Integration of the Squid Cache Manager into pfSense

rocaembole

Squid works perfectly. ACL allows all. Firewall is widely opened (pass any to any from/to any port) on LAN.-

I'm trying by proxy and by LAN (My squid's in non transparent mode) and can't access…

attach some other images also squid.conf & squidguard.conf

# Do not edit manually !
http_port 10.0.0.6:3128
icp_port 0

pid_filename /var/run/squid.pid
cache_effective_user proxy
cache_effective_group proxy
error_directory /usr/pbi/squid-i386/etc/squid/errors/Spanish
icon_directory /usr/pbi/squid-i386/etc/squid/icons
visible_hostname localhost
cache_mgr admin@localhost
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
logfile_rotate 0
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  10.0.0.0/255.255.255.0
uri_whitespace strip

cache_mem 1024 MB
maximum_object_size_in_memory 100 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir ufs /var/squid/cache 50000 16 256
minimum_object_size 0 KB
maximum_object_size 4 KB
offline_mode off
cache_swap_low 90
cache_swap_high 95
acl donotcache dstdomain '/var/squid/acl/donotcache.acl'
cache deny donotcache
# No redirector configured

# Setup some default acls
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535 8000-8010 8000-8010
acl sslports port 443 563  8000-8010 8000-8010
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
acl dynamic urlpath_regex cgi-bin ?
acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'
cache deny dynamic
http_access allow manager localhost

# Allow external cache managers
acl ext_manager_1 src 127.0.0.1 
http_access allow manager ext_manager_1
acl ext_manager_2 src 10.0.0.6 
http_access allow manager ext_manager_2

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

quick_abort_min 0 KB
quick_abort_max 0 KB
request_body_max_size 5000000 KB
reply_body_max_size 5120000000 deny all
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
# Throttle extensions matched in the url
acl throttle_exts urlpath_regex -i '/var/squid/acl/throttle_exts.acl'
delay_access 1 allow throttle_exts
delay_access 1 deny all

# Custom options
redirect_program /usr/pbi/squidguard-i386/bin/squidGuard -c /usr/pbi/squidguard-i386/etc/squidGuard/squidGuard.conf
redirector_bypass off
url_rewrite_children 5
# Always allow access to whitelist domains
http_access allow whitelist
auth_param basic program /usr/pbi/squid-i386/libexec/squid/squid_ldap_auth -v 3 -b DC=pfsense,DC=local -R -D CN=squid,CN=Users,DC=pfsense,DC=local -w a1s2d3.. -f 'sAMAccountName=%s' -u uid -P 10.0.0.80:389
auth_param basic children 5
auth_param basic realm Please enter your credentials to access the proxy
auth_param basic credentialsttl 60 minutes
acl password proxy_auth REQUIRED
http_access allow password localnet
# Default block all to be sure
http_access deny all


# ============================================================
# SquidGuard configuration file
# This file generated automaticly with SquidGuard configurator
# (C)2006 Serg Dvoriancev
# email: dv_serg@mail.ru
# ============================================================

logdir /var/squidGuard/log
dbhome /var/db/squidGuard
ldapbinddn cn=squid,cn=users,dc=pfsense,dc=local
ldapbindpass a1s2d3..
ldapprotover 3

# test schedulle
time test_porn {
	weekly * 16:00-16:40
}

# 
src test {
	user   jfilogna
	log block.log
}

# 
dest blk_BL_adv {
	domainlist blk_BL_adv/domains
	urllist blk_BL_adv/urls
	log block.log
}

# 
dest blk_BL_aggressive {
	domainlist blk_BL_aggressive/domains
	urllist blk_BL_aggressive/urls
	log block.log
}

# 
dest blk_BL_alcohol {
	domainlist blk_BL_alcohol/domains
	urllist blk_BL_alcohol/urls
	log block.log
}

# 
dest blk_BL_anonvpn {
	domainlist blk_BL_anonvpn/domains
	urllist blk_BL_anonvpn/urls
	log block.log
}

# 
dest blk_BL_automobile_bikes {
	domainlist blk_BL_automobile_bikes/domains
	urllist blk_BL_automobile_bikes/urls
	log block.log
}

# 
dest blk_BL_automobile_boats {
	domainlist blk_BL_automobile_boats/domains
	urllist blk_BL_automobile_boats/urls
	log block.log
}

# 
dest blk_BL_automobile_cars {
	domainlist blk_BL_automobile_cars/domains
	urllist blk_BL_automobile_cars/urls
	log block.log
}

