Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Limiter blocks internet access (Squid transparent proxy)

    Scheduled Pinned Locked Moved Traffic Shaping
    73 Posts 34 Posters 36.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      Your "fills up the System logs" non-issue has nothing to do with the topic here. When you log ALL passed traffic, then yeah, your logs are going to fill up, limiters or not.

      1 Reply Last reply Reply Quote 0
      • E
        eri--
        last edited by

        @doktornotor:

        Hmmm? Not really sure how's this related to unbound, or even any resolver at all? When I put limiters on a NAT firewall rule, the traffic stop flowing. As simple as that.

        This should be fixed in 2.2.3 snapshots.

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          Thanks, will test as soon as nanobsd becomes usable again…  :D

          1 Reply Last reply Reply Quote 0
          • cwagzC
            cwagz
            last edited by

            @ermal:

            @doktornotor:

            Hmmm? Not really sure how's this related to unbound, or even any resolver at all? When I put limiters on a NAT firewall rule, the traffic stop flowing. As simple as that.

            This should be fixed in 2.2.3 snapshots.

            I am seeing this problem on 2.2.3-DEVELOPMENT (amd64) built on Fri Jun 19 14:25:29 CDT 2015 FreeBSD 10.1-RELEASE-p13.  No traffic with limiter and transparent proxy.

            Netgate 6100 MAX

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by

              Yeah this is still broken. Don't use limiters on NAT.

              https://redmine.pfsense.org/issues/4596
              https://redmine.pfsense.org/issues/4590

              1 Reply Last reply Reply Quote 0
              • N
                NABAMB
                last edited by

                Still not working on Pfsense 2.2.3 final release. I need both, limiter and  transparent squid proxy to work together for my scenario.

                Regards,

                Nabeel

                1 Reply Last reply Reply Quote 0
                • A
                  Alfanetindo
                  last edited by

                  I have been having this problem also. It's a BIG problem actually for me. Does anyone know if it's been fixed yet, and if not if it's been brought to the developers attention ?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Apparently the changes to fix this are significant so they have pushed it to 2.3.  I see they're planning a 2.2.5 first so you're looking at months (at least) before limiters are usable again. Use 2.1.5 and hope no significant vulnerabilities appear since they have stated they will not be patched.  Or evaluate other options, as I am.

                    2.2 is, for the most part, useless if you rely on dummynet limiters.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • A
                      Abhishek
                      last edited by

                      @doktornotor:

                      Well then stick with 2.1.5 until fixed.

                      Can any1 share 2.1.5 v pfsense usb image ?

                      2.3-RC (amd64)
                      built on Mon Apr 04 17:09:32 CDT 2016
                      FreeBSD 10.3-RELEASE
                      Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                      darkstat 3.1.2_1
                      Lightsquid 3.0.3_1
                      mailreport 3.0_1
                      pfBlockerNG 2.0.9_1  
                      RRD_Summary 1.3.1_2
                      snort 3.2.9.1_9  
                      squid 0.4.16_1  
                      squidGuard 1.14_1
                      syslog-ng 1.1.2_2

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        That's a pretty good question.

                        I just clicked around and couldn't find a 2.1.5 download.

                        You might want to start thinking about other products/distros if you can't wait months for the functionality you need.

                        I <3 pfSense but this limiter shit is getting old.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          @Derelict:

                          That's a pretty good question.

                          I just clicked around and couldn't find a 2.1.5 download.

                          You clicking skills suck.  ;D :P

                          Just click on the "Just show me the mirrors" on the download page. Select one, and go to "old" dir.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Didn't see the old dir.  Knew it was there somewhere.  Thanks.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • A
                              Alfanetindo
                              last edited by

                              SOLVED*

                              I managed to find a simple fix. All I needed to do was create a pass all firewall rule on the (LAN) interface for port 3128 (my proxy port).

                              IPv4 TCP * * * 3128 * none   Rule to allow transparent proxy to work

                              It worked and the speed limiter still works also.

                              1 Reply Last reply Reply Quote 0
                              • A
                                Abhishek
                                last edited by

                                @Alfanetindo:

                                SOLVED*

                                I managed to find a simple fix. All I needed to do was create a pass all firewall rule on the (LAN) interface for port 3128 (my proxy port).

                                IPv4 TCP * * * 3128 * none   Rule to allow transparent proxy to work

                                It worked and the speed limiter still works also.

                                anyone else tested this ?

