Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid3-dev blocks Windows update and other updates

    Scheduled Pinned Locked Moved Cache/Proxy
    28 Posts 17 Posters 18.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Abhishek
      last edited by

      so u disabled Https interception ?    i have no issue deploying cert since i am using AD gpmc

      2.3-RC (amd64)
      built on Mon Apr 04 17:09:32 CDT 2016
      FreeBSD 10.3-RELEASE
      Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

      darkstat 3.1.2_1
      Lightsquid 3.0.3_1
      mailreport 3.0_1
      pfBlockerNG 2.0.9_1  
      RRD_Summary 1.3.1_2
      snort 3.2.9.1_9  
      squid 0.4.16_1  
      squidGuard 1.14_1
      syslog-ng 1.1.2_2

      1 Reply Last reply Reply Quote 0
      • A
        aGeekhere
        last edited by

        You first have to decide if you want to use a transparent proxy or non transparent proxy with wpad

        If you want to try using non transparent proxy with wpad here are a few links
        https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
        https://forum.pfsense.org/index.php?topic=93060.0

        Note: non transparent proxy with wpad you disable HTTPS/SSL interception and Transparent HTTP proxy.

        Let me know if you get stuck

        Never Fear, A Geek is Here!

        1 Reply Last reply Reply Quote 0
        • A
          Abhishek
          last edited by

          So i cant use Https inspection with wpad ?  As far as i understood wpad is a method of delivering proxy server info such as IP address and port number so we don't need to manually configure all client PC's proxy serttings manually in Non Transparent proxy case

          IF using transparent proxy there is no need of configuring wpad

          2.3-RC (amd64)
          built on Mon Apr 04 17:09:32 CDT 2016
          FreeBSD 10.3-RELEASE
          Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

          darkstat 3.1.2_1
          Lightsquid 3.0.3_1
          mailreport 3.0_1
          pfBlockerNG 2.0.9_1  
          RRD_Summary 1.3.1_2
          snort 3.2.9.1_9  
          squid 0.4.16_1  
          squidGuard 1.14_1
          syslog-ng 1.1.2_2

          1 Reply Last reply Reply Quote 0
          • A
            aGeekhere
            last edited by

            So i cant use Https inspection with wpad

            wpad is only used to auto configure a non transparent proxy.

            transparent proxy there is no need of configuring wpad

            You cannot have both.

            Never Fear, A Geek is Here!

            1 Reply Last reply Reply Quote 0
            • KOMK
              KOM
              last edited by

              So i cant use Https inspection with wpad ?

              You can't use the HTTPS Interception feature of pfSense because it goes along with Transparent mode.  If you use an explicit proxy (not transparent) and WPAD auto-detection, then you don't need to worry about certs or group policy.  You will still be able to filter HTTPS streams and your users won't get a browser warning.  The only glitch is that some mobiles, specifically Android, don't do WPAD so those users must manually configure the proxy.

              1 Reply Last reply Reply Quote 0
              • S
                S. Kirschner
                last edited by

                The issue with the actual version of squid for pfsense is , that the acl "ssl::server_name" isnt available.

                The available acl dstdomain shouldnt be used for that, because the information that dstdomain tries to compare are encrypted at these moment.

                You could read the description http://lists.squid-cache.org/pipermail/squid-users/2015-July/004429.html

                Another issue with Windows Update is , that Microsoft use self signed certificate that are not signed by VeriSign.
                There would be 2 solutions for the 2nd issue , ignoring cert errors or import the certificate.

                1 Reply Last reply Reply Quote 0
                • R
                  ramalave
                  last edited by

                  Create Aliases Called add WindowsUpdate and the following list for the networking group
                  157.54.0.0/15
                  157.56.0.0/14
                  157.60.0.0/16
                  65.52.0.0/14
                  70.37.0.0/17
                  70.37.128.0/18
                  207.46.0.0/16
                  131.107.0.0/16
                  66.119.144.0/20
                  23.96.0.0/13
                  204.79.195.0/24
                  204.79.196.0/23
                  208.76.44.0/22
                  208.68.136.0/21
                  216.220.208.0/20
                  209.240.192.0/19
                  204.14.180.0/22
                  206.191.224.0/19
                  192.92.90.0/24
                  208.84.0.0/21
                  104.40.0.0/13
                  192.197.157.0/24
                  204.231.192.0/24
                  104.208.0.0/13
                  129.75.0.0/16
                  204.79.179.0/24
                  64.4.0.0/18
                  167.220.0.0/17
                  167.220.128.0/18
                  167.220.192.0/19
                  192.92.214.0/24
                  207.68.128.0/18
                  13.64.0.0/11
                  13.96.0.0/13
                  13.104.0.0/14
                  146.147.0.0/16
                  52.145.0.0/16
                  52.146.0.0/15
                  52.148.0.0/14
                  52.152.0.0/13
                  52.160.0.0/11
                  52.224.0.0/11
                  52.96.0.0/12
                  52.112.0.0/14
                  52.120.0.0/14
                  52.125.0.0/16
                  52.126.0.0/15
                  52.130.0.0/15
                  52.132.0.0/14
                  52.136.0.0/13
                  138.196.0.0/16
                  150.171.0.0/16
                  40.74.0.0/15
                  40.76.0.0/14
                  40.80.0.0/12
                  40.96.0.0/12
                  40.112.0.0/13
                  40.120.0.0/14
                  40.124.0.0/16
                  40.125.0.0/17
                  40.64.0.0/13
                  40.126.128.0/17
                  40.127.0.0/16
                  40.126.0.0/18
                  204.13.120.0/21
                  204.152.18.0/23
                  Then you go to Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                  Enter the created alliase called WindowsUpdate
                  And this way it fixes all the updates for Windows with Transparent Proxy