# 
dest blk_BL_automobile_planes {
	domainlist blk_BL_automobile_planes/domains
	urllist blk_BL_automobile_planes/urls
	log block.log
}

# 
dest blk_BL_chat {
	domainlist blk_BL_chat/domains
	urllist blk_BL_chat/urls
	log block.log
}

# 
dest blk_BL_costtraps {
	domainlist blk_BL_costtraps/domains
	urllist blk_BL_costtraps/urls
	log block.log
}

# 
dest blk_BL_dating {
	domainlist blk_BL_dating/domains
	urllist blk_BL_dating/urls
	log block.log
}

# 
dest blk_BL_downloads {
	domainlist blk_BL_downloads/domains
	urllist blk_BL_downloads/urls
	log block.log
}

# 
dest blk_BL_drugs {
	domainlist blk_BL_drugs/domains
	urllist blk_BL_drugs/urls
	log block.log
}

# 
dest blk_BL_dynamic {
	domainlist blk_BL_dynamic/domains
	urllist blk_BL_dynamic/urls
	log block.log
}

# 
dest blk_BL_education_schools {
	domainlist blk_BL_education_schools/domains
	urllist blk_BL_education_schools/urls
	log block.log
}

# 
dest blk_BL_finance_banking {
	domainlist blk_BL_finance_banking/domains
	urllist blk_BL_finance_banking/urls
	log block.log
}

# 
dest blk_BL_finance_insurance {
	domainlist blk_BL_finance_insurance/domains
	urllist blk_BL_finance_insurance/urls
	log block.log
}

# 
dest blk_BL_finance_moneylending {
	domainlist blk_BL_finance_moneylending/domains
	urllist blk_BL_finance_moneylending/urls
	log block.log
}

# 
dest blk_BL_finance_other {
	domainlist blk_BL_finance_other/domains
	urllist blk_BL_finance_other/urls
	log block.log
}

# 
dest blk_BL_finance_realestate {
	domainlist blk_BL_finance_realestate/domains
	urllist blk_BL_finance_realestate/urls
	log block.log
}

# 
dest blk_BL_finance_trading {
	domainlist blk_BL_finance_trading/domains
	urllist blk_BL_finance_trading/urls
	log block.log
}

# 
dest blk_BL_fortunetelling {
	domainlist blk_BL_fortunetelling/domains
	urllist blk_BL_fortunetelling/urls
	log block.log
}

# 
dest blk_BL_forum {
	domainlist blk_BL_forum/domains
	urllist blk_BL_forum/urls
	log block.log
}

# 
dest blk_BL_gamble {
	domainlist blk_BL_gamble/domains
	urllist blk_BL_gamble/urls
	log block.log
}

# 
dest blk_BL_government {
	domainlist blk_BL_government/domains
	urllist blk_BL_government/urls
	log block.log
}

# 
dest blk_BL_hacking {
	domainlist blk_BL_hacking/domains
	urllist blk_BL_hacking/urls
	log block.log
}

# 
dest blk_BL_hobby_cooking {
	domainlist blk_BL_hobby_cooking/domains
	urllist blk_BL_hobby_cooking/urls
	log block.log
}

# 
dest blk_BL_hobby_games-misc {
	domainlist blk_BL_hobby_games-misc/domains
	urllist blk_BL_hobby_games-misc/urls
	log block.log
}

# 
dest blk_BL_hobby_games-online {
	domainlist blk_BL_hobby_games-online/domains
	urllist blk_BL_hobby_games-online/urls
	log block.log
}

# 
dest blk_BL_hobby_gardening {
	domainlist blk_BL_hobby_gardening/domains
	urllist blk_BL_hobby_gardening/urls
	log block.log
}

