Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid3-dev blocks Windows update and other updates

    Scheduled Pinned Locked Moved Cache/Proxy
    28 Posts 17 Posters 18.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ayman
      last edited by

      Hello,

      Windows update is not working with me too, below what i have for windows update

      acl windowsupdate dstdomain windowsupdate.microsoft.com
      acl windowsupdate dstdomain update.microsoft.com
      acl windowsupdate dstdomain download.windowsupdate.com
      acl windowsupdate dstdomain redir.metaservices.microsoft.com
      acl windowsupdate dstdomain images.metaservices.microsoft.com
      acl windowsupdate dstdomain c.microsoft.com
      acl windowsupdate dstdomain www.download.windowsupdate.com
      acl windowsupdate dstdomain wustat.windows.com
      acl windowsupdate dstdomain crl.microsoft.com
      acl windowsupdate dstdomain sls.microsoft.com
      acl windowsupdate dstdomain productactivation.one.microsoft.com
      acl windowsupdate dstdomain ntservicepack.microsoft.com
      acl windowsupdate dstdomain watson.microsoft.com

      acl CONNECT method CONNECT
      acl wuCONNECT dstdomain update.microsoft.com

      http_access allow CONNECT wuCONNECT localnet
      http_access allow CONNECT wuCONNECT localhost
      http_access allow windowsupdate localnet
      http_access allow windowsupdate localhost

      but i still get error 80072f8f while trying to update.

      access.log:

      1422878282.386    76 192.168.1.58 TCP_MISS/200 391 HEAD http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
      1422878282.521    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
      1422878283.051    76 192.168.1.124 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
      1422878286.460    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream

      I have squid3-dev with squidGuard 3 installed

      I have more than 70 pcs and i have to fix this urgently, any clue ?

      Thanks

      Ayman

      1 Reply Last reply Reply Quote 0
      • V
        vinbot
        last edited by

        I generated a tcpdump when this was happening and poked around the contents.  I found the URL fe2.update.microsoft.com

        I added that URL AND windowsupdate.microsoft.com to my squid.conf (with ssl_bump none as well for each) it seems to be updating now

        Hope it helps.

        ~Vinbot

        1 Reply Last reply Reply Quote 0
        • KOMK
          KOM
          last edited by

          acl windowsupdate dstdomain windowsupdate.microsoft.com
          acl windowsupdate dstdomain update.microsoft.com
          acl windowsupdate dstdomain download.windowsupdate.com
          …

          Could you not just use .microsoft.com, .windowsupdate.com and .windows.com to replace all of that?

          I've played with Squid3 dynamic caching with Windows Update and I always ended up in a situation where it would download the entire file for every segment it's trying to download.  100 MB of patches required downloading many gigabytes of data, as each segment request would cause the entire file to be downloaded again and again.  My traffic graph would show my WAN being fully saturated for an hour or more and hardly anything coming in to LAN from Squid.

          I have more than 70 pcs and i have to fix this urgently, any clue ?

          For that many users, why not run WSUS?

          1 Reply Last reply Reply Quote 0
          • F
            Firzze
            last edited by

            Hi, :)
            So with ssl filtering, windows update does not want to do this. There in there a manipulation to do to solve this problem.
            Sorry for my bad english  ;D

            1 Reply Last reply Reply Quote 0
            • A
              Abhishek
              last edited by

              I am also facing same issue as reported by poster , if any one have solution to this kindly update this thread ,if i bypass source Ip from proxy server settings i am able to update

              2.3-RC (amd64)
              built on Mon Apr 04 17:09:32 CDT 2016
              FreeBSD 10.3-RELEASE
              Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

              darkstat 3.1.2_1
              Lightsquid 3.0.3_1
              mailreport 3.0_1
              pfBlockerNG 2.0.9_1  
              RRD_Summary 1.3.1_2
              snort 3.2.9.1_9  
              squid 0.4.16_1  
              squidGuard 1.14_1
              syslog-ng 1.1.2_2

              1 Reply Last reply Reply Quote 0
              • A
                aGeekhere
                last edited by

                This was a main reason why I switch to a wpad.

