Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cant access internal resources when using pfsense squid?

    Scheduled Pinned Locked Moved Cache/Proxy
    14 Posts 4 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK Offline
      KOM
      last edited by

      Do you have your client set to bypass proxy for internal addresses?  That might avoid the problem altogether.

      1 Reply Last reply Reply Quote 0
      • M Offline
        meruem
        last edited by

        @KOM:

        Do you have your client set to bypass proxy for internal addresses?  That might avoid the problem altogether.

        I could but I really want to know why PFSense SQUID has this issue but other SQUID's I use on my internal network (like the Synology DiskStation Proxy Server) do not have the issue

        1 Reply Last reply Reply Quote 0
        • M Offline
          meruem
          last edited by

          pfsense squid access.log when going to http://192.168.1.51:8081/home/

          These logs come up then nothing… it stops

          
1431809714.997     20 192.168.1.5 TCP_MISS/200 8451 GET http://192.168.1.51:8081/home/ - DIRECT/192.168.1.51 text/html
1431809715.141     42 192.168.1.5 TCP_MISS/200 22837 GET http://192.168.1.51:8081/images/ico/favicon.ico - DIRECT/192.168.1.51 image/vnd.microsoft.icon
1431809715.160     61 192.168.1.5 TCP_MISS/200 72968 GET http://192.168.1.51:8081/images/ico/favicon-196.png - DIRECT/192.168.1.51 image/png
1431809715.187     46 192.168.1.5 TCP_MISS/200 51256 GET http://192.168.1.51:8081/images/ico/favicon-160.png - DIRECT/192.168.1.51 image/png
1431809715.189     27 192.168.1.5 TCP_MISS/200 21500 GET http://192.168.1.51:8081/images/ico/favicon-96.png - DIRECT/192.168.1.51 image/png
1431809715.208     19 192.168.1.5 TCP_MISS/200 10956 GET http://192.168.1.51:8081/images/ico/favicon-64.png - DIRECT/192.168.1.51 image/png
1431809715.219     29 192.168.1.5 TCP_MISS/200 3767 GET http://192.168.1.51:8081/images/ico/favicon-32.png - DIRECT/192.168.1.51 image/png
1431809715.220     11 192.168.1.5 TCP_MEM_HIT/200 1834 GET http://192.168.1.51:8081/images/ico/favicon-16.png - DIRECT/192.168.1.51 image/png
          1 Reply Last reply Reply Quote 0
          • K Offline
            killmasta93
            last edited by

            I had the same problem  https://forum.pfsense.org/index.php?topic=93679.msg520471#msg520471

            Thanks to Kom helped me out just bypass it better altogether or make a rule to allow and log it.

            Tutorials:

            https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

            1 Reply Last reply Reply Quote 0
            • M Offline
              meruem
              last edited by

              @killmasta93:

              I had the same problem  https://forum.pfsense.org/index.php?topic=93679.msg520471#msg520471

              Thanks to Kom helped me out just bypass it better altogether or make a rule to allow and log it.

              It's not the same. i really think this is a serious issue that should be addressed

              If i'm at a remote location, and I use ssh LocalForward localhost:port 192.168.1.1:3128 (pfsense squid) , I can not access some internal resources (as i detailed in this thread) . however if I do ssh LocalForward localhost:port 192.168.1.15:3128 (synology diskstation squid) I can access all internal resources.

              I shouldn't be forced to keep around a second squid end point just to get things to work. What if one day I want to remove the synology, or shut it down for maintenance.

              The pfsense is the much more concrete equipment out of the two and will stay around much longer

              this issue doesnt just happen through a SSH tunnel. when im on my local lan, and i proxy directly to 192.168.1.1:3128, i get the same issue with access internal resources.

              the true seriousness of the issue: if i bypass internal resources from my pfsense squid proxy, how can I access them over the ssh tunnel + squid proxy? I cant, and there is the true problem and why I think this is a serious problem

              the second crappy part about this is, i've looked at every debug log I can think of and i'm getting zero help from the logs.

              i could just use socks for specific resources that dont work with pfsense squid, but i dont like compromises & workarounds, i like things to work

              1 Reply Last reply Reply Quote 0
              • K Offline
                killmasta93
                last edited by

                hmm..are you running 2.2.2 pfSense?

                Tutorials:

                https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                1 Reply Last reply Reply Quote 0
                • C Offline
                  chris4916
                  last edited by

                  First it could make sense to access even internal servers relying on Squid (running on pfSense or not, this is another debate) however, for internal servers, purpose will be only cache and anti-virus. I don't think you intend to apply access control and filtering for internal servers isn't it? And given the dynamic aspect of even internal servers, does cache really makes sense?

                  Anyway, this could be part of your plan and this is definitely your decision.

                  Second point: am I correct guessing that servers you can't access are all running on ports different from standard HTTP/HTTPS port (i.e. 80, 8080 and 443)?

                  Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                  1 Reply Last reply Reply Quote 0
                  • M Offline
                    meruem
                    last edited by

                    @killmasta93:

                    hmm..are you running 2.2.2 pfSense?

                    Yep

                    2.2.2-RELEASE (amd64)
                    built on Mon Apr 13 20:10:22 CDT 2015
                    FreeBSD 10.1-RELEASE-p9

                    with this mobo http://www.supermicro.com/products/motherboard/celeron/x10/x10sba-l.cfm

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      meruem
                      last edited by

                      @chris4916:

                      First it could make sense to access even internal servers relying on Squid (running on pfSense or not, this is another debate) however, for internal servers, purpose will be only cache and anti-virus. I don't think you intend to apply access control and filtering for internal servers isn't it? And given the dynamic aspect of even internal servers, does cache really makes sense?

                      Anyway, this could be part of your plan and this is definitely your decision.

                      Second point: am I correct guessing that servers you can't access are all running on ports different from standard HTTP/HTTPS port (i.e. 80, 8080 and 443)?

                      I'll try changing the port to 80/443 and see if it works

                      1 Reply Last reply Reply Quote 0
                      • M Offline
                        meruem
                        last edited by

                        Also going to try and look at the tornado log files

                        1 Reply Last reply Reply Quote 0
                        • M Offline
                          meruem
                          last edited by

                          I changed http://192.168.1.51:8081/home/ to http://192.168.1.51:8080/home/ , same issue. PFSense SQUID times out when I try and go to the website. And again SOCKS or Synology SQUID still work fine

                          1 Reply Last reply Reply Quote 0
                          • M Offline
                            meruem
                            last edited by

                            never was able to figure this one out  :'(

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.