=73640.0

zaf

here is the screen print of packages installed, do you want me to uninstall this and install the highlighted in yellow on the second screen print?

Thanks

packages.PNG_thumb

squid.PNG_thumb

Tikimotel

Your current squid is version 2 based. (a.k.a old)
I don't know if there is any development on that package…

When re-installing you version of squid, just make sure the old squid pkg settings are gone, because now you have weird issues.

I suggest you use "Squid3-dev" in combination with "Squidguard-squid3", because there is more development on that being done.

KOM

Squid3-dev in pfSense 2.1.x is fragile and I would not recommend using it unless you have both time on your hands and a masochistic streak. Perhaps look at it in pfSense 2.2-ALPHA.

zaf

more confusion!! :-\

im thinking of giving up on this, unless someone gives me assured tested solution please?

Thanks