                Never Fear, A Geek is Here!

                1 Reply Last reply Reply Quote 0
                • A
                  Abhishek
                  last edited by

                  @aGeekHere:

                  This was a main reason why I switch to a wpad.

                  So are you telling moving from transparent proxy to non transparent proxy will fix my issue ?

                  2.3-RC (amd64)
                  built on Mon Apr 04 17:09:32 CDT 2016
                  FreeBSD 10.3-RELEASE
                  Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                  darkstat 3.1.2_1
                  Lightsquid 3.0.3_1
                  mailreport 3.0_1
                  pfBlockerNG 2.0.9_1  
                  RRD_Summary 1.3.1_2
                  snort 3.2.9.1_9  
                  squid 0.4.16_1  
                  squidGuard 1.14_1
                  syslog-ng 1.1.2_2

                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere
                    last edited by

                    I could not get windows updates to work through HTTPS/SSL interception, and dealing with the CA were a pain.

                    Windows updates using wpad with squid proxy works.

                    Never Fear, A Geek is Here!

                    1 Reply Last reply Reply Quote 0
                    • A
                      Abhishek
                      last edited by

                      so u disabled Https interception ?    i have no issue deploying cert since i am using AD gpmc

                      2.3-RC (amd64)
                      built on Mon Apr 04 17:09:32 CDT 2016
                      FreeBSD 10.3-RELEASE
                      Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                      darkstat 3.1.2_1
                      Lightsquid 3.0.3_1
                      mailreport 3.0_1
                      pfBlockerNG 2.0.9_1  
                      RRD_Summary 1.3.1_2
                      snort 3.2.9.1_9  
                      squid 0.4.16_1  
                      squidGuard 1.14_1
                      syslog-ng 1.1.2_2

                      1 Reply Last reply Reply Quote 0
                      • A
                        aGeekhere
                        last edited by

                        You first have to decide if you want to use a transparent proxy or non transparent proxy with wpad

                        If you want to try using non transparent proxy with wpad here are a few links
                        https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
                        https://forum.pfsense.org/index.php?topic=93060.0

                        Note: non transparent proxy with wpad you disable HTTPS/SSL interception and Transparent HTTP proxy.

                        Let me know if you get stuck

                        Never Fear, A Geek is Here!

                        1 Reply Last reply Reply Quote 0
                        • A
                          Abhishek
                          last edited by

                          So i cant use Https inspection with wpad ?  As far as i understood wpad is a method of delivering proxy server info such as IP address and port number so we don't need to manually configure all client PC's proxy serttings manually in Non Transparent proxy case

                          IF using transparent proxy there is no need of configuring wpad

                          2.3-RC (amd64)
                          built on Mon Apr 04 17:09:32 CDT 2016
                          FreeBSD 10.3-RELEASE
                          Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                          darkstat 3.1.2_1
                          Lightsquid 3.0.3_1
                          mailreport 3.0_1
                          pfBlockerNG 2.0.9_1  
                          RRD_Summary 1.3.1_2
                          snort 3.2.9.1_9  
                          squid 0.4.16_1  
                          squidGuard 1.14_1
                          syslog-ng 1.1.2_2

                          1 Reply Last reply Reply Quote 0
                          • A
                            aGeekhere
                            last edited by

                            So i cant use Https inspection with wpad

                            wpad is only used to auto configure a non transparent proxy.

                            transparent proxy there is no need of configuring wpad

                            You cannot have both.

                            Never Fear, A Geek is Here!

                            1 Reply Last reply Reply Quote 0
                            • KOMK
                              KOM
                              last edited by

                              So i cant use Https inspection with wpad ?

                              You can't use the HTTPS Interception feature of pfSense because it goes along with Transparent mode.  If you use an explicit proxy (not transparent) and WPAD auto-detection, then you don't need to worry about certs or group policy.  You will still be able to filter HTTPS streams and your users won't get a browser warning.  The only glitch is that some mobiles, specifically Android, don't do WPAD so those users must manually configure the proxy.

