Guide to filtering web content (http and https) with pfsense 2.3

chris4916

At the moment, if the user access HTTP - Reddit.com/r/nsfw, then squidguard blocks at the proxy. However HTTPS requests to the same site are not blocked.

Is the proxy able to block this type of traffic without MITM / certificate installation on each host? At the moment, "transparent mode" and "MITM" are disabled on squid. Any advice is appreciated.

No this will not work without MITM because CONNECT method on which Squidguard relies in order to block HTTPS knows only the left part of your URL, meaning here http://reddit.com
This part is sent in clear text but then everything else is within HTTPS tunnel thus this can't be read therefore blocked.

oddworld19

Since that is literally the only site I'm trying to block on squid (and everything else is blocked using DNSBL / pfblockerng) how would you suggest I intercept HTTPS?

Do you think I could alter the WPAD rules to PROXY reddit.com and default to pass/DIRECT all other traffic? Then on squid, I enable MITM/SSL. I shouldn't use transparent mode, right, because WPAD would notify users of the proxy?

Would I use port 3128 or 3129 (I'm a little confused about the separate SSL port in the options).

Since this isn't a banking site or google site, any idea if I could configure squid such that no certs are needed on the host computers?

chris4916

I can't really answer :-[

To me DNSBL doesn't aim at replacing HTTP filtering. These are on 2 different layers. If you implement DNSBL, then you will access less sites, that's it (and this is already not so bad) but HTTP proxy permits to filer at fqdn level (like DNSBL does) but also in URL (for HTTP or HTTPS is MITM) and, on top of that, to check for virus (again HTTP and also HTTPS if MITM)

Then decision to deploy proxy in transparent mode or not is entirely on your side. I'm definitely not prone to deploy transparent proxy but can understand that is some cases it may help.

oddworld19

Thanks. Yes - I use DNSBL just to block at the DNS level. pfblockerng has a new update where it also includes top level domains. It does a pretty good job of blocking content at the "domain-level" via DNS. I then set-up rules in pfsense to require the network to use pfsense's DNS unbound server. I agree these are two fundamentally different technologies. However, the DNS blacklist does not cover quite everything I intend to block. I want reddit.com to work, but want to block certain sub-reddits. Obviously, DNS is the wrong tool for this job, which brought me to squid.

I do not want to enable a transparent proxy. That seems overkill if I just want to block one site.

Does SSL filtering work in non-transparent mode?

I assume so. Is the port still 3128?

chris4916

@oddworld19:

I do not want to enable a transparent proxy. That seems overkill if I just want to block one site.
Does SSL filtering work in non-transparent mode?
I assume so. Is the port still 3128?

yes and yes.
And BTW you don"t need to edit proxy.pac in order to go direct for all sites but reddit.
You can still use proxy for all and only block reddit content.
Other HTTP sites will benefit from cache and all sites will potentially benefit from anti-virus if one day you enable it.

oddworld19

Thanks. Right. My only thought there was:

I understand SSL decryption and inspection gets…. Nasty.

For example, if browsers require HSTS or whatever other protocols check certificates, then it might get annoying to keep installing certs on all on my computers on the LAN. For example... A small FTP server has no need to access Reddit, but I don't know if SSL bumping will cause issues with package updates in the future (without a cert).

Maybe it will... Maybe it won't. I don't know... Do you think it would potentially be an annoyance if I don't have certs installed?

maverik1

Lots of good info! Thanks!!

Any clue as how to get android phones to be able to receive push notifications when using wifi via router connected to a pfsense box? I've enabled that particular vlans firewall to any any and the wan is any any as well. No filtering going on for that vlan via squid or squidguard. Cannot for the life of me understand what is blocking notifications. Very annoying.

chris4916

@maverik1:

Any clue as how to get android phones to be able to receive push notifications when using wifi via router connected to a pfsense box? I've enabled that particular vlans firewall to any any and the wan is any any as well. No filtering going on for that vlan via squid or squidguard. Cannot for the life of me understand what is blocking notifications. Very annoying.

What "notification" are you speaking about?
I'm confused :-[

maverik1

I was speaking about push notifications on android and iOS based phones. I think I've got it working..hopefully.

maverik1

@aGeekHere:

Update Youtube safe mode
Click add under Host overrides
Host = www
Domain = youtube.com
IP = 216.239.38.120
Description = youtube
Save
NOTE: Safe search for youtube is not as advanced as google safe search, which results in a lot of safe content be filtered out.

How can we get this working with mobile devices Android and iOS that use the youtube mobile app or m.youtube.com?

chris4916

@maverik1:

I was speaking about push notifications on android and iOS based phones. I think I've got it working..hopefully.

Sorry but I still don't understand what "notification" means here and if you managed to make this working, you could at least share it (i.e. what did you do?) with other forum members ;)

maverik1

@chris4916:

Sorry but I still don't understand what "notification" means here and if you managed to make this working, you could at least share it (i.e. what did you do?) with other forum members ;)

Push notifications are alerts that are received by cellular phones;mostly smart phones, for different types of apps such as social media, email, games and whatnot. I have no issues receiving these alerts when using data only. However, when I was on my wifi network they were not coming through. I spend a few weeks working with the firewall rules and proxy settings trying everything I could think of to troubleshoot the issue. Turns out the problem was with the phone and not pfsense.

kpa

I'd be very surprised if all those "push" system weren't all emulated by polling a server periodically, that kind of set up needs absolutely nothing else but an outgoing connection from the device to the server. The other option would be a service running on the device and the notifications would be then really pushed on the device by an incoming connection from the server to the device. I don't think you'd want implement it like that however ;)

laurenzzo

@aGeekHere:

[…]

First we are going to setup squidguard
Update
In squidguard under General settings
Tic enable
Tic Enable log
Tic Enable log rotation
Tic enable blacklist
Under Blacklist URL add http://www.shallalist.de/Downloads/shallalist.tar.gz
Save
apply (you must always hit apply for any changes you made to squidguard).

