PfSense 2.2: Squid 3.4.10_2 pkg 0.2.6 redirection not working in transparent mode

Steve Evans

Interesting.

Given that I see the lack of redirection with nc as well as squid I'm inclined to think this may not be an issue with squid at all, but rather with pf. That'd be quite a fundamental problem for pfSense!

I made THIS post in the Firewalling forum to see if that provides any insight. For now I'm going to see if a minimal pf configuration helps.

Thanks,

Steve

Steve Evans

With the default firewall rules, squid is still not working in transparent mode.

As you're seeing multiple reports of this, could you please raise a bug report that captures the collective experience.

Thanks,

Steve

marcelloc

@Steve:

With the default firewall rules, squid is still not working in transparent mode.

As you're seeing multiple reports of this, could you please raise a bug report that captures the collective experience.

Thanks,

Steve

I'll need to create an i386 virtual machine to get same problem. On all my labs, transparent proxy is working fine.

Steve Evans

OK, thanks.

I thought the following might be of use to confirm the squid configuration I have installed.

: squid -v
Squid Cache: Version 3.4.10
configure options:  '--with-default-user=squid' '--bindir=/usr/local/sbin' '--sbindir=/usr/local/sbin' '--datadir=/usr/local/etc/squid' '--libexecdir=/usr/local/libexec/squid' '--localstatedir=/var' '--sysconfdir=/usr/local/etc/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid/squid.pid' '--with-swapdir=/var/squid/cache' '--enable-auth' '--enable-build-info' '--enable-loadable-modules' '--enable-removal-policies=lru heap' '--disable-epoll' '--disable-linux-netfilter' '--disable-linux-tproxy' '--disable-translation' '--disable-arch-native' '--enable-eui' '--enable-cache-digests' '--enable-delay-pools' '--enable-ecap' '--disable-esi' '--enable-follow-x-forwarded-for' '--enable-htcp' '--enable-icap-client' '--enable-icmp' '--enable-ident-lookups' '--enable-ipv6' '--enable-kqueue' '--with-large-files' '--enable-http-violations' '--without-nettle' '--enable-snmp' '--enable-ssl' '--enable-ssl-crtd' '--disable-stacktraces' '--disable-ipf-transparent' '--disable-ipfw-transparent' '--enable-pf-transparent' '--with-nat-devpf' '--disable-forw-via-db' '--enable-wccp' '--enable-wccpv2' '--enable-auth-basic=DB MSNT MSNT-multi-domain NCSA PAM POP3 RADIUS fake getpwnam LDAP NIS' '--enable-auth-digest=file' '--enable-external-acl-helpers=file_userip time_quota unix_group LDAP_group' '--enable-auth-negotiate=kerberos wrapper' '--enable-auth-ntlm=fake smb_lm' '--enable-storeio=ufs aufs diskd' '--enable-disk-io=AIO Blocking IpcIo Mmapped DiskThreads DiskDaemon' '--enable-log-daemon-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-storeid-rewrite-helpers=file' '--with-openssl=/usr' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=i386-portbld-freebsd10.1' 'build_alias=i386-portbld-freebsd10.1' 'CC=cc' 'CFLAGS=-O2 -pipe  -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing' 'LDFLAGS= -L/usr/local/lib -L/usr/local/lib -pthread -Wl,-rpath,/usr/lib:/usr/local/lib -L/usr/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing  -Wno-unused-private-field' 'CPP=cpp' 'PKG_CONFIG=pkgconf' --enable-ltdl-convenience

Steve

Steve Evans

Now here's an oddity. There are two squid binaries installed. Potential for inconsistencies here…

