Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Proxy causing time outs.

    Scheduled Pinned Locked Moved Cache/Proxy
    29 Posts 2 Posters 4.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM
      last edited by

      No, it should just work.  If HTTPS sites are working, HTTP sites should be no problem.  Don't use squid2, stay on squid3.  When the timeouts are happening, you can shell in and run:

      squidclient -h squid_ip_address -p 3128 mgr:info

      look for the Median Service Times, and look a a large number that would indicate a slowdown.  Also, look at /var/log/squid/access.log and cache.log for clues.

      1 Reply Last reply Reply Quote 0
      • M
        Mr.b
        last edited by

        Thanks for the command to type in. I used this command on the pfsense box via ssh and got this:

        Sending HTTP request ... done.
HTTP/1.1 403 Forbidden
Server: squid/3.4.10
Mime-Version: 1.0
Date: Mon, 27 Apr 2015 15:45:11 GMT
Content-Type: text/html
Content-Length: 3082
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from localhost
X-Cache-Lookup: NONE from localhost:3128
Via: 1.1 localhost (squid/3.4.10)
Connection: close

<title>ERROR: The requested URL could not be retrieved</title>

# ERROR

## The requested URL could not be retrieved

* * *

The following error was encountered while trying to retrieve the URL: [cache_object://10.0.0.1/info](cache_object://10.0.0.1/info)

> **Access Denied.**

Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.

Your cache administrator is [admin@localhost](mailto:admin@localhost?subject=CacheErrorInfo%20-%20ERR_ACCESS_DENIED&body=CacheHost%3A%20localhost%0D%0AErrPage%3A%20ERR_ACCESS_DENIED%0D%0AErr%3A%20%5Bnone%5D%0D%0ATimeStamp%3A%20Mon,%2027%20Apr%202015%2015%3A45%3A11%20GMT%0D%0A%0D%0AClientIP%3A%2010.0.0.1%0D%0A%0D%0AHTTP%20Request%3A%0D%0AGET%20%2Finfo%20HTTP%2F1.0%0AHost%3A%2010.0.0.1%0D%0AUser-Agent%3A%20squidclient%2F3.4.10%0D%0AAccept%3A%20*%2F*%0D%0AConnection%3A%20close%0D%0A%0D%0A%0D%0A).

* * *

Generated Mon, 27 Apr 2015 15:45:11 GMT by localhost (squid/3.4.10)

        So after seeing the access is denied and tired adding the ip range of the whole network to use the squid proxy (ACL). So in my case its 10.0.0.0/8 (I know i don’t need range that big but I started testing with DHCP etc years ago and kept with it.). But i am still getting time outs. :-( .

        The Clients on the network are Mac, Linux, Andriod Devices, iOS Devices and Windows with the same result.

        1 Reply Last reply Reply Quote 0
        • KOMK
          KOM
          last edited by

          I have no idea what command you entered and what all that output is.  However, it seems that you aren't allowed to use Squid.  By default, the LAN network for pfSense is Squid's allowed network range.  I have seen cases where you uninstall and then reinstall and it's working, so I would try that because it should be working for you.

          1 Reply Last reply Reply Quote 0
          • M
            Mr.b
            last edited by

            Ive found this on the cache.log's.

            2015/04/27 21:49:23| pinger: Initialising ICMP pinger ...
2015/04/27 21:49:23|  icmp_sock: (1) Operation not permitted
2015/04/27 21:49:23| pinger: Unable to start ICMP pinger.
2015/04/27 21:49:23|  icmp_sock: (1) Operation not permitted
2015/04/27 21:49:23| pinger: Unable to start ICMPv6 pinger.
2015/04/27 21:49:23| FATAL: pinger: Unable to open any ICMP sockets.
2015/04/27 21:49:54 kid1| Starting Squid Cache version 3.4.10 for i386-portbld-freebsd10.1...
2015/04/27 21:49:54| pinger: Initialising ICMP pinger ...
2015/04/27 21:49:54|  icmp_sock: (1) Operation not permitted
2015/04/27 21:49:54| pinger: Unable to start ICMP pinger.
2015/04/27 21:49:54|  icmp_sock: (1) Operation not permitted
2015/04/27 21:49:54| pinger: Unable to start ICMPv6 pinger.
2015/04/27 21:49:54| FATAL: pinger: Unable to open any ICMP sockets.
2015/04/27 21:50:00| pinger: Initialising ICMP pinger ...
2015/04/27 21:50:00|  icmp_sock: (1) Operation not permitted
2015/04/27 21:50:00| pinger: Unable to start ICMP pinger.
2015/04/27 21:50:00|  icmp_sock: (1) Operation not permitted
2015/04/27 21:50:00| pinger: Unable to start ICMPv6 pinger.
2015/04/27 21:50:00| FATAL: pinger: Unable to open any ICMP sockets.
2015/04/27 21:50:05| pinger: Initialising ICMP pinger ...
2015/04/27 21:50:05|  icmp_sock: (1) Operation not permitted
2015/04/27 21:50:05| pinger: Unable to start ICMP pinger.
2015/04/27 21:50:05|  icmp_sock: (1) Operation not permitted
2015/04/27 21:50:05| pinger: Unable to start ICMPv6 pinger.
2015/04/27 21:50:05| FATAL: pinger: Unable to open any ICMP sockets.
            1 Reply Last reply Reply Quote 0
            • M
              Mr.b
              last edited by

              The other 2 log file's appear to be empty.

