Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Limiter blocks internet access (Squid transparent proxy)

    Scheduled Pinned Locked Moved Traffic Shaping
    73 Posts 34 Posters 33.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      killmasta93
      last edited by

      nah not sure  maybe for 2.2.5 :)

      I would love to have limiter to work with NAT reflection

      Tutorials:

      https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        As far as I know this problem is punted to 2.3, unfortunately.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • K
          killmasta93
          last edited by

          So on 2.2.2 Limiter does not have any issue with NAT reflection? on 2.2.4 still theres issues

          Tutorials:

          https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            I think it's 2.2.X.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • E
              Ecnerwal
              last edited by

              @JDvD:

              Has it been solved for the new version 2.2.4?

              I'm having the problem on 2.2.4, so, no.

              pfSense on i5 3470/DQ77MK/16GB/500GB

              1 Reply Last reply Reply Quote 0
              • F
                foresthus
                last edited by

                Hi there,

                I have got the same problem. Version 2.2.4 (64Bit) does not work with transparent proxy anymore. In version 2.1.5 it worked fine. In that version (2.1.5) it was also possible to change the port of squid to a port beneeth 100. This is not working in 2.2.4 aswell.

                I guess this must be a bug.  ??? :-\

                1 Reply Last reply Reply Quote 0
                • C
                  cmutwiwa
                  last edited by

                  7 months later and this issue has not been addressed yet?…not complaining tho', SmallWall has kept me happy so far.
                  I hope this issue will be addressed tho' would like to use pf.

                  1 Reply Last reply Reply Quote 0
                  • F
                    foresthus
                    last edited by

                    Hello,

                    after updating to 2.2.5 the bug ist still there. traffic-shaping does not work with proxy in transparent mode.

                    :-[

                    1 Reply Last reply Reply Quote 0
                    • J
                      JDvD
                      last edited by

                      Ok, I have not tried it with the new version (2.2.5).
                      I also see in several post that there is a confusion, let's clarify this, the Limiter + Transparent Proxy not work, but, Limiter + Proxy NO-Transparent, work?

                      I think it's the same problem for all Traffic Shaper.

                      USER ERROR: Replace user and press any key to continue …

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        This entire topic has nothing to do with proxy. Limiters are (still) broken when applied to any NAT firewall rules; this is nothing specific to transparent Squid. On 2.2.x, and I cannot see any difference on 2.3 either. Broken as in dropping traffic -> unusable.

                        https://redmine.pfsense.org/issues/4326

                        1 Reply Last reply Reply Quote 0
                        • J
                          JDvD
                          last edited by

                          I meant to the subject of title (Limiter + Proxy), but, you have made it clear that it is a generalized problem from the NAT firewall rules. Thank you doktornotor

                          USER ERROR: Replace user and press any key to continue …

                          1 Reply Last reply Reply Quote 0
                          • H
                            herymulyo
                            last edited by

                            JAJAJA NO SOLUTION … back to 2.0.3 and fix it

                            1 Reply Last reply Reply Quote 0
                            • G
                              gmar15
                              last edited by

                              finley SOLUTION  here

                              https://forum.pfsense.org/index.php?topic=106640.0

                              1 Reply Last reply Reply Quote 0
                              • R
                                Riroxi
                                last edited by

                                @Alfanetindo:

                                SOLVED*

                                I managed to find a simple fix. All I needed to do was create a pass all firewall rule on the (LAN) interface for port 3128 (my proxy port).

                                IPv4 TCP * * * 3128 * none   Rule to allow transparent proxy to work

                                It worked and the speed limiter still works also.

                                Hello!

                                I made some adjusts to this rule, and worked! thx!

                                Just point the rule to 127.0.0.1, and will work!

                                Don't forget, the rule must be at top, and the rule with limiter must be below

                                Some screenshots below to help.

                                I hope this can help someone. Srry for my bad english.

                                :)

                                [EDIT]

                                Hello Again!

                                I tested this workaround for a few days and some apps like download managers can bypass limiters. :(

                                Looking for another temp solution.

                                Cya!

                                PROXY_RULE.png
                                PROXY_RULE.png_thumb
                                LIMITER_RULE.png
                                LIMITER_RULE.png_thumb
                                LIMITER_DOWN.png
                                LIMITER_DOWN.png_thumb
                                LIMITER_UP.png
                                LIMITER_UP.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • G
                                  geovaneg
                                  last edited by

                                  I suggest, as workaround, that you limit the client bandwidth through squid "Traffic Mgmt" tab, "Per-host throttling" option, on "Proxy server: General settings". For me, it is running ok. Sorry by my bad english too :-)

                                  1 Reply Last reply Reply Quote 0
                                  • O
                                    ohbobva
                                    last edited by

                                    For years, I've limited Squid (transparent) bandwidth using Squid "delay pools" in "Custom Options" on the "General" tab of Squid's settings.  I researched and set this up years ago, and don't remember the details, so you'll need to check Squid's documentation for info on the various options.  Here is what I've been using in the "Custom Options" box…

                                    positive_dns_ttl 90 seconds
                                    delay_class 1 3
                                    delay_parameters 1 1572864/1966080 1572864/1966080 524288/655360
                                    quick_abort_min 1024 KB
                                    quick_abort_max 2048 KB
                                    quick_abort_pct 90

                                    If I remember correctly, among other things, this limits the download speed of the browser, but allows some amount of bursting.

                                    More info at http://wiki.squid-cache.org/Features/DelayPools

                                    It looks like this when added to the "Custom Options" box on the "General" tab of Squid's settings in PFSense's GUI...

                                    positive_dns_ttl 90 seconds;delay_class 1 3;delay_parameters 1 1572864/1966080 1572864/1966080 524288/655360;quick_abort_min 1024 KB;quick_abort_max 2048 KB;quick_abort_pct 90
                                    
                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      GraKa
                                      last edited by

                                      Hello,

                                      is the problem, that the Limiters are not working with the transparent proxy solved in pfSense 2.3?
                                      And I mean without any workarounds.

                                      Thanks!

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JDvD
                                        last edited by

                                        @GraKa:

                                        Hello,

                                        is the problem, that the Limiters are not working with the transparent proxy solved in pfSense 2.3?
                                        And I mean without any workarounds.

                                        Thanks!

                                        No yet. Unfortunately…

                                        @gmar15:

                                        finley SOLUTION  here

                                        And the gmar15 solution not work for each IP, only makes a single pipe…

                                        USER ERROR: Replace user and press any key to continue …

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          alfredopea
                                          last edited by

                                          Check this issue:

                                          https://redmine.pfsense.org/issues/4325

                                          Just change the transfer rate from megabits to kilobits in you limiters (download/upload) and everything will work fine again.

                                          The problem is with squid 2.7.9+ and ipfw limiters.

                                          Example 1.5 Mbps (1536 Kbps) Download and 1 Mbps (1024 Kbps) limiters:

                                          Hope this help and sorry about my english.

                                          Limiter_Kbps.png
                                          Limiter_Kbps.png_thumb
                                          Firewall_Rule.png
                                          Firewall_Rule.png_thumb

                                          Ing. Alfredo Peña Ramos
                                          Viva el Software Libre!

                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            felipemb
                                            last edited by

                                            Hi Alfredo,

                                            This solution not worked on 2.3.1  :(

                                            In this video: https://www.youtube.com/watch?v=wcSyGDXkJ9A

                                            How i create queue on interface LAN in 2.3.1?

                                            Thanks for the help!!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.