Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Guide to filtering web content (http and https) with pfsense 2.3

    Scheduled Pinned Locked Moved Documentation
    190 Posts 54 Posters 223.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      huuur
      last edited by

      @aGeekHere:

      On the android phone (wireless setting) try setting the proxy settings manually, instead of auto or none.

      Finally, with manual proxy settings I have a stable communication with android devices.

      You are the MAN!

      1 Reply Last reply Reply Quote 0
      • H
        huuur
        last edited by

        @maverik1:

        @aGeekHere:

        Update Youtube safe mode
        Click add under Host overrides
        Host = www
        Domain = youtube.com
        IP =  216.239.38.120
        Description = youtube
        Save
        NOTE: Safe search for youtube is not as advanced as google safe search, which results in a lot of safe content be filtered out.

        How can we get this working with mobile devices Android and iOS that use the youtube mobile app or m.youtube.com?

        I can't express how useful this guide been for me.

        For the record I found the below is working for youtube mobile app safe search:

        
        Host = youtube
        Domain = googleapis.com
        IP =  216.239.38.120
        Description = youtube app1
        
        
        
        Host = youtubei
        Domain = googleapis.com
        IP =  216.239.38.120
        Description = youtube app2
        
        

        and maybe..

        
        Host = www
        Domain = youtube-nocookie.com
        IP =  216.239.38.120
        Description = youtube nocookie
        
        

        in addition to what's mentioned in Reply#60 for mobile browsers.

        1 Reply Last reply Reply Quote 0
        • A
          aGeekhere
          last edited by

          Thanks huuur, that should help others.

          Though it would be good if youtube was better at filtering videos.

          Never Fear, A Geek is Here!

          1 Reply Last reply Reply Quote 0
          • A
            aGeekhere
            last edited by

            Update

            You can try setting up MITM by setting the SSL/MITM Mode to splice all, that way you do not need to create a certificate for each device on the network. (you still need to create a main certificate though).

            Never Fear, A Geek is Here!

            1 Reply Last reply Reply Quote 0
            • V
              vielfede
              last edited by

              @aGeekHere:

              Update

              You can try setting up MITM by setting the SSL/MITM Mode to splice all, that way you do not need to create a certificate for each device on the network. (you still need to create a main certificate though).

              That works fine for me also setting Client proxy settings manually:
              Proxy address/PORT= SQUID_IP 3128

              And that only! Indeed if i specify different proxy settings for http/https in (client win10=> Internet Settings=>Lan settings=>Advanced=>

              • http=SQUID_IP 3128
              • https=SQUID_IP 3129

              It does not work, as in the contrary I'd excpect….  ::)
              Geek can you explain why?

              1 Reply Last reply Reply Quote 0
              • A
                aGeekhere
                last edited by

                Does automatically detect settings work?

                Never Fear, A Geek is Here!

                1 Reply Last reply Reply Quote 0
                • V
                  vielfede
                  last edited by

                  @aGeekHere:

                  Does automatically detect settings work?

                  Ehmm sorry, could you explain me better what you mean? As I stated I do not use WPAD, I configure proxy manually on client see picture…

                  Thanks.
                  PS. Sorry to answer late

                  ProxyClientSettings.JPG
                  ProxyClientSettings.JPG_thumb

                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere
                    last edited by

                    if you have the transparent proxy working then you do not need to define the proxy server.

                    Never Fear, A Geek is Here!

                    1 Reply Last reply Reply Quote 0
                    • V
                      vielfede
                      last edited by

                      If I use it in transparent mode, https does not work!
                      Better sometimes it works, sometimes it does not! (http works always!)

                      If anyone managed to get http+https in splice all + transparent mode work please let me know… ;)

                      1 Reply Last reply Reply Quote 0
                      • A
                        aGeekhere
                        last edited by

                        I just enabled it mitm, added a cert, set it to splice all and its working.

                        Never Fear, A Geek is Here!

                        1 Reply Last reply Reply Quote 0
                        • T
                          techbee
                          last edited by

                          The guide is update but confusing.  Can you please clean up the guide and have it step by step.  Its somewhat hard to follow if you are not familiar with wpad and related firewall rules.

                          Thanks for the guide.

                          1 Reply Last reply Reply Quote 0
                          • A
                            aGeekhere
                            last edited by

                            hi techbee, yeah after discovering a few new things the guide is a little messy now.

