Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Guide to filtering web content (http and https) with pfsense 2.3

    Scheduled Pinned Locked Moved Documentation
    190 Posts 54 Posters 223.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vielfede
      last edited by

      @aGeekHere:

      sometimes splice all can show SSL errors when web browsing.

      I'd say "often" a  lot of SSL errors!  ;)
      In my opinion Splice All is not usable in the way it is now (without WPAD).

      1 Reply Last reply Reply Quote 0
      • O
        originalsin
        last edited by

        guess it is way too late for asking abbration.

        But what does "Tic" stands for?

        I can not find out the Tic in Pfsense and can not figure it out.

        Plz somebody help me!!!

        1 Reply Last reply Reply Quote 0
        • A
          aGeekhere
          last edited by

          Tick, select.

          Never Fear, A Geek is Here!

          1 Reply Last reply Reply Quote 0
          • Y
            yaska
            last edited by

            I have multiple vlans with different IP addresses

            VLAN_50 = 192.168.50.0
            VLAN_60 = 192.168.60.0

            How do I add all the IPs to the below section

            function FindProxyForURL(url, host)
            {
                if (isPlainHostName(host) ||
                    shExpMatch(host, "*.local") ||
                    isInNet(dnsResolve(host), "192.168.60.0",  "255.255.255.0"))
                    return "DIRECT";

            return "PROXY 192.168.60.1:3128";
            }

            1 Reply Last reply Reply Quote 0
            • S
              shan52
              last edited by

              Why is the difference between Squiguard and OpenDNS?

              1 Reply Last reply Reply Quote 0
              • V
                vielfede
                last edited by

                Just one thing I can not get working:

                Windows 7 updates, W7 detects them, but it's not able to download. I read something about here, but I do not know how to manage it.
                https://wiki.squid-cache.org/SquidFaq/WindowsUpdate#Squid_with_SSL-Bump_and_Windows_Updates

                Anyone with the same problem?
                Solutions? Workarounds?
                Thanks in advance

                1 Reply Last reply Reply Quote 0
                • S
                  shan52
                  last edited by

                  We have lots of laptop and pc, is there an easier way to install the cert for all the devices?

                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere
                    last edited by

                    I have multiple vlans with different IP addresses

                    I do not use vlans so I do not know, sorry

                    Why is the difference between Squiguard and OpenDNS?

                    Squiguard block content on rules you set on your router (totally private).
                    OpenDNS block content on rules you set on their servers (they see all traffic, also can be slower)

                    Just one thing I can not get working

                    Windows updates (as well as Mac and linux) should all be working, if it is not that you may have missed a step. Check that the WPAD is working and your pc is set to auto configure.
                    If it is still not working read though the guide again, it should work.

                    We have lots of laptop and pc, is there an easier way to install the cert for all the devices?

                    You only have to create a cert of squid when using splice all not for all devices

                    Hope this helps

                    Never Fear, A Geek is Here!

                    1 Reply Last reply Reply Quote 0
                    • D
                      DerHeldvomErdbeerfeld
                      last edited by

                      Hi there,

                      I just read this guide and also tried a little bit an the most I tried worked. Now I just have some
                      questions for better understanding.

                      @aGeekHere:

                      Guide to filtering web content (http and https) with pfsense 2.3 updated 09 June 2017

                      To stop users from bypassing your proxy setup a new firewall lan rule and block port 80 and 443
                      IPv4 TCP * * * 80 - 443 * none.
                      Save

                      If I set it up like this FROM 80 TO 443 (this is what it mean to me 80-443) didnt I block also all ports
                      between 80 and 443? Wouldnt it be better to set up two rules or an alias (Firewall/Aliases/Ports)
                      for the pot 80 and 443 or did I understood it wrong?

                      I also want to use a dual wan configuration, is there something to take care of?

                      –-
                      greets from Germany

                      DerHeldvomErdbeerfeld

                      1 Reply Last reply Reply Quote 0
                      • A
                        aGeekhere
                        last edited by

                        hi
                        1. I created two rules, one for port 80 and one for 443 (I will update this part of the guide)

                        2. I do not think squid works on dual wan

                        Never Fear, A Geek is Here!

                        1 Reply Last reply Reply Quote 0
                        • T
                          Tecnergy
                          last edited by

                          Hi, thanks for this guide it has helped me a lot, bear with me pls no bully, I just installed pfsense

                          "the wpad will be setup to use port 80 and 443. The transperrent proxy is going to catch every thing that the wpad misses, enable transperrent proxy in squid once you have the wpad setup."

                          shouldn't be "the proxy will be setup…"?

