Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 3 reverse proxy - HTTPS==>HTTP fails

    Scheduled Pinned Locked Moved Cache/Proxy
    15 Posts 5 Posters 19.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      I know apache can do it easily, but have no idea how to do it with squid reverse options.

      Pound proxy can help too, but there is no gui for pfsense yet.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • G
        Gob
        last edited by

        Thanks again for you valued help Marcelloc.

        Pound looks like it will do the job and be the simplest to set up. I don't want to risk breaking my production pfSense box so I will install as a standalone proxy.

        Just looking through the packages I came across stunnel. do you think that would do the job or is stunnel for outbound connections only?

        Gordon

        If I fix one more thing than I break in a day, it's a good day!

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          @Gob:

          Just looking through the packages I came across stunnel. do you think that would do the job or is stunnel for outbound connections only?

          I have not tried stunnel package yet to see how it works.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • G
            Gob
            last edited by

            Hi Marcelloc

            I have done some more reading on squid and following the examples on the squid website it is possible to use the squid reverse proxy to work with HTTPS on the WAN and HTTP on the LAN.
            After examining the /usr/local/etc/squid/squid.conf it appears that only the HTTPS webserver get an entry and not the HTTP webservers. The mappings seem to get added correctly but not the peer entries.
            I manually added the following to the squid.conf and it worked perfectly.

            #test
            cache_peer 192.168.250.4 parent 80 0 proxy-only no-query originserver login=PASS name=rvp_test
            

            Obviously this will get overwritten if I perform anything that regenerates the squid.conf.

            Can you give me any tips on how to make it persistent or are you able to take a look at the package?

            many thanks
            Gordon

            If I fix one more thing than I break in a day, it's a good day!

            1 Reply Last reply Reply Quote 0
            • G
              Gob
              last edited by

              further to my post above…
              If I enable the HTTP reverse proxy (as well as the HTTPS reverse proxy) the package manager does add all of the HTTP webservers (cache_peer) and cache_peer_access lines to squid.conf.
              But the addition of the http_port lines along side the existing https_port lines seems to prevent it from working.

              So ideally it would be handy to include all cache_peer and cache_peer_access lines for HTTP webservers even when the HTTP reverse proxy is not enabled.

              If I fix one more thing than I break in a day, it's a good day!

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @Gob:

                So ideally it would be handy to include all cache_peer and cache_peer_access lines for HTTP webservers even when the HTTP reverse proxy is not enabled.

                Did you tried this config? Does it creates a bogons config?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • C
                  Comexans
                  last edited by

                  Hi,

                  I am facing the same situation :
                  we have a webserver (http only) within our company and needed to make it accessible from internet in https.
                  I set the HTTPS mode for squid and create HTTP peer et corresponding mapping.
                  This was not working at all

                  I added the missing cache_peer and cache_peer_access lines as explained by Gob within /usr/local/etc/squid/squid.conf file and now the HTTPS ==> HTTP reverse proxy is working very well !

                  Marcelloc : is there a way to fix this in the squid3 package ?

                  Thanks.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    can you try with squid3-dev package on a testing machine?

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • F
                      falcone
                      last edited by

                      hi
                      i had same probleb,i enabled http and https mode,but i uncomment

                      Reverse Proxy settings

                      #http_port 213.151.40.39:80 accel defaultsite=falcone.co.il vhost
                      https_port 213.151.40.39:443 accel cert=/usr/pbi/squid-amd64/local/etc/squid/564b6b275c7eb.crt key=/usr/pbi/squid-amd64/local/etc/squid/564b6b275c7eb.key defaultsite=falcone.co.il vhost

                      after this proxy listening just on https:)

                      1 Reply Last reply Reply Quote 0
                      • F
                        flowjo-mike
                        last edited by

                        This is still an issue with that latest pfSense (2.3.2-RELEASE-p1) and Squid 0.4.23_1) Packages.  Every time I make a change to anything squid/clamav/reverse proxy I have to add the entry back into squid.conf.

                        Is this going to be fixed?

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.