                                2.3-RC (amd64)
                                built on Mon Apr 04 17:09:32 CDT 2016
                                FreeBSD 10.3-RELEASE
                                Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                darkstat 3.1.2_1
                                Lightsquid 3.0.3_1
                                mailreport 3.0_1
                                pfBlockerNG 2.0.9_1  
                                RRD_Summary 1.3.1_2
                                snort 3.2.9.1_9  
                                squid 0.4.16_1  
                                squidGuard 1.14_1
                                syslog-ng 1.1.2_2

                                1 Reply Last reply Reply Quote 0
                                • G
                                  gringo13
                                  last edited by

                                  @Abhishek:

                                  @Alfanetindo:

                                  SOLVED*

                                  I managed to find a simple fix. All I needed to do was create a pass all firewall rule on the (LAN) interface for port 3128 (my proxy port).

                                  IPv4 TCP * * * 3128 * none   Rule to allow transparent proxy to work

                                  It worked and the speed limiter still works also.

                                  anyone else tested this ?

                                  Limiter still not working!

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    techgs
                                    last edited by

                                    I can confirm that the issue solved 100 %

                                    My configuration :

                                    1.  Pfsense Version :  2.2.4-RELEASE (amd64)
                                    built on Sat Jul 25 19:57:37 CDT 2015

                                    2.  Packages Installed :  A.  Squid :  2.7.9 pkg v.4.3.6  ( Do not install squid3 – its very buggy )
                                    b.  Squidguard : 1.9.14  -- squid configured as a transparent proxy on lan interface  - rest are default settings.

                                    3.  Memory : 1 GB

                                    4.  Bandwidth Available :  4 MB

                                    5.  Limiter applies for testing :  only to 1 ip  ( 256 kb download and 1 mb upload )

                                    6.  Result  tested with speed.net  (  Worked exactly as expected )

                                    7.  All test carried when no one else using internet ( doubly confirmed )

                                    Please mark that this issue is fully resolved.

                                    Kudos and special thanks to  Alfanetindo  for a simple but a great solution.

                                    Steps need to be taken...

                                    1.  Following rule must be first rule

                                    IPv4 TCP    *    *    *    3128    *    none        Rule to allow transparent proxy to work

                                    2.  Then you can apply the limiter rule.

                                    pfsense-limiter-rule.png_thumb
                                    pfsense-limiter-rule.png
                                    pfsense-services-status.png
                                    pfsense-services-status.png_thumb
                                    pfsense-version.png
                                    pfsense-version.png_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      djzort
                                      last edited by

                                      the order of the actual pf rules must be the issue then, perhaps someone can post the pf rules of working 2.1.5 and not working 2.2.x

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        Ecnerwal
                                        last edited by

                                        Not "solved" and the rule change does not "solve" it. Looks like it just bypasses the limiter.

                                        Tried on 2.2.4, squid 3 (what was installed, has not been transparent since I decided that limiter fairness beat the heck out of squid caching if I had to pick only one of those) - traffic limited at 10 and running 10.6 shot above 12, quality shot from 40 to 1500 ms.

                                        Uninstalled squid 3, installed 2.7.9.

                                        Traffic again shot above 12, quality went to 400, then 1200 ms.

                                        Turned off transparent and disabled firewall rule. Traffic remained high, quality low, so I reset states as well to flush it out.

                                        Back to 10.4 and 27 ms.

                                        Guess I'll have to find a second box to run an independent squid instance between pfSense and the rest of the LAN, since this is not remotely working (on older versions I could have both work, but only when cache hits were shaped, which was NOT the point, and the workarounds some claimed to work for that always left me with a locked up system and no network access.

                                        I have been running the limiter (and basically no squid, or only non-transparent squid which is functionally like no squid) since last spring with excellent results on getting fairness while allowing most of the BW to be used (one user gets it all (minus limiter overhead to make the limiter work at all), two users share evenly, 80 users share evenly) and holding quality to a reasonable level.

                                        "Quality to a reasonable level" is basically tuning the main limiters' in/out values that are then divided among users.

                                        pfSense on i5 3470/DQ77MK/16GB/500GB

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          debianxp
                                          last edited by

                                          Finally the only way to fix this was installing the old version of pfsense 2.1.5. I tested with squid transparent mode, dansguardian and Limiters and everything works fine. I was reading the pfsense Digest and there are many security issues and bugs from the old version 2.1.5 to the last version 2.2.4, like a multiple Cross-Site Scripting (XSS) vulnerabilities were found in the pfSense WebGUI, and OpenSSL “FREAK” vulnerability (If packages include a web server or similar component, such as a proxy, an improper user configuration may be affected. Consult the package documentation or forum for details.)

                                          My question, is there any secure way to keep this old version for remote access?

                                          Regards!

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            chris4916
                                            last edited by

                                            That's a pretty strange technical debate here about rule handling access to port 3128 while idea is to use transparent proxy which is, by design, implemented in such a way that proxy port is unknown browser side and accessed only internally.

                                            Not reading even further, when I saw such proposal in term of FW rule associated with transparent proxy, I was…  :o ???....  ::)

                                            If issue is with transparent proxy only, why don't you move to explicit proxy with is definitely far better, in any case?

                                            Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.