# 
dest blk_BL_hobby_pets {
	domainlist blk_BL_hobby_pets/domains
	urllist blk_BL_hobby_pets/urls
	log block.log
}

# 
dest blk_BL_homestyle {
	domainlist blk_BL_homestyle/domains
	urllist blk_BL_homestyle/urls
	log block.log
}

# 
dest blk_BL_hospitals {
	domainlist blk_BL_hospitals/domains
	urllist blk_BL_hospitals/urls
	log block.log
}

# 
dest blk_BL_imagehosting {
	domainlist blk_BL_imagehosting/domains
	urllist blk_BL_imagehosting/urls
	log block.log
}

# 
dest blk_BL_isp {
	domainlist blk_BL_isp/domains
	urllist blk_BL_isp/urls
	log block.log
}

# 
dest blk_BL_jobsearch {
	domainlist blk_BL_jobsearch/domains
	urllist blk_BL_jobsearch/urls
	log block.log
}

# 
dest blk_BL_library {
	domainlist blk_BL_library/domains
	urllist blk_BL_library/urls
	log block.log
}

# 
dest blk_BL_military {
	domainlist blk_BL_military/domains
	urllist blk_BL_military/urls
	log block.log
}

# 
dest blk_BL_models {
	domainlist blk_BL_models/domains
	urllist blk_BL_models/urls
	log block.log
}

# 
dest blk_BL_movies {
	domainlist blk_BL_movies/domains
	urllist blk_BL_movies/urls
	log block.log
}

# 
dest blk_BL_music {
	domainlist blk_BL_music/domains
	urllist blk_BL_music/urls
	log block.log
}

# 
dest blk_BL_news {
	domainlist blk_BL_news/domains
	urllist blk_BL_news/urls
	log block.log
}

# 
dest blk_BL_podcasts {
	domainlist blk_BL_podcasts/domains
	urllist blk_BL_podcasts/urls
	log block.log
}

# 
dest blk_BL_politics {
	domainlist blk_BL_politics/domains
	urllist blk_BL_politics/urls
	log block.log
}

# 
dest blk_BL_porn {
	domainlist blk_BL_porn/domains
	urllist blk_BL_porn/urls
	log block.log
}

# 
dest blk_BL_radiotv {
	domainlist blk_BL_radiotv/domains
	urllist blk_BL_radiotv/urls
	log block.log
}

# 
dest blk_BL_recreation_humor {
	domainlist blk_BL_recreation_humor/domains
	urllist blk_BL_recreation_humor/urls
	log block.log
}

# 
dest blk_BL_recreation_martialarts {
	domainlist blk_BL_recreation_martialarts/domains
	urllist blk_BL_recreation_martialarts/urls
	log block.log
}

# 
dest blk_BL_recreation_restaurants {
	domainlist blk_BL_recreation_restaurants/domains
	urllist blk_BL_recreation_restaurants/urls
	log block.log
}

# 
dest blk_BL_recreation_sports {
	domainlist blk_BL_recreation_sports/domains
	urllist blk_BL_recreation_sports/urls
	log block.log
}

# 
dest blk_BL_recreation_travel {
	domainlist blk_BL_recreation_travel/domains
	urllist blk_BL_recreation_travel/urls
	log block.log
}

# 
dest blk_BL_recreation_wellness {
	domainlist blk_BL_recreation_wellness/domains
	urllist blk_BL_recreation_wellness/urls
	log block.log
}

# 
dest blk_BL_redirector {
	domainlist blk_BL_redirector/domains
	urllist blk_BL_redirector/urls
	log block.log
}

# 
dest blk_BL_religion {
	domainlist blk_BL_religion/domains
	urllist blk_BL_religion/urls
	log block.log
}

# 
dest blk_BL_remotecontrol {
	domainlist blk_BL_remotecontrol/domains
	urllist blk_BL_remotecontrol/urls
	log block.log
}

# 
dest blk_BL_ringtones {
	domainlist blk_BL_ringtones/domains
	urllist blk_BL_ringtones/urls
	log block.log
}

# 
dest blk_BL_science_astronomy {
	domainlist blk_BL_science_astronomy/domains
	urllist blk_BL_science_astronomy/urls
	log block.log
}

# 
dest blk_BL_science_chemistry {
	domainlist blk_BL_science_chemistry/domains
	urllist blk_BL_science_chemistry/urls
	log block.log
}

# 
dest blk_BL_searchengines {
	domainlist blk_BL_searchengines/domains
	urllist blk_BL_searchengines/urls
	log block.log
}

# 
dest blk_BL_sex_education {
	domainlist blk_BL_sex_education/domains
	urllist blk_BL_sex_education/urls
	log block.log
}

