Squid in Transparent HTTP Proxy mode Didn't work

MR-NT · Apr 7, 2017, 3:09 PM

Squid in Transparent HTTP Proxy mode Didn't work but when i put the the proxy server & port in my browser it work any help

Stewart · Apr 12, 2017, 1:03 PM

@MR-NT:

Squid in Transparent HTTP Proxy mode Didn't work but when i put the the proxy server & port in my browser it work any help

What do you mean it doesn't work?
Is there nothing in /var/squid/cache? If there is then it is working.
Is it not caching enough? Maybe you need to increase the cache size.
Is it not filtering for you? That's a squidGuard issue, not Squid.
Is the AV not catching things? Check your freshclam log and see what it says.

If you have Transparent HTTP Proxy checked then what Interface do you have it set to? Also, I know in the past that using a limiter could cause the transparent to not work. Not sure if that is still a thing.

hdokes · May 30, 2017, 2:55 AM

Hmmmmm… I thought 'Squid in Transparent mode didn't work' was pretty clear.... because... it just doesn't work.

Version 2.3.4 4gb embedded w/2gb ram here (Firebox x750e - all 4 boxes).
Proxy set to LAN inteface
No SSL filtering
ClamAV enabled
Google Safe Browsing enabled
Audio and video antivirus scanning disabled
All other settings at defaults

Squid proxy works just fine as long as Transparent mode is not checked and you set proxy settings in the browsers. Once Transparent mode is checked and the proxy mode is disabled in the browsers all port 80 requests stop in their tracks.

Seems to me that if a package for pfsense has a known issue it should be flagged in some fashion to let the end user know. Even if in the description of the package. I stop short of suggesting that it should be pulled from the package list (tho I am of the belief that it should be if it is known not to work as professed) as it would be advantageous to access the package and manually apply fixes should they be available (again, annotated in the description of the package).

I have 4 devices, all upgraded to 2.3.4 and all having this issue. Three of these were upgraded from 2.3.3 and were working fine until the upgrade to 2.3.4. The forth was 2.3.1 and was also working fine until the upgrade to 2.3.4.

I'm happy to provide any additional information that may be requested.

Thanks for any assistance provided.

marcelloc · May 30, 2017, 3:13 AM

Do you have loopback interface selected on any of squid's interface item?

Did you checked if there is any ticket on redmine about it?

I saw that package native firewall rules was changed some time ago and maybe it's the reason for a squid package installed together with 2.3.1 release has different behavior from current package code or a compile problem like this thread suggest

https://forum.pfsense.org/index.php?topic=129129.msg711800#msg711800

hdokes · May 30, 2017, 1:13 PM

Thanks for the response.

I do not have the loopback interface selected on any of the squid items.

I did check Redmine and only found a reference to permissions from which I compared those on our boxes and they are set correctly.

I also was aware of the link you provided below and it is apparent that many are having this issue. I thought it may have been just embedded related but other variations of the install are having the same issue as well.

I simply responded in the last thread I was in that was related to my symptoms.

I have many customers who have associates that travel with notebooks… as well as associates from other regions coming to the local facility. Being able to use the transparent mode is our preferred choice for the proxy configuration as a result.

I have seen that for many this has been a problem for several releases. It does appear that it isn't get much priority on the 'bug' list.

I do have a test box assembled and identical in configuration to those which are on line with the exception of the IP settings. I am very happy to attempt any tests or provide any information that might assist in identifying why we are having this issue.

Thanks again

ryanhunt · May 30, 2017, 2:28 PM

I'm having the exact same issue - brand new install of pfSense 2.4 (latest build) and squid (0.4.36_3) in transparent mode doesn't work.

When I set a client computer to manually specify the pfSense box as a proxy = works
When I set a client with no proxy settings, and enable transparent proxy in pfSense = doesn't work (i.e. doesn't hit the proxy)

AR15USR · May 30, 2017, 6:52 PM

@ryanhunt:

…When I set a client with no proxy settings, and enable transparent proxy in pfSense = doesn't work (i.e. doesn't hit the proxy)

No expert here but I believe you will need wpad setup for this to work..

ryanhunt · May 31, 2017, 12:39 PM

@AR15USR:

No expert here but I believe you will need wpad setup for this to work..

UPDATE: OK, I feel like an idiot - it was working all along. I used to test a proxy was working by typing in gibberish in the browser and getting the squid error, however for some reason Chrome simply reports ERR_NAME_NOT_RESOLVED rather than giving me a Squid error. I was looking for the squid error - but I was actually using a transparent proxy!

Good way to test for people is to visit a site like http://www.lagado.com/proxy-test - helped me :)

hdokes · May 31, 2017, 4:35 PM

@ryanhunt:

@AR15USR:

No expert here but I believe you will need wpad setup for this to work..

UPDATE: OK, I feel like an idiot - it was working all along. I used to test a proxy was working by typing in gibberish in the browser and getting the squid error, however for some reason Chrome simply reports ERR_NAME_NOT_RESOLVED rather than giving me a Squid error. I was looking for the squid error - but I was actually using a transparent proxy!

Good way to test for people is to visit a site like http://www.lagado.com/proxy-test - helped me :)

Hello ryanhunt,

It's good to know that transparent mode works on 2.4. For those of us with 32 bit machines installed however that doesn't help us to much. In an effort to narrow this issue down can you pass a copy of the squid config file that is working for you?