              1 Reply Last reply Reply Quote 0
              • KOMK
                KOM
                last edited by

                I'd blow it away and redo it from scratch.  You have some weird problem going on.

                1 Reply Last reply Reply Quote 0
                • M
                  Mr.b
                  last edited by

                  Ill give that a try.

                  I know i can backup DHCP settings etc etc but what would i select to backup usernames and password for my isp etc. In my mind it will make life a little faster when ive got time to reinstall.

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    Do a backup via Diagnostics - Backup/Restore, but set it to not backup packages.  Your pfSense settings will be saved but the package details will be lost.  That allows you to really start fresh but not have to reconfigure the basics.

                    1 Reply Last reply Reply Quote 0
                    • M
                      Mr.b
                      last edited by

                      I have just wiped and started again. Bootable USB FTW!!

                      All I have done is restore settings (for DHCP etc), go to squid3 in the packages, installed it, enabled it in transparent mode, checked if squid was running with top and timeout :-( .

                      EDIT : However i have noticed the same site as before are still working with the proxy cache.

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        I don't know if transparent mode is yet working on squid3.  Some others have been complaining it's broken.

                        1 Reply Last reply Reply Quote 0
                        • M
                          Mr.b
                          last edited by

                          I can try squi 3 in standard mode and see if it works (Slandered mode for me is It required username and password).

                          Will i need to set a user-name and password for each user or computer?

                          1 Reply Last reply Reply Quote 0
                          • KOMK
                            KOM
                            last edited by

                            ??? You don't need to specify a username and password in standard mode.  You do, however, need to either manually configure the client to use the proxy, or implement WPAD so the client can find it automatically.  Transparent mode is convenient but useless for HTTPS, which is the way everything is going these days.

                            1 Reply Last reply Reply Quote 0
                            • M
                              Mr.b
                              last edited by

                              Will WPAD work for all OS's? So it will autocratically detect for Linux, Mac, Andriod?

                              & would the settings return to default (ie no proxy etc) when the device leaves etc.

                              I am also looking at the captive portal which will help security as well.

                              I am testing the proxy with a Ubuntu VM before I block port 80 and redirect everything to the proxy.

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mr.b
                                last edited by

                                Is there another way to do this without a need a for a username and password?

                                I think i have found it. On the proxy setting I have set the authentication method to none in the Proxy server - Authentication.

                                On my test VM (Ubuntu Mate 15.04. Kill two birds with one Stone. Test Ubuntu MATE 15.04 and test the proxy. LOL.) I have set the gateway ip and squid port, And it seems to be working. The increased speed on web pages is noticeable.

                                WPAD i think is needed.

                                1 Reply Last reply Reply Quote 0
                                • KOMK
                                  KOM
                                  last edited by

                                  Will WPAD work for all OS's? So it will autocratically detect for Linux, Mac, Andriod?

                                  Windows, Mac, Linux - yes.  Android - no.

                                  & would the settings return to default (ie no proxy etc) when the device leaves etc.

                                  Yes.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    Mr.b
                                    last edited by

                                    Brilliant, I will look into that.

                                    All of the Android devices that connect to the network are known / allowed. So i do not see any reason i cant leave port 80 open to a static ip range (Unless i want to filter them. Then ill have to think of something.).

                                    The proxy was working for about half (test VM) and then it was timing out again. So i am currently going through the process of diagnosing it again.

                                    I did test the captive portal again and i love the idea of it and i am planning to use it in a different case if & when i need it. For what i need at the moment it is not necessary.

                                    1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM
                                      last edited by

                                      Autodetection of web proxies has been around for at least a decade.  That's what that Automatically detect settings checkbox does in Windows' Control Panel - Internet Options - LAN Settings - Automatic configuration.  I've seen a bug report filed against Android to get Google to add WPAD support but it hasn't happened yet.  I don't know about iPhone.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Mr.b
                                        last edited by

                                        Can I make a firewall rule to redirect traffic from port 80 / 8080 to the proxy port (Default 3128)? This should then start filtering for all devices such as Android, iOS etc.

                                        So far I am loving SquidGaurd and have started restricting access to my needs. I am half tempted to make a group for my server's and tighten security a little (Block everything and allow domain's that I want such as pfsense.org, ubuntu.com etc etc).

                                        1 Reply Last reply Reply Quote 0
                                        • KOMK
                                          KOM
                                          last edited by

                                          Can I make a firewall rule to redirect traffic from port 80 / 8080 to the proxy port (Default 3128)? This should then start filtering for all devices such as Android, iOS etc.

                                          That's essentially what Transparent Proxy does.  You're still going to have Man in the Middle warnings on all HTTPS sites if you do that.  Leave it up to the user to manually config the proxy settings if his device doesn't support auto-detection.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Mr.b
                                            last edited by

                                            Ok in that case ill take a look at implementing WPAD soon. I might end up doing it when no one is online to make life a little peaceful.

                                            Is there a plan to add WPAD into the WebUI (Config etc).

                                            How would I redirect traffic to work with the proxy. Its something ive never tried before and i would like to give it a try and learn what it does etc first hand.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.