Users bypass squid

doktornotor

Does not go anywhere, I give up. Still no network diagram.

Having a default gateway configured to the IP of your router is absolutely expected and normally required. It does not result in any bypass of anything expect for utterly broken network designs.

atn78

This is the network diagram. I thinked I explained it by writing it.

![LAN internet.png](/public/imported_attachments/1/LAN internet.png)
![LAN internet.png_thumb](/public/imported_attachments/1/LAN internet.png_thumb)

doktornotor

Great. Now, did you configure anything on the clients? Because, with the proxy NOT being transparent, I cannot figure out how on earth you imagine the clients to be forced to use it?!?! (And, BTW, if going through Squid is required, you'll need to block all IPv6.)

atn78

I attached two screenshots showing interrnet configuration in browsers and the coniguration of network cards.

![options internet.png](/public/imported_attachments/1/options internet.png)
![options internet.png_thumb](/public/imported_attachments/1/options internet.png_thumb)
![carte réseau.png](/public/imported_attachments/1/carte réseau.png)
![carte réseau.png_thumb](/public/imported_attachments/1/carte réseau.png_thumb)

doktornotor

Yeah. So, unless you configure the clients manually, they won't use the proxy. Cannot see the "bypass" here. And still do not see the problem and the relation with the gateway.

atn78

DHCP is not activated so clients are manually configurated.

doktornotor

Yes. If you have DHCP activated, you'd have noticed that it is absolutely standard to have a default gateway configured on clients. I mean, you break the network connectivity if you don't have it configured. And no, it does not have anything in common with Squid "bypass". Not in any normal network. Yours apparently is abnormal.

atn78

When I desactivated the proxy in Internet Options the squid authentification is not prompted and I have access to Internet.

doktornotor

Yes of course they are NOT!!! Because if you want to force people to use a proxy, you need to either make it transparent, or force it on clients via DHCP/DNS/WPAD/Group Policy and block the direct traffic. You do not force people to use a proxy by inventing broken network configuration on clients that's missing a default gateway.

:o ::)

atn78

I have activated the transparent proxy option and I still have the same problem.

doktornotor

As noted, you need to block IPv6 if going through Squid is a requirement. Other than that, I'd wipe everything and start from scratch, and start with fixing your completely whacky workflows. Using DHCP and configuring clients in a way that's used by the rest of the world (which includes having a default gateway set) would be a nice start here.

Bye.

atn78

Can you tell me how to do it?

doktornotor

There really is nothing special to do, it just works for everyone with DHCP server enabled on pfSense.

atn78

I noticed that users can bypass squid by configuring the DNS in their network interfaces.

C0RR0SIVE

Then block their ability to do so, either via a GPO, or at the firewall. If they are actually using the proxy (either transparently, or via wpad) then regardless of their DNS settings, the proxy will serve what the PFSense DNS looks up.

ast

@doktornotor:

Great. Now, did you configure anything on the clients? Because, with the proxy NOT being transparent, I cannot figure out how on earth you imagine the clients to be forced to use it?!?! (And, BTW, if going through Squid is required, you'll need to block all IPv6.)

I know this is already an old post, but can I ask for your assistance, how do we block all IPv6?

TIA!

ast