: which squid
/usr/local/sbin/squid
: /usr/local/sbin/squid -v 
Squid Cache: Version 3.4.10
configure options:  '--with-default-user=squid' '--bindir=/usr/local/sbin' '--sbindir=/usr/local/sbin' '--datadir=/usr/local/etc/squid' '--libexecdir=/usr/local/libexec/squid' '--localstatedir=/var' '--sysconfdir=/usr/local/etc/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid/squid.pid' '--with-swapdir=/var/squid/cache' '--enable-auth' '--enable-build-info' '--enable-loadable-modules' '--enable-removal-policies=lru heap' '--disable-epoll' '--disable-linux-netfilter' '--disable-linux-tproxy' '--disable-translation' '--disable-arch-native' '--enable-eui' '--enable-cache-digests' '--enable-delay-pools' '--enable-ecap' '--disable-esi' '--enable-follow-x-forwarded-for' '--enable-htcp' '--enable-icap-client' '--enable-icmp' '--enable-ident-lookups' '--enable-ipv6' '--enable-kqueue' '--with-large-files' '--enable-http-violations' '--without-nettle' '--enable-snmp' '--enable-ssl' '--enable-ssl-crtd' '--disable-stacktraces' '--disable-ipf-transparent' '--disable-ipfw-transparent' '--enable-pf-transparent' '--with-nat-devpf' '--disable-forw-via-db' '--enable-wccp' '--enable-wccpv2' '--enable-auth-basic=DB MSNT MSNT-multi-domain NCSA PAM POP3 RADIUS fake getpwnam LDAP NIS' '--enable-auth-digest=file' '--enable-external-acl-helpers=file_userip time_quota unix_group LDAP_group' '--enable-auth-negotiate=kerberos wrapper' '--enable-auth-ntlm=fake smb_lm' '--enable-storeio=ufs aufs diskd' '--enable-disk-io=AIO Blocking IpcIo Mmapped DiskThreads DiskDaemon' '--enable-log-daemon-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-storeid-rewrite-helpers=file' '--with-openssl=/usr' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=i386-portbld-freebsd10.1' 'build_alias=i386-portbld-freebsd10.1' 'CC=cc' 'CFLAGS=-O2 -pipe  -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing' 'LDFLAGS= -L/usr/local/lib -L/usr/local/lib -pthread -Wl,-rpath,/usr/lib:/usr/local/lib -L/usr/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing  -Wno-unused-private-field' 'CPP=cpp' 'PKG_CONFIG=pkgconf' --enable-ltdl-convenience
: /usr/pbi/squid-i386/local/sbin/squid -v
Shared object "libmd5.so.0" not found, required by "squid"

Steve

marcelloc

@Steve:

Now here's an oddity.

This is one of pbi behaviors. same binary, different folder, different results. (Imagine get all it working together :))

And here is the confirmation that pbi build on i386 is outdated

'--disable-ipf-transparent' '--disable-ipfw-transparent'

Go to amd64 and it will work :)

Thanks for your feedback

Steve Evans

Hi Marcelloc,

As I'm running on a Pentium-M on a Watchguard Firebox x750e I'm afraid that I'm constrained somewhat to only running 32 bit. That said, one of the great things about pfSense is it's a great application to run on older hardware, so thanks for keeping the i386 version alive!

How soon might a package update for i386 be forthcoming would you guess?

Thanks again,

Steve

marcelloc

Just wait core team to compile it again. The compile args were fixed few weeks ago but only amd64 was rebuild.

georgio777

@marcelloc:

Just wait core team to compile it again. The compile args were fixed few weeks ago but only amd64 was rebuild.

I am running 2.2-RELEASE (amd64) and transparent mode isn't working either.

marcelloc

@georgio777:

I am running 2.2-RELEASE (amd64) and transparent mode isn't working either.

Check package config again, it's working on my setup and on my labs.

georgio777

@marcelloc:

@georgio777:

I am running 2.2-RELEASE (amd64) and transparent mode isn't working either.

Check package config again, it's working on my setup and on my labs.

Not sure what's wrong, I am getting the following errors on the system/squid logs.

Squid log:

2015/01/27 13:35:16 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/27 13:35:17 kid1| sendto FD 24: (1) Operation not permitted
2015/01/27 13:35:17 kid1| ipcCreate: CHILD: hello write test failed
2015/01/27 13:44:36 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/27 13:44:36 kid1| sendto FD 24: (1) Operation not permitted
2015/01/27 13:44:36 kid1| ipcCreate: CHILD: hello write test failed
2015/01/27 13:54:48 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/27 13:54:48 kid1| sendto FD 24: (1) Operation not permitted
2015/01/27 13:54:48 kid1| ipcCreate: CHILD: hello write test failed
2015/01/27 13:56:10 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/27 13:56:10 kid1| sendto FD 24: (1) Operation not permitted
2015/01/27 13:56:10 kid1| ipcCreate: CHILD: hello write test failed
2015/01/29 13:57:45 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/29 13:57:45 kid1| sendto FD 24: (1) Operation not permitted
2015/01/29 13:57:45 kid1| ipcCreate: CHILD: hello write test failed
2015/01/29 14:08:07 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/29 14:08:08 kid1| sendto FD 24: (1) Operation not permitted
2015/01/29 14:08:08 kid1| ipcCreate: CHILD: hello write test failed
2015/01/29 14:17:08 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/01/29 14:17:08 kid1| sendto FD 24: (1) Operation not permitted
2015/01/29 14:17:08 kid1| ipcCreate: CHILD: hello write test failed

