Https block sgerror only in transparent mode

moley2016

Let me know if you get this sorted. Sounds like a similar issue to what i'm having.

https://forum.pfsense.org/index.php?topic=109208.0

Hanswerner

Ok…
configured new pfsense in VM.
everything stays the same. It is impossible to tell squid to redirect correctly.

NON - Transparent with or without ssl - man in the middle
http://eample.com blocked and redirect to sgerror.php
https://example.com blocked but NO REDIRECT:

same setup only enabling the transparent setting:
everything works

i believe its a bug. during my configurations there were so many bugs in reloading config or something like squidgard stops working after setting something complete different...

misant

@Hanswerner:

https://example.com blocked but NO REDIRECT:

Can you open block page with https itself? just type https://YUORIP/sgerror.php

Check if you disallow numeric URLs, if yes - add your pfSense to exclusion.

Hanswerner

Opening blockpage itself depends on webconfigurator http or https setting. Both works.
it doesnt matter if i chose internal or external page.
The only problem here is the default redirect of the blacklist advertisement filter that redirects to the ip with a domain cert error instead of fqdn without error ;)
(this could be managed with the webconfigurator setting)

the very interesting thing is, that everything is working nice in transparent mode (witch ssl-bump) and gateway setting via dhcp. Everything except some strange cert errors because there is a lack of options for squid to correctly mimik the server cert…
(for example if www.example.com loads js from www.cd.example.com -> squid is too dump to generate different cert for different connection and so you get cert domain errors)

Hanswerner

"Do not allow IP-Addresses in URL" doesnt matter… :(

Hanswerner

End Workaround: I changed squid error page to sgerror.php

Better the users get blocked message than proxy errors.. but … crap

RoFz

According to Amos Jeffries, a squid developer/maintainer, it's a browser problem:

http://www.squid-cache.org/mail-archive/squid-users/201202/0216.html

olivier.dumonexodata.fr

Hi all.
Is there any update on this case ?
I have exactly the same problem with a pfsense version 2.3.2.

Thanks.
Regards.
Olivier.

chicago_cs

Hi, Me too.

Any advice?

heliop100

@Hanswerner:

End Workaround: I changed squid error page to sgerror.php

Better the users get blocked message than proxy errors.. but … crap

Hi,

How to change squid error page to sgerror.php?

Thanks.

beto0914

I reported this issue as a bug in https://redmine.pfsense.org/issues/6777

I hope that the programmers can help us, in my situation, this issue is present in pfsense 2.3.2

LFCavalcanti

Ressurecting this thread…

I'm having similar issues, more... even when the external error page is loaded, no CSS on that page is applied.

LFCavalcanti

After some search, It's a behavior standard in Browsers.

See this: https://bugzilla.mozilla.org/show_bug.cgi?id=479880

So any page blocked by Squid(+SquidGuard) that is HTTPS will not display the error page, just the generic error message from the browser on Tunnel connection error.

shyaminayesh

any updates on this ?

jimp

@shyaminayesh:

any updates on this ?

No because it is not a bug, it's working in the only way that it can with SSL/TLS.