In Package/Proxy filter SquidGuard: General settings/General settings
click blacklist
enter http://www.shallalist.de/Downloads/shallalist.tar.gz
download
wait to finish

[…]

Hi aGeekHere,

Thanks a lot for your guide !
~~I tried to follow your steps to get my blacklist downloaded but without success.

Could you please have a look on my post for more details ?~~
https://forum.pfsense.org/index.php?topic=117314.msg649961#msg649961

~~I really don't understand why the download doesn't work…~~

~~Thanks in advance for any help !~~

EDIT : SOLVED !
this was an issue with Firefox…
Could you please update your nice guide with a small note ? (e.g. "don't use Firefox to download the blacklist, IE do the job correctly")

Thanks !

Kind regards,
Laurenzzo

jadog

Thanks for taking the time to post this excellent guide! Just a few additions I would recommend adding.

YouTube mobile still allows unrestricted access. Including the below corrected it for me.


Click add under Host overrides
Host = m
Domain = youtube.com
IP =  216.239.38.120
Description = youtube mobile
Save

Also when using vi after you ssh into your router, using wq does not allow saving. You need to use ":wq" (without the quotes). All working perfectly for me!

eixel05

Hi,

First of all thank you so much for this guide, just what I've been looking for!

Before this guide I was using Transparent+MITM approach but because some HTTPS sites doesn't load as they should (I'm not sure if the cause was indeed MITM but after turning it off the sites loads fine)

I followed this guide thoroughly, HTTP filtering works fine but I don't know if HTTPS filtering is working? Before, I am using the tail command (/var/squid/logs/access.log) and while MITM is on, https site access is being logged but now with this approach, not a single HTTPS is being logged.

Is there another way to check if indeed this approach is working for HTTPS?

Out-of-topic question, since my main purpose for this Proxy server is local cache, Are HTTPS objects being cache as well? or only HTTP?

Update (09/07/2016): NVM, I figured it out :D all is working great, thank you so much for this guide!

I'M REALLY SORRY FOR BEING NOOB, I just started my way to "Networking", please be patient with me.

Maxim_Al

Can anybody help me?
I test pfsense for gateway/proxy for a company. But I have one strange trouble:
The pfsense is installed and work but if I use it for access (through proxy) to https://code.getmdl.io/1.2.1/material.grey-orange.min.css I have in proxy log:
Date IP Status Address User Destination
16.09.2016 14:37:28 192.168.1.222 TAG_NONE/503 code.getmdl.io:443 - -
What is it an how I must to do that resolve it?

UPDATE 28/10/2016 - This was provider :) not pfsense!

klmiciano

Which rule should be above between these two?

FIRST –
"Now we are going to create a rule that will force the network to use our route as the DNS server.
In Firewall/NAT/Port forward
add a new rule

Interface = LAN
Protocol = TCP/UDP
Source ports = *
Dest address = *
Dest ports = 53
NAT IP = 127.0.0.1
NAT Ports = 53
Description = Redirect DNS
LAN TCP/UDP * * * 53 127.0.0.1 53 Redirect DNS
Save"

SECOND --
"To stop users from bypassing your proxy setup a new firewall lan rule and block port 80 and 443
IPv4 TCP * * * 80 - 443 * none.
Save"

klmiciano

@aGeekHere:

I found this post and I am researching to see how well it will work.

https://forum.pfsense.org/index.php?topic=106016.0

The idea is to use the wpad for https content and have a transperrent proxy for http traffic. This could remove the bypass rules for programs with no proxy settings and need to use port 80.

Update
OK it looks to be working fine, now all the traffic that was block on port 80 is now using the transperrent proxy, you will still need a pass rule for port 443 but not for port 80.

So you can use the wpad for http and https filtering (or for just https) and enable the transperrent proxy to catch the leftovers.

How to do this?

aGeekhere

@klmiciano:

Which rule should be above between these two?

FIRST –
"Now we are going to create a rule that will force the network to use our route as the DNS server.
In Firewall/NAT/Port forward
add a new rule

Interface = LAN
Protocol = TCP/UDP
Source ports = *
Dest address = *
Dest ports = 53
NAT IP = 127.0.0.1
NAT Ports = 53
Description = Redirect DNS
LAN TCP/UDP * * * 53 127.0.0.1 53 Redirect DNS
Save"

SECOND --
"To stop users from bypassing your proxy setup a new firewall lan rule and block port 80 and 443
IPv4 TCP * * * 80 - 443 * none.
Save"

first one on top

@klmiciano:

@aGeekHere:

I found this post and I am researching to see how well it will work.

https://forum.pfsense.org/index.php?topic=106016.0

The idea is to use the wpad for https content and have a transperrent proxy for http traffic. This could remove the bypass rules for programs with no proxy settings and need to use port 80.

Update
OK it looks to be working fine, now all the traffic that was block on port 80 is now using the transperrent proxy, you will still need a pass rule for port 443 but not for port 80.

So you can use the wpad for http and https filtering (or for just https) and enable the transperrent proxy to catch the leftovers.

How to do this?

after you have the wpad setup and working enable transperrent proxy in squid