Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squidguard-squid3 systempatch for use with squid3-dev

    Scheduled Pinned Locked Moved Cache/Proxy
    59 Posts 11 Posters 49.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      webstor
      last edited by

      Hi,

      Of course you cannot decrypt every Site. Itunes is also not decryptable.
      BTW: is squidguard and antivirus working?
      As exakte is the Eicar Testvirus getting blocked?

      1 Reply Last reply Reply Quote 0
      • A
        aGeekhere
        last edited by

        How do I add the exclusions?

        Yes squidguard and the antivirus are working and it does block the exakte file.

        [UPDATE] Also Do you have to manually find each service to exclude?
        e.g.
        windows update
        Adobe creative cloud
        Google update
        Antivirus update
        other updater

        Or can we just create a general rule that will allow all service updates, because finding all these service updates would hard and take a while and if someone comes onto the network and has some other software package that need an exclusion in order to update that would be hard to maintain.

        Never Fear, A Geek is Here!

        1 Reply Last reply Reply Quote 0
        • W
          webstor
          last edited by

          Hm, my squidguard isn't still working.

          Are you using HAVP as antivirus?

          Did you add more then one nat rule for ssl decryption?

          Thanx.

          1 Reply Last reply Reply Quote 0
          • A
            aGeekhere
            last edited by

            Are you using HAVP as antivirus?

            I left the squid Antivirus (clamav) as default (do not know if it is using HAVP or not, can't
            even find a setting for it in squid)

            Did you add more then one nat rule for ssl decryption?

            I did not set any nat rules for ssl decryption in the Firewall, but rather in System: Advanced: Firewall and NAT and set NAT Reflection mode for port forwards to enable(pure nat).Also enabled Enable NAT Reflection for 1:1 NAT and Enable automatic outbound NAT for Reflection.

            Hope this helps

            Also any ideas on my above post about windows updates and other update servers?

            Never Fear, A Geek is Here!

            1 Reply Last reply Reply Quote 0
            • W
              webstor
              last edited by

              Strange, is your squidguard configured as parent for squid?

              Could you maybe post your squid.conf please?

              Thanx.

              1 Reply Last reply Reply Quote 0
              • A
                aGeekhere
                last edited by

                in squidgard set Blacklist proxy as the ip of pfsense

                Never Fear, A Geek is Here!

                1 Reply Last reply Reply Quote 0
                • W
                  webstor
                  last edited by

                  That is not working correctly, squidguard won't start if I enter the ip of pfsense in the blacklist proxy.

                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere
                    last edited by

                    Same, I have to cut every thing out of integrations then start squidgaurd then renter it back in

                    Never Fear, A Geek is Here!

                    1 Reply Last reply Reply Quote 0
                    • W
                      webstor
                      last edited by

                      And after that it was working, I mean ssl bump and squidguard filtering?

                      1 Reply Last reply Reply Quote 0
                      • A
                        aGeekhere
                        last edited by

                        both, sometimes a restart is needed and then cut everying out from integrations, start squidgaurd and then paste it back into squid.

                        Never Fear, A Geek is Here!

                        1 Reply Last reply Reply Quote 0
                        • W
                          webstor
                          last edited by

                          Nope, won't help. I don't get it.

                          1 Reply Last reply Reply Quote 0
                          • A
                            aGeekhere
                            last edited by

                            Hi all, still stuck on getting windows update working, any advice?.

                            Never Fear, A Geek is Here!

                            1 Reply Last reply Reply Quote 0
                            • W
                              webstor
                              last edited by

                              When I got it working with squidguard, I will attend to that problem.

                              1 Reply Last reply Reply Quote 0
                              • A
                                aGeekhere
                                last edited by

                                I am a bit stumped on why Squidguard is not working for you (as I am new to this) list your squid, Squidguard and System: Advanced: Firewall and NAT settings.

                                Never Fear, A Geek is Here!

                                1 Reply Last reply Reply Quote 0
                                • W
                                  webstor
                                  last edited by

                                  Transparent Proxy.

                                  Integrations Settings:
                                  cache_peer 127.0.0.1 parent 3125 0 name=havp no-query no-digest no-netdb-exchange default;url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-amd64/etc/squidGuard/squidGuard.conf;url_rewrite_bypass off;url_rewrite_children 16 startup=8 idle=4 concurrency=0

                                  Custom Acls:
                                  always_direct allow all
                                  ssl_bump server-first all

                                  Only one nat rue for redirecting https traffic to squid.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    aGeekhere
                                    last edited by

                                    do you put amd64 instead of i386 by mistake or are you running amd64?

                                    Never Fear, A Geek is Here!

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      webstor
                                      last edited by

                                      I'm running a 64bit pfsense.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        aGeekhere
                                        last edited by

                                        is the squidGuard service able to run? or is it erroring? Also try using proxy port 3128 in Proxy port under Squid General Settings.

                                        Also here is my Custom ACLS (Before_Auth) in squid (Trying to get windows updates working)

                                        acl WindowsUpdate dstdomain windowsupdate.microsoft.com
                                        acl WindowsUpdate dstdomain update.microsoft.com
                                        acl WindowsUpdate dstdomain activex.microsoft.com
                                        acl WindowsUpdate dstdomain download.windowsupdate.com
                                        acl WindowsUpdate dstdomain codecs.microsoft.com
                                        acl WindowsUpdate dstdomain stats.updates.microsoft.com
                                        acl WindowsUpdate dstdomain c.microsoft.com
                                        no_cache deny WindowsUpdate
                                        http_access allow WindowsUpdate
                                        always_direct allow all
                                        ssl_bump server-first all

                                        This does not work

                                        Never Fear, A Geek is Here!

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          webstor
                                          last edited by

                                          Hi, squidguard is running and no error in the log files.
                                          Port squid is 3128.

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            aGeekhere
                                            last edited by

                                            But it is not filtering anything? Check Target Rules in squidGuard.
                                            In SquidGuard: General settings
                                            tic Check this option to enable blacklist
                                            Blacklist proxy is your pfsense router ip

                                            then clear your cache or try private search and try now

                                            Never Fear, A Geek is Here!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.