                              1 Reply Last reply Reply Quote 0
                              • S
                                S. Kirschner
                                last edited by

                                The issue with the actual version of squid for pfsense is , that the acl "ssl::server_name" isnt available.

                                The available acl dstdomain shouldnt be used for that, because the information that dstdomain tries to compare are encrypted at these moment.

                                You could read the description http://lists.squid-cache.org/pipermail/squid-users/2015-July/004429.html

                                Another issue with Windows Update is , that Microsoft use self signed certificate that are not signed by VeriSign.
                                There would be 2 solutions for the 2nd issue , ignoring cert errors or import the certificate.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  ramalave
                                  last edited by

                                  Create Aliases Called add WindowsUpdate and the following list for the networking group
                                  157.54.0.0/15
                                  157.56.0.0/14
                                  157.60.0.0/16
                                  65.52.0.0/14
                                  70.37.0.0/17
                                  70.37.128.0/18
                                  207.46.0.0/16
                                  131.107.0.0/16
                                  66.119.144.0/20
                                  23.96.0.0/13
                                  204.79.195.0/24
                                  204.79.196.0/23
                                  208.76.44.0/22
                                  208.68.136.0/21
                                  216.220.208.0/20
                                  209.240.192.0/19
                                  204.14.180.0/22
                                  206.191.224.0/19
                                  192.92.90.0/24
                                  208.84.0.0/21
                                  104.40.0.0/13
                                  192.197.157.0/24
                                  204.231.192.0/24
                                  104.208.0.0/13
                                  129.75.0.0/16
                                  204.79.179.0/24
                                  64.4.0.0/18
                                  167.220.0.0/17
                                  167.220.128.0/18
                                  167.220.192.0/19
                                  192.92.214.0/24
                                  207.68.128.0/18
                                  13.64.0.0/11
                                  13.96.0.0/13
                                  13.104.0.0/14
                                  146.147.0.0/16
                                  52.145.0.0/16
                                  52.146.0.0/15
                                  52.148.0.0/14
                                  52.152.0.0/13
                                  52.160.0.0/11
                                  52.224.0.0/11
                                  52.96.0.0/12
                                  52.112.0.0/14
                                  52.120.0.0/14
                                  52.125.0.0/16
                                  52.126.0.0/15
                                  52.130.0.0/15
                                  52.132.0.0/14
                                  52.136.0.0/13
                                  138.196.0.0/16
                                  150.171.0.0/16
                                  40.74.0.0/15
                                  40.76.0.0/14
                                  40.80.0.0/12
                                  40.96.0.0/12
                                  40.112.0.0/13
                                  40.120.0.0/14
                                  40.124.0.0/16
                                  40.125.0.0/17
                                  40.64.0.0/13
                                  40.126.128.0/17
                                  40.127.0.0/16
                                  40.126.0.0/18
                                  204.13.120.0/21
                                  204.152.18.0/23
                                  Then you go to Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                                  Enter the created alliase called WindowsUpdate
                                  And this way it fixes all the updates for Windows with Transparent Proxy

                                  A 1 Reply Last reply Reply Quote 0
                                  • R
                                    ramalave
                                    last edited by