# 
dest blk_BL_sex_lingerie {
	domainlist blk_BL_sex_lingerie/domains
	urllist blk_BL_sex_lingerie/urls
	log block.log
}

# 
dest blk_BL_shopping {
	domainlist blk_BL_shopping/domains
	urllist blk_BL_shopping/urls
	log block.log
}

# 
dest blk_BL_socialnet {
	domainlist blk_BL_socialnet/domains
	urllist blk_BL_socialnet/urls
	log block.log
}

# 
dest blk_BL_spyware {
	domainlist blk_BL_spyware/domains
	urllist blk_BL_spyware/urls
	log block.log
}

# 
dest blk_BL_tracker {
	domainlist blk_BL_tracker/domains
	urllist blk_BL_tracker/urls
	log block.log
}

# 
dest blk_BL_updatesites {
	domainlist blk_BL_updatesites/domains
	urllist blk_BL_updatesites/urls
	log block.log
}

# 
dest blk_BL_urlshortener {
	domainlist blk_BL_urlshortener/domains
	urllist blk_BL_urlshortener/urls
	log block.log
}

# 
dest blk_BL_violence {
	domainlist blk_BL_violence/domains
	urllist blk_BL_violence/urls
	log block.log
}

# 
dest blk_BL_warez {
	domainlist blk_BL_warez/domains
	urllist blk_BL_warez/urls
	log block.log
}

# 
dest blk_BL_weapons {
	domainlist blk_BL_weapons/domains
	urllist blk_BL_weapons/urls
	log block.log
}

# 
dest blk_BL_webmail {
	domainlist blk_BL_webmail/domains
	urllist blk_BL_webmail/urls
	log block.log
}

# 
dest blk_BL_webphone {
	domainlist blk_BL_webphone/domains
	urllist blk_BL_webphone/urls
	log block.log
}

# 
dest blk_BL_webradio {
	domainlist blk_BL_webradio/domains
	urllist blk_BL_webradio/urls
	log block.log
}

# 
dest blk_BL_webtv {
	domainlist blk_BL_webtv/domains
	urllist blk_BL_webtv/urls
	log block.log
}

# vagina tetas striptis culo striptease stripteasse
dest palabras_blk {
	expressionlist palabras_blk/expressions
}

# 
rew nosslsearch {
	s@regexi ^(http://www.google..*/search?.*)@1&safe=active@r
	s@regexi ^(http://www.google..*/images?.*)@1&safe=active@r
}

# 
rew safesearch {
	s@(google..*/search?.*q=.*)@&safe=active@i
	s@(google..*/images.*q=.*)@&safe=active@i
	s@(google..*/groups.*q=.*)@&safe=active@i
	s@(google..*/news.*q=.*)@&safe=active@i
	s@(yandex..*/yandsearch?.*text=.*)@&fyandex=1@i
	s@(search.yahoo..*/search.*p=.*)@&vm=r&v=1@i
	s@(search.live..*/.*q=.*)@&adlt=strict@i
	s@(search.msn..*/.*q=.*)@&adlt=strict@i
	s@(.bing..*/.*q=.*)@&adlt=strict@i
	log block.log
}

# 
acl  {
	# 
	test  within test_porn {
		pass !blk_BL_porn palabras_blk all
		rewrite safesearch
		log block.log
		} else {
		pass !palabras_blk !blk_BL_porn all
		redirect http://10.0.0.6:80/sgerror.php?url=403%20&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
		rewrite safesearch
		log block.log
	}
	# 
	default  {
		pass !palabras_blk !blk_BL_porn all
		redirect http://pranaglobal.com.ar/acceso_denegado.jpg
		rewrite safesearch
		log block.log
	}
}

![firewall rules.jpg](/public/imported_attachments/1/firewall rules.jpg)
![firewall rules.jpg_thumb](/public/imported_attachments/1/firewall rules.jpg_thumb)
![service status.jpg](/public/imported_attachments/1/service status.jpg)
![service status.jpg_thumb](/public/imported_attachments/1/service status.jpg_thumb)

mir

Did you remember to add localhost and your pfsense box' interface IP to 'External Cache-Managers' under the tab Access Control?

My setting:
LAN: 192.168.2.0/24. Gateway (pfsense) 192.168.2.1
External Cache-Managers: 127.0.0.1;192.168.2.1;

rocaembole

yes =/

![external cachemgr.jpg](/public/imported_attachments/1/external cachemgr.jpg)
![external cachemgr.jpg_thumb](/public/imported_attachments/1/external cachemgr.jpg_thumb)

mir

I can see that I have the following link: ln -s /var/log/squid /var/squid/logs/

rocaembole

In my case /var/log/squid doesn't exists :)

mir

Does this folder have any contents? /var/squid/logs/
That folder did not exists on my pfsense either but the reason was that squid seems to log into /var/log/squid

rocaembole

[2.1.5-RELEASE][root@pfsense.localdomain]/var/squid/logs(42): ls
access.log cache.log squid.pid store.log