System log:

Jan 29 12:32:00 pfsense php-fpm[86134]: /rc.filter_configure_sync: The command '/sbin/pfctl -nf /tmp/rules.test.packages' returned exit code '1', the output was '/tmp/rules.test.packages:37: syntax error /tmp/rules.test.packages:38: syntax error /tmp/rules.test.packages:39: syntax error /tmp/rules.test.packages:40: syntax error' 
Jan 29 12:32:00 pfsense php-fpm[86134]: /rc.filter_configure_sync: There was an error while parsing the package filter rules for /usr/local/pkg/squid.inc.
Jan 29 12:32:03 pfsense php-fpm[86134]: /rc.filter_configure_sync: The command '/sbin/pfctl -nf /tmp/rules.test.packages' returned exit code '1', the output was '/tmp/rules.test.packages:36: syntax error' 
Jan 29 12:32:03 pfsense php-fpm[86134]: /rc.filter_configure_sync: There was an error while parsing the package filter rules for /usr/local/pkg/squid.inc.

Hope you can help.

Thanks.

marcelloc

Problably you've enabled transparent mode but did not selected any interface for interception.

Steve Evans

@marcelloc:

@georgio777:

I am running 2.2-RELEASE (amd64) and transparent mode isn't working either.

Check package config again, it's working on my setup and on my labs.

Could you please confirm that my experiment using nc works in your setup. This will help determine if the issue is with squid or the firewall.

Thanks,

Steve

Steve Evans

@georgio777:

@marcelloc:

Just wait core team to compile it again. The compile args were fixed few weeks ago but only amd64 was rebuild.

I am running 2.2-RELEASE (amd64) and transparent mode isn't working either.

Hi Marcelloc,

Any idea when the new package might be available?

Thanks,

Steve

marcelloc

No. I'll ping Renato again and ask for a update to 3.4.11

Steve Evans

Thank you.

Steve

eqx

@Steve:

Thank you.
Steve

Bump for i386 build:)

I'm also on a i386 box and i wonder if i should go with squid or squid3 ? i've had squid running under other circumstances, but not with pfSense on i386. Im already running pfBlockerNG with several alias lists, and i'd want squid/squid3 to not work for sites that are blocked there, obviously. Does squid3 transparent proxies 'bypass' the pfBlockerNG rules, or are the rules applied before the traffic even reaches it?

I think SquidGuard rule administering are a lot harder than in pfBlocker so i'd prefer to keep all the rules management there and have squid3 only do transparent proxying for the sites that pass the firewall.

Steve Evans

@marcelloc:

@Steve:

Now here's an oddity.

This is one of pbi behaviors. same binary, different folder, different results. (Imagine get all it working together :))

And here is the confirmation that pbi build on i386 is outdated
'--disable-ipf-transparent' '--disable-ipfw-transparent'
Go to amd64 and it will work :)

Thanks for your feedback

I've just installed 3.4.10_2 pkg 0.2.6 and I'm seeing the following config using "squid -v"

'--disable-ipf-transparent' '--disable-ipfw-transparent' '--enable-pf-transparent'

This is the same as before… :(

Although I was offered an upgrade I now realise the version hasn't actually changed. Should I have expected this for the recompiled version?

