Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Any chance of getting a working transparent proxy again?

    Scheduled Pinned Locked Moved Cache/Proxy
    31 Posts 9 Posters 7.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M Offline
      messerchmidt
      last edited by

      working for non https transparent mode

      do a fresh install of 2.2.1 @ x64

      install squid3 and squidguard dev

      create the necessary wdap files as per https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

      use urlresolver instead of dhcp forwarder in 2.2.1! - same idea and setup

      using the file manager and editor

      create a /cache directiory and set it to 30gb or so in squid 3

      configure squidguard

      start squid 3 and put on transparent mode

      do not sue the antivirus atm as it gives icamp errors

      you may want to use the service watch to retreat squid3 if it stops,etc

      1 Reply Last reply Reply Quote 0
      • T Offline
        tester_02
        last edited by

        I played around quite a bit and held off upgrading from 2.1.5 until just this week.  I've tried many times and always had to roll back to 2.1.5
        vmware workstation environment, 64bit pfsense.
        Uninstalled squid/squidguard.  Then ran the update.
        install squid 3
        install squidguard development (could never get the main version running).
        download blacklist.
        enable clamav in squid.  Then disable it.
        re-download blacklist.

        Seems to work now.  The main issue now is that after a reboot, everything crashes and fails to restart.
        Fix is to enable then disable clamav in squid.  Then re-download blacklist and it stays up and running.

        Definitely not good, but at least it's working.  Nowhere near as stable as when we were on 2.1.5 (or any previous version for that matter back to 1.2)

        Not pushing my luck on https proxy until this part is better.

        1 Reply Last reply Reply Quote 0
        • P Offline
          peter808
          last edited by

          @messerchmidt:

          working for non https transparent mode

          do a fresh install of 2.2.1 @ x64

          install squid3 and squidguard dev

          With squidguard dev installed and starting, squid now always crashes:

          Apr 7 07:53:07	squid[60452]: Squid Parent: (squid-1) process 69996 will not be restarted due to repeated, frequent failures
Apr 7 07:53:07	squid[60452]: Squid Parent: (squid-1) process 69996 exited with status 1
Apr 7 07:53:07	(squid-1): The redirector helpers are crashing too rapidly, need help!
Apr 7 07:53:06	squid[60452]: Squid Parent: (squid-1) process 69996 started

          @messerchmidt:

          create the necessary wdap files as per https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

          The howto you mentioned says: "To use squid authentication, squid cannot be used in transparent mode. "

          The rest you suggested does not seem to be related to the transparent proxy-problem, I guess, but thanks though.

          1 Reply Last reply Reply Quote 0
          • P Offline
            peter808
            last edited by

            @tester_02:

            I played around quite a bit and held off upgrading from 2.1.5 until just this week.  I've tried many times and always had to roll back to 2.1.5
            vmware workstation environment, 64bit pfsense.
            Uninstalled squid/squidguard.  Then ran the update.

            Did I get you right that squid transparent mode only seems to be running on pfsense 2.15?

            So what did you mean with "ran the upgrade"? You upgraded to the recent 2.2 after all, anyway?

            1 Reply Last reply Reply Quote 0
            • N Offline
              notaduck
              last edited by

              Well i have it running on 2.2.1
              have you disabled icmp?

              1 Reply Last reply Reply Quote 0
              • P Offline
                peter808
                last edited by

                yep.

                1 Reply Last reply Reply Quote 0
                • K Offline
                  kejianshi
                  last edited by

                  "Any chance of getting a working transparent proxy again?"

                  Seems to depend on who you ask.

                  magic8ball250.gif
                  magic8ball250.gif_thumb

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    Steve Evans
                    last edited by

                    Having another go at this, taking things slowly and making sure I've not overlooked anything.

                    I'm seeing the following in cache.log on startup.

                    2015/04/07 22:04:13 kid1| Starting Squid Cache version 3.4.10 for i386-portbld-freebsd10.1...
2015/04/07 22:04:14| pinger: Initialising ICMP pinger ...
2015/04/07 22:04:14|  icmp_sock: (1) Operation not permitted
2015/04/07 22:04:14| pinger: Unable to start ICMP pinger.
2015/04/07 22:04:14|  icmp_sock: (1) Operation not permitted
2015/04/07 22:04:14| pinger: Unable to start ICMPv6 pinger.
2015/04/07 22:04:14| FATAL: pinger: Unable to open any ICMP sockets.
2015/04/07 22:04:16 kid1| Starting Squid Cache version 3.4.10 for i386-portbld-freebsd10.1...
2015/04/07 22:04:16| pinger: Initialising ICMP pinger ...
2015/04/07 22:04:16|  icmp_sock: (1) Operation not permitted
2015/04/07 22:04:16| pinger: Unable to start ICMP pinger.
2015/04/07 22:04:16|  icmp_sock: (1) Operation not permitted
2015/04/07 22:04:16| pinger: Unable to start ICMPv6 pinger.
2015/04/07 22:04:16| FATAL: pinger: Unable to open any ICMP sockets.

                    Is this normal. Do I need to disable IPv6?

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • S Offline
                      Supermule Banned
                      last edited by

                      I did this… not getting through to HTTP sites but only HTTPS as expected.

                      Unchecked Suppress Squid Version -> clicked save.

                      Rebooted.

                      Now it worked with HTTP sites like it should.

                      Squid version is 2.7.9 pkg v.4.3.6

                      EDIT: pretty scary shit. It works for a short time, then it stops working again.

                      And nothing in the logs at all!

                      1 Reply Last reply Reply Quote 0
                      • KOMK Offline
                        KOM
                        last edited by

                        Squid2 was crap from what I understand.  Have you tried Squid3?

                        1 Reply Last reply Reply Quote 0
                        • S Offline
                          Supermule Banned
                          last edited by

                          Yes. But I cant get the damned ClamAV working….

                          V3 doesnt have the same issue.

                          1 Reply Last reply Reply Quote 0
                          • KOMK Offline
                            KOM
                            last edited by

                            When using Squid3, I just ignored or disabled the AV crap.  We already have a better solution running on the desktops, and it just slowed everything down when running on the router.

                            1 Reply Last reply Reply Quote 0
                            • S Offline
                              Supermule Banned
                              last edited by

                              It annoys me when disabled it still shows in services as not running together with the ICAP crap….

                              Can someone tell me how to get rid of that so it doesnt trick my OCD all the time?? :D

                              1 Reply Last reply Reply Quote 0
                              • KOMK Offline
                                KOM
                                last edited by

                                If you know PHP you could take a look through /usr/local/www/status_services.php and do something with that.

                                And yes, I fully agree that any services that are not enabled should not even show in the Service Status widget.  I don't know if they can programmatically distinguish between an enabled service that's stopped versus a disabled service.  Either way, it bugs me too that my eye keeps tripping on those little red icons.

                                1 Reply Last reply Reply Quote 0
                                • S Offline
                                  Supermule Banned
                                  last edited by

                                  TRUE THAT!!

                                  1 Reply Last reply Reply Quote 0
                                  • P Offline
                                    peter808
                                    last edited by

                                    So coming back to my original post (and believing in the strenght of the devs :) ) :

                                    is there any chance of getting a working transparent proxy again?

                                    1 Reply Last reply Reply Quote 0
                                    • M Offline
                                      maex
                                      last edited by

                                      This bugs me for some quite some time, too.
                                      Enabling transparent works for a couple of calls to websites - then it dies…
                                      Scarry is the right description...

                                      3.1.20 pkg 2.1.2 on pfsense 2.1.5
                                      I have to say that the previous package (whichever that was!?) was running just fine!

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.