mir

[2.2-RC][root@pfsense.datanom.net]/var/squid/logs: ls -l
total 73472
-rw-r–--- 1 proxy proxy 2009012 Jan 12 19:53 access.log
-rw-r----- 1 proxy proxy 4067785 Jan 12 00:00 access.log.0
-rw-r----- 1 proxy proxy 3174363 Jan 11 00:00 access.log.1
-rw-r----- 1 proxy proxy 3861748 Jan 1 23:59 access.log.10
-rw-r----- 1 proxy proxy 4091622 Dec 31 23:59 access.log.11
-rw-r----- 1 proxy proxy 3596919 Dec 31 00:00 access.log.12
-rw-r----- 1 proxy proxy 3379364 Dec 29 23:59 access.log.13
-rw-r----- 1 proxy proxy 3471317 Dec 29 00:00 access.log.14
-rw-r----- 1 proxy proxy 3594618 Jan 10 00:00 access.log.2
-rw-r----- 1 proxy proxy 2675342 Jan 9 00:00 access.log.3
-rw-r----- 1 proxy proxy 3242169 Jan 8 00:00 access.log.4
-rw-r----- 1 proxy proxy 2105987 Jan 7 00:00 access.log.5
-rw-r----- 1 proxy proxy 16549068 Jan 6 00:00 access.log.6
-rw-r----- 1 proxy proxy 3253532 Jan 4 23:59 access.log.7
-rw-r----- 1 proxy proxy 3322237 Jan 4 00:00 access.log.8
-rw-r----- 1 proxy proxy 4927550 Jan 2 23:59 access.log.9
-rw-r----- 1 proxy proxy 71356 Jan 12 19:46 cache.log
-rw-r----- 1 proxy proxy 312265 Jan 11 15:23 cache.log.0
-rw-r----- 1 proxy proxy 12340 Jan 10 20:01 cache.log.1
-rw-r----- 1 proxy proxy 19693 Jan 1 23:33 cache.log.10
-rw-r----- 1 proxy proxy 4761 Dec 31 23:23 cache.log.11
-rw-r----- 1 proxy proxy 2073 Dec 30 22:22 cache.log.12
-rw-r----- 1 proxy proxy 4231 Dec 29 22:22 cache.log.13
-rw-r----- 1 proxy proxy 2510 Dec 28 22:36 cache.log.14
-rw-r----- 1 proxy proxy 2623 Jan 9 16:35 cache.log.2
-rw-r----- 1 proxy proxy 1861 Jan 8 21:27 cache.log.3
-rw-r----- 1 proxy proxy 774 Jan 7 19:04 cache.log.4
-rw-r----- 1 proxy proxy 898 Jan 6 19:50 cache.log.5
-rw-r----- 1 proxy proxy 8201 Jan 5 20:12 cache.log.6
-rw-r----- 1 proxy proxy 381 Jan 4 23:19 cache.log.7
-rw-r----- 1 proxy proxy 28029 Jan 3 22:23 cache.log.8
-rw-r----- 1 proxy proxy 6779 Jan 2 18:57 cache.log.9
-rw-r--r-- 1 proxy proxy 6 Jan 10 02:22 squid.pid
-rw-r----- 1 proxy proxy 6556746 Jan 10 02:28 store.log

rocaembole

cuz you rotate your logs <3

daxpfacc

Hi friends,

rocaembole

try to remove semicolon after 10.0.0.6, I have not and it works, then it say "separated" by semi-colons.
Just to try :)

rocaembole

I see that too and tried without semicolon but neither works

Steve Evans

@rocaembole:

I'm trying by proxy and by LAN (My squid's in non transparent mode) and can't access…

I use transparent mode. I wonder if that's part of your problem?

Steve

rocaembole

Thanks! that was my problem. Now i can access. thanks!

newkansan

I'm on pfSense 2.2.1 and I just installed squid3 and set up a simple transparent proxy. No clamav, no squidguard. I was trying to follow the OP's tuturial to add access to the cachemgr tab:

cd /usr/local/www
ln -s /usr/local/libexec/squid/cachemgr.cgi
cd /usr/local/etc/squid
cp cachemgr.conf.default cachemgr.conf

The problem is the paths are all different.
/usr/local/libexec/squid and /usr/local/etc/squid do not exist.

Any ideas?

Thank you.

edit: I figured it out (I'm a BSD noob…sorry)

Here are the paths.

/usr/pbi/squid-i386/local/etc/squid

/usr/pbi/squid-i386/local/libexec/squid

I'm not sure if the paths changed due to newer pfSense version, or the fact I'm using squid3 vs. squid, but it did work for me!