Steve

sujyo1

Here is mine for more info…

2.2-RELEASE (i386)
built on Thu Jan 22 14:04:25 CST 2015
FreeBSD 10.1-RELEASE-p4

Intel(R) Atom(TM) CPU N280 @ 1.66GHz
2 CPUs: 1 package(s) x 1 core(s) x 2 HTT threads

$ squid -v
Squid Cache: Version 3.4.10
configure options: '–with-default-user=squid' '--bindir=/usr/local/sbin' '--sbindir=/usr/local/sbin' '--datadir=/usr/local/etc/squid' '--libexecdir=/usr/local/libexec/squid' '--localstatedir=/var' '--sysconfdir=/usr/local/etc/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid/squid.pid' '--with-swapdir=/var/squid/cache' '--enable-auth' '--enable-build-info' '--enable-loadable-modules' '--enable-removal-policies=lru heap' '--disable-epoll' '--disable-linux-netfilter' '--disable-linux-tproxy' '--disable-translation' '--disable-arch-native' '--enable-eui' '--enable-cache-digests' '--enable-delay-pools' '--enable-ecap' '--disable-esi' '--enable-follow-x-forwarded-for' '--enable-htcp' '--enable-icap-client' '--enable-icmp' '--enable-ident-lookups' '--enable-ipv6' '--enable-kqueue' '--with-large-files' '--enable-http-violations' '--without-nettle' '--enable-snmp' '--enable-ssl' '--enable-ssl-crtd' '--disable-stacktraces' '--disable-ipf-transparent' '--disable-ipfw-transparent' '--enable-pf-transparent' '--with-nat-devpf' '--disable-forw-via-db' '--enable-wccp' '--enable-wccpv2' '--enable-auth-basic=DB MSNT MSNT-multi-domain NCSA PAM POP3 RADIUS fake getpwnam LDAP NIS' '--enable-auth-digest=file' '--enable-external-acl-helpers=file_userip time_quota unix_group LDAP_group' '--enable-auth-negotiate=kerberos wrapper' '--enable-auth-ntlm=fake smb_lm' '--enable-storeio=ufs aufs diskd' '--enable-disk-io=AIO Blocking IpcIo Mmapped DiskThreads DiskDaemon' '--enable-log-daemon-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-storeid-rewrite-helpers=file' '--with-openssl=/usr' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=i386-portbld-freebsd10.1' 'build_alias=i386-portbld-freebsd10.1' 'CC=cc' 'CFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing' 'LDFLAGS= -L/usr/local/lib -L/usr/local/lib -pthread -Wl,-rpath,/usr/lib:/usr/local/lib -L/usr/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include -I/usr/include -fstack-protector -DLDAP_DEPRECATED -fno-strict-aliasing -Wno-unused-private-field' 'CPP=cpp' 'PKG_CONFIG=pkgconf' --enable-ltdl-convenience

Log:

Feb 14 02:00:57 syslogd: kernel boot file is /boot/kernel/kernel
Feb 14 02:00:57 syslogd: exiting on signal 15
Feb 14 02:00:57 check_reload_status: Syncing firewall
Feb 14 02:00:00 php: sarg.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.
Feb 14 01:41:33 sshlockout[57823]: sshlockout/webConfigurator v3.0 starting up
Feb 14 01:41:33 php-fpm[11780]: /index.php: Successful login for user 'admin' from: X.X.X.X
Feb 14 01:41:33 php-fpm[11780]: /index.php: Successful login for user 'admin' from: X.X.X.X
Feb 14 01:01:00 php: rc.dyndns.update: phpDynDNS (X.X.X.X.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
Feb 14 01:00:00 php: sarg.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.
Feb 14 00:00:44 check_reload_status: Reloading filter
Feb 14 00:00:43 Squid_Alarm[8897]: Squid has resumed. Reconfiguring filter.
Feb 14 00:00:43 Squid_Alarm[7332]: Reconfiguring filter…
Feb 14 00:00:40 squid[6274]: Squid Parent: (squid-1) process 6758 started
Feb 14 00:00:40 squid[6274]: Squid Parent: will start 1 kids
Feb 14 00:00:39 Squid_Alarm[3586]: Attempting restart…
Feb 14 00:00:39 Squid_Alarm[3308]: Squid has exited. Reconfiguring filter.
Feb 14 00:00:34 php: swapstate_check.php: Squid cache and/or swap.state exceeded size limits. Removing and rotating. File was 293760 bytes, 0% of total disk space.
Feb 14 00:00:34 squid[94339]: Squid Parent: (squid-1) process 94855 exited with status 0
Feb 14 00:00:20 squid[85421]: Exiting due to repeated, frequent failures
Feb 14 00:00:20 squid[85421]: Squid Parent: (squid-1) process 99037 will not be restarted due to repeated, frequent failures
Feb 14 00:00:20 squid[85421]: Squid Parent: (squid-1) process 99037 exited with status 1
Feb 14 00:00:20 (squid-1): Failed to verify one of the swap directories, Check cache.log for details. Run 'squid -z' to create swap directories if needed, or if running Squid for the first time.
Feb 14 00:00:19 squid[85421]: Squid Parent: (squid-1) process 99037 started
Feb 14 00:00:17 php: sarg.php: The command 'export LC_ALL=C && /usr/pbi/sarg-i386/bin/sarg -d date +%d/%m/%Y-date +%d/%m/%Y' returned exit code '1', the output was 'SARG: Records in file: 385516, reading: 0.00%^MSARG: Records in file: 5000, reading: 1.30%^MSARG: Records in file: 10000, reading: 2.59%^MSARG: Records in file: 15000, reading: 3.89%^MSARG: Records in file: 20000, reading: 5.19%^MSARG: Records in file: 25000, reading: 6.48%^MSARG: Records in file: 30000, reading: 7.78%^MSARG: Records in file: 35000, reading: 9.08%^MSARG: Records in file: 40000, reading: 10.38%^MSARG: Records in file: 45000, reading: 11.67%^MSARG: Records in file: 50000, reading: 12.97%^MSARG: Records in file: 55000, reading: 14.27%^MSARG: Records in file: 60000, reading: 15.56%^MSARG: Records in file: 65000, reading: 16.86%^MSARG: Records in file: 70000, reading: 18.16%^MSARG: Records in file: 75000, reading: 19.45%^MSARG: Records in file: 80000, reading: 20.75%^MSARG: Records in file: 85000, reading: 22.05%^MSARG: Records
Feb 14 00:00:16 squid[85421]: Squid Parent: (squid-1) process 97629 exited with status 1
Feb 14 00:00:16 (squid-1): Failed to verify one of the swap directories, Check cache.log for details. Run 'squid -z' to create swap directories if needed, or if running Squid for the first time.
Feb 14 00:00:16 squid[85421]: Squid Parent: (squid-1) process 97629 started
Feb 14 00:00:13 squid[85421]: Squid Parent: (squid-1) process 95605 exited with status 1
Feb 14 00:00:13 (squid-1): Failed to verify one of the swap directories, Check cache.log for details. Run 'squid -z' to create swap directories if needed, or if running Squid for the first time.
Feb 14 00:00:12 squid[85421]: Squid Parent: (squid-1) process 95605 started
Feb 14 00:00:09 squid[85421]: Squid Parent: (squid-1) process 95125 exited with status 1
Feb 14 00:00:09 (squid-1): Failed to verify one of the swap directories, Check cache.log for details. Run 'squid -z' to create swap directories if needed, or if running Squid for the first time.
Feb 14 00:00:09 squid[85421]: Squid Parent: (squid-1) process 95125 started
Feb 14 00:00:08 squid[94339]: Squid Parent: (squid-1) process 94855 started
Feb 14 00:00:08 squid[94339]: Squid Parent: will start 1 kids
Feb 14 00:00:07 php: swapstate_check.php: The command '/usr/pbi/squid-i386/sbin/squid -k kill -f /usr/pbi/squid-i386/local/etc/squid/squid.conf' returned exit code '1', the output was 'squid: ERROR: Could not send signal 9 to process 86112: (3) No such process'
Feb 14 00:00:06 squid[85421]: Squid Parent: (squid-1) process 89244 exited with status 1
Feb 14 00:00:06 (squid-1): Failed to verify one of the swap directories, Check cache.log for details. Run 'squid -z' to create swap directories if needed, or if running Squid for the first time.
Feb 14 00:00:05 squid[85421]: Squid Parent: (squid-1) process 89244 started
Feb 14 00:00:02 kernel: pid 86112 (squid), uid 62: exited on signal 6
Feb 14 00:00:01 php: swapstate_check.php: Creating squid cache subdirs in /var/squid/cache
Feb 14 00:00:01 php: swapstate_check.php: Creating Squid cache dir /var/squid/cache
Feb 14 00:00:01 php: sarg.php: Sarg: force refresh now with -d date +%d/%m/%Y-date +%d/%m/%Y args, compress(on) and none action after sarg finish.

Steve Evans

Hi Sujyo1,

You report the squid version/config and startup logs, but you don't indicate what issues you are seeing. Is it that transparent mode isn't working for you? If so do it prior to your upgrade to 2.2 with your current configuration?

Thanks,

Steve