                            The transparent proxy with MITM (splice all) vs wpad should really be divided into two different choices. When I made the guide I did not know that all you need to get transparent proxy for https working is set splice all and create a cert for the router. So in fact you can now choose either using a wpad or the transparent proxy MITM or both.

                            when i get time I will try an clean it up a bit.

                            Never Fear, A Geek is Here!

                            1 Reply Last reply Reply Quote 0
                            • V
                              vielfede
                              last edited by

                              @aGeekHere:

                              The transparent proxy with MITM (splice all) vs wpad should really be divided into two different choices. When I made the guide I did not know that all you need to get transparent proxy for https working is set splice all and create a cert for the router. So in fact you can now choose either using a wpad or the transparent proxy MITM or both.

                              Indeed I do not think MITM and splice all can work toghether, as stated on squid documentation MITM is associated to the "bump" directive that is something complety different from splice directive.
                              With MITM (bump) squid is able to decrypt traffic (and analyse it) meanwhile with splice all you can do is just "web filtering".
                              Summarizing
                              Directive          Advantages/features                                                                    Disadvantage
                              Splice (all)        No needs of certificate installation on Clients + webfiltering              No traffic analysis i.e no AntiVirus
                              Bump (MITM)    Traffic analysis i.e noYES AntiVirus    + webfiltering                              Needs to install certs on clients

                              Please take a look here and let me know if I missed something. Thanks
                              http://wiki.squid-cache.org/Features/SslPeekAndSplice#Actions
                              http://marek.helion.pl/install/squid.html

                              1 Reply Last reply Reply Quote 1
                              • A
                                AR15USR
                                last edited by

                                @vielfede:

                                @aGeekHere:

                                The transparent proxy with MITM (splice all) vs wpad should really be divided into two different choices. When I made the guide I did not know that all you need to get transparent proxy for https working is set splice all and create a cert for the router. So in fact you can now choose either using a wpad or the transparent proxy MITM or both.

                                Indeed I do not think MITM and splice all can work toghether, as stated on squid documentation MITM is associated to the "bump" directive that is something complety different from splice directive.
                                With MITM (bump) squid is able to decrypt traffic (and analyse it) meanwhile with splice all you can do is just "web filtering".
                                Summarizing
                                Directive          Advantages/features                                                                    Disadvantage
                                Splice (all)        No needs of certificate installation on Clients + webfiltering              No traffic analysis i.e no AntiVirus
                                Bump (MITM)    Traffic analysis i.e no AntiVirus    + webfiltering                              Needs to install certs on clients

                                Please take a look here and let me know if I missed something. Thanks
                                http://wiki.squid-cache.org/Features/SslPeekAndSplice#Actions
                                http://marek.helion.pl/install/squid.html

                                Shouldn't the second one not have the word "no"..


                                2.6.0-RELEASE

                                1 Reply Last reply Reply Quote 0
                                • V
                                  vielfede
                                  last edited by

                                  @AR15USR:

                                  Shouldn't the second one not have the word "no"..

                                  Sorry cut & paste mistake, I fixed it.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mahnonsaprei
                                    last edited by

                                    Hi at all,

                                    I'm Marcello from italy. Nice to meet you, i'm a newbie of pfsense.

                                    I have read the tutorial, but i have one problem.
                                    When i try to connect to an https website in blacklist, the browser show me a generic error see the attachment: (ERR_TUNNEL_CONNECTION_FAILED) while i want to see a message of pfsense that explain the block. In http it's ok

                                    I'm looking for in google but i not found the answer.

                                    Please help me.
                                    Thank you veeeeery much!!!

                                    error.PNG
                                    error.PNG_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aGeekhere
                                      last edited by

                                      When i try to connect to an https website in blacklist, the browser show me a generic error see the attachment: (ERR_TUNNEL_CONNECTION_FAILED) while i want to see a message of pfsense that explain the block. In http it's ok

                                      Known issue with squid, I do not think there is a fix for it.

                                      Never Fear, A Geek is Here!

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mahnonsaprei
                                        last edited by

                                        Thank you so much. There aren't alternatives to redirect https via proxy also blank page or other?

                                        B.r.

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          techbee
                                          last edited by

                                          hello ageekhere,

                                          can you update your guide now.

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            aGeekhere
                                            last edited by

                                            what part are you stuck on?

                                            Never Fear, A Geek is Here!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.