                                    Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
                                    157.54.0.0/15
                                    157.56.0.0/14
                                    157.60.0.0/16
                                    65.52.0.0/14
                                    70.37.0.0/17
                                    70.37.128.0/18
                                    207.46.0.0/16
                                    131.107.0.0/16
                                    66.119.144.0/20
                                    23.96.0.0/13
                                    204.79.195.0/24
                                    204.79.196.0/23
                                    208.76.44.0/22
                                    208.68.136.0/21
                                    216.220.208.0/20
                                    209.240.192.0/19
                                    204.14.180.0/22
                                    206.191.224.0/19
                                    192.92.90.0/24
                                    208.84.0.0/21
                                    104.40.0.0/13
                                    192.197.157.0/24
                                    204.231.192.0/24
                                    104.208.0.0/13
                                    129.75.0.0/16
                                    204.79.179.0/24
                                    64.4.0.0/18
                                    167.220.0.0/17
                                    167.220.128.0/18
                                    167.220.192.0/19
                                    192.92.214.0/24
                                    207.68.128.0/18
                                    13.64.0.0/11
                                    13.96.0.0/13
                                    13.104.0.0/14
                                    146.147.0.0/16
                                    52.145.0.0/16
                                    52.146.0.0/15
                                    52.148.0.0/14
                                    52.152.0.0/13
                                    52.160.0.0/11
                                    52.224.0.0/11
                                    52.96.0.0/12
                                    52.112.0.0/14
                                    52.120.0.0/14
                                    52.125.0.0/16
                                    52.126.0.0/15
                                    52.130.0.0/15
                                    52.132.0.0/14
                                    52.136.0.0/13
                                    138.196.0.0/16
                                    150.171.0.0/16
                                    40.74.0.0/15
                                    40.76.0.0/14
                                    40.80.0.0/12
                                    40.96.0.0/12
                                    40.112.0.0/13
                                    40.120.0.0/14
                                    40.124.0.0/16
                                    40.125.0.0/17
                                    40.64.0.0/13
                                    40.126.128.0/17
                                    40.127.0.0/16
                                    40.126.0.0/18
                                    204.13.120.0/21
                                    204.152.18.0/23
                                    Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                                    Escrevem os aliases criado chamado WindowsUpdate
                                    e desta forma você pode atualizar todas as versões do Windows com proxy transparente

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      ramalave
                                      last edited by

                                      Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
                                      157.54.0.0/15
                                      157.56.0.0/14
                                      157.60.0.0/16
                                      65.52.0.0/14
                                      70.37.0.0/17
                                      70.37.128.0/18
                                      207.46.0.0/16
                                      131.107.0.0/16
                                      66.119.144.0/20
                                      23.96.0.0/13
                                      204.79.195.0/24
                                      204.79.196.0/23
                                      208.76.44.0/22
                                      208.68.136.0/21
                                      216.220.208.0/20
                                      209.240.192.0/19
                                      204.14.180.0/22
                                      206.191.224.0/19
                                      192.92.90.0/24
                                      208.84.0.0/21
                                      104.40.0.0/13
                                      192.197.157.0/24
                                      204.231.192.0/24
                                      104.208.0.0/13
                                      129.75.0.0/16
                                      204.79.179.0/24
                                      64.4.0.0/18
                                      167.220.0.0/17
                                      167.220.128.0/18
                                      167.220.192.0/19
                                      192.92.214.0/24
                                      207.68.128.0/18
                                      13.64.0.0/11
                                      13.96.0.0/13
                                      13.104.0.0/14
                                      146.147.0.0/16
                                      52.145.0.0/16
                                      52.146.0.0/15
                                      52.148.0.0/14
                                      52.152.0.0/13
                                      52.160.0.0/11
                                      52.224.0.0/11
                                      52.96.0.0/12
                                      52.112.0.0/14
                                      52.120.0.0/14
                                      52.125.0.0/16
                                      52.126.0.0/15
                                      52.130.0.0/15
                                      52.132.0.0/14
                                      52.136.0.0/13
                                      138.196.0.0/16
                                      150.171.0.0/16
                                      40.74.0.0/15
                                      40.76.0.0/14
                                      40.80.0.0/12
                                      40.96.0.0/12
                                      40.112.0.0/13
                                      40.120.0.0/14
                                      40.124.0.0/16
                                      40.125.0.0/17
                                      40.64.0.0/13
                                      40.126.128.0/17
                                      40.127.0.0/16
                                      40.126.0.0/18
                                      204.13.120.0/21
                                      204.152.18.0/23
                                      Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                                      Escrevem os aliases criado chamado WindowsUpdate
                                      e desta forma você pode atualizar todas as versões do Windows com proxy transparente

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        blueadept
                                        last edited by

                                        ramalave's solution worked fine for me.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          AndrewGR @ramalave
                                          last edited by

                                          @ramalave , thanks for the list of networks. It helped in my case as well with squid in transparent mode.
                                          Are there any other solutions available to fix Windows Updates issues when squid works in transparent mode?
                                          Thanks!

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.