                  A 1 Reply Last reply Reply Quote 0
                  • R
                    ramalave
                    last edited by

                    Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
                    157.54.0.0/15
                    157.56.0.0/14
                    157.60.0.0/16
                    65.52.0.0/14
                    70.37.0.0/17
                    70.37.128.0/18
                    207.46.0.0/16
                    131.107.0.0/16
                    66.119.144.0/20
                    23.96.0.0/13
                    204.79.195.0/24
                    204.79.196.0/23
                    208.76.44.0/22
                    208.68.136.0/21
                    216.220.208.0/20
                    209.240.192.0/19
                    204.14.180.0/22
                    206.191.224.0/19
                    192.92.90.0/24
                    208.84.0.0/21
                    104.40.0.0/13
                    192.197.157.0/24
                    204.231.192.0/24
                    104.208.0.0/13
                    129.75.0.0/16
                    204.79.179.0/24
                    64.4.0.0/18
                    167.220.0.0/17
                    167.220.128.0/18
                    167.220.192.0/19
                    192.92.214.0/24
                    207.68.128.0/18
                    13.64.0.0/11
                    13.96.0.0/13
                    13.104.0.0/14
                    146.147.0.0/16
                    52.145.0.0/16
                    52.146.0.0/15
                    52.148.0.0/14
                    52.152.0.0/13
                    52.160.0.0/11
                    52.224.0.0/11
                    52.96.0.0/12
                    52.112.0.0/14
                    52.120.0.0/14
                    52.125.0.0/16
                    52.126.0.0/15
                    52.130.0.0/15
                    52.132.0.0/14
                    52.136.0.0/13
                    138.196.0.0/16
                    150.171.0.0/16
                    40.74.0.0/15
                    40.76.0.0/14
                    40.80.0.0/12
                    40.96.0.0/12
                    40.112.0.0/13
                    40.120.0.0/14
                    40.124.0.0/16
                    40.125.0.0/17
                    40.64.0.0/13
                    40.126.128.0/17
                    40.127.0.0/16
                    40.126.0.0/18
                    204.13.120.0/21
                    204.152.18.0/23
                    Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                    Escrevem os aliases criado chamado WindowsUpdate
                    e desta forma você pode atualizar todas as versões do Windows com proxy transparente

                    1 Reply Last reply Reply Quote 0
                    • R
                      ramalave
                      last edited by

                      Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
                      157.54.0.0/15
                      157.56.0.0/14
                      157.60.0.0/16
                      65.52.0.0/14
                      70.37.0.0/17
                      70.37.128.0/18
                      207.46.0.0/16
                      131.107.0.0/16
                      66.119.144.0/20
                      23.96.0.0/13
                      204.79.195.0/24
                      204.79.196.0/23
                      208.76.44.0/22
                      208.68.136.0/21
                      216.220.208.0/20
                      209.240.192.0/19
                      204.14.180.0/22
                      206.191.224.0/19
                      192.92.90.0/24
                      208.84.0.0/21
                      104.40.0.0/13
                      192.197.157.0/24
                      204.231.192.0/24
                      104.208.0.0/13
                      129.75.0.0/16
                      204.79.179.0/24
                      64.4.0.0/18
                      167.220.0.0/17
                      167.220.128.0/18
                      167.220.192.0/19
                      192.92.214.0/24
                      207.68.128.0/18
                      13.64.0.0/11
                      13.96.0.0/13
                      13.104.0.0/14
                      146.147.0.0/16
                      52.145.0.0/16
                      52.146.0.0/15
                      52.148.0.0/14
                      52.152.0.0/13
                      52.160.0.0/11
                      52.224.0.0/11
                      52.96.0.0/12
                      52.112.0.0/14
                      52.120.0.0/14
                      52.125.0.0/16
                      52.126.0.0/15
                      52.130.0.0/15
                      52.132.0.0/14
                      52.136.0.0/13
                      138.196.0.0/16
                      150.171.0.0/16
                      40.74.0.0/15
                      40.76.0.0/14
                      40.80.0.0/12
                      40.96.0.0/12
                      40.112.0.0/13
                      40.120.0.0/14
                      40.124.0.0/16
                      40.125.0.0/17
                      40.64.0.0/13
                      40.126.128.0/17
                      40.127.0.0/16
                      40.126.0.0/18
                      204.13.120.0/21
                      204.152.18.0/23
                      Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                      Escrevem os aliases criado chamado WindowsUpdate
                      e desta forma você pode atualizar todas as versões do Windows com proxy transparente

                      1 Reply Last reply Reply Quote 0
                      • B
                        blueadept
                        last edited by

                        ramalave's solution worked fine for me.

                        1 Reply Last reply Reply Quote 0
                        • A
                          AndrewGR @ramalave
                          last edited by

                          @ramalave , thanks for the list of networks. It helped in my case as well with squid in transparent mode.
                          Are there any other solutions available to fix Windows Updates issues when squid works in transparent mode?
                          Thanks!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.