                          Guide is missing configuration of mime type, I don't know which file to edit. I've read other guides and most of them say something about adding mime types for .da, .dat and .pac (if it's not there already)

                          Anyways, my problem is that I cannot download the files so no HTTPS filtering for me. I've made a folder inside www called wpad "www/wpad"
                          I cannot reach wpad.mydomain.local/wpad/wpad.da nor any other. Ping to wpad.mydomain.local responds to firewall IP

                          It's probably something dumb like a firewall rule but I can't see it.

                          -I have changed access to GUI to port 9999 and HTTP
                          -squid and squidguard services up
                          -with MiTM enabled I can't access HTTPS sites (because no downloading of proxy files I guess)
                          -Im running pfblocker too
                          -pfsense is my DHCP and DNS server
                          -have two WAN (I've read it squid proxy doesn't work with dual wan but it is blocking http OK like this)

                          Can you help me to realize whats wrong with the downloading of files for wpad?

                          thanks.

                          1 Reply Last reply Reply Quote 0
                          • T
                            Tecnergy
                            last edited by

                            Hi,

                            I managed to make it work by implementing another recurrent instance of nginx following another guide I found on the internet (I don't know if I'm allowed to post external links so I won't).

                            it seems to be working so far with 2 WAN's in load balance mode and it is filtering both http and https it seems with out MitM.

                            Thanks!

                            1 Reply Last reply Reply Quote 0
                            • J
                              J7529
                              last edited by

                              Hello,

                              Just following the Guide, I am getting a issue where when searching on https i get "This site can't be reached" and when browsing on http I get "The requested URL could not be retrieved" I am only trying to get to Google which is let through!

                              How I am currently setting up is behind a Router/Firewall and we already have a DNS server so I haven't enabled DNS Resolver, would this cause issues?

                              Thanks!

                              1 Reply Last reply Reply Quote 0
                              • M
                                MartinN
                                last edited by

                                @aGeekHere:

                                Go to Services/DNS/Resolver/General Settings
                                in custom option enter

                                server:
                                include: /var/unbound/forecegoogle.conf
                                

                                You have mis-spelled the filename here, which prevents it from being saved by pfSense. Please fix it  8)

                                Thanks for the guide, excellent stuff!

                                1 Reply Last reply Reply Quote 0
                                • A
                                  aGeekhere
                                  last edited by

                                  Fixed spelling

                                  Never Fear, A Geek is Here!

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    nib01
                                    last edited by

                                    @nib01:

                                    I got confused when you say add (blue). Did you mean add (blue) below yellow within the same wpad.da file? or..

                                    "Part 3
                                    Now we are going to set up a wpad read more here about wpad https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
                                    ssh in to pfsense
                                    8
                                    cd /
                                    create the wpad.da file
                                    vi /usr/local/www/wpad.da
                                    wq

                                    Create two new symbolic link files
                                    Code: [Select]
                                    ln -s /usr/local/www/wpad.da /usr/local/www/wpad.dat
                                    ln -s /usr/local/www/wpad.da /usr/local/www/proxy.pac

                                    Then go Diagnostics /Edit File
                                    click browse
                                    user
                                    local
                                    www
                                    click wpad.da
                                    add

                                    Code: [Select]
                                    function FindProxyForURL(url, host)
                                    {
                                        if (isPlainHostName(host) ||
                                            shExpMatch(host, "*.local") ||
                                            isInNet(dnsResolve(host), "192.168.1.0",  "255.255.255.0"))
                                            return "DIRECT";

                                    return "PROXY 192.168.1.1:3128";
                                    }

                                    save"

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aGeekhere
                                      last edited by

                                      You have to create 3 files in /usr/local/www/
                                      wpad.da
                                      wpad.dat
                                      proxy.pac

                                      Each having this code

                                      function FindProxyForURL(url, host) 
                                      { 
                                          if (isPlainHostName(host) ||
                                              shExpMatch(host, "*.local") ||
                                              isInNet(dnsResolve(host), "192.168.1.0",  "255.255.255.0"))
                                              return "DIRECT";
                                      
                                          return "PROXY 192.168.1.1:3128";
                                      } 
                                      

                                      Instead of maintaining changes for all 3 files you can create a main file e.g. wpad.da and create a symbolic link for the other 2 files, that way all changes from wpad.da are copied over to the other files.

                                      So now you only need to make changes to wpad.da.

                                      Never Fear, A Geek is Here!

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kpoman
                                        last edited by

                                        Is there any way to force safesearch (google youtube etc…) if your DNS is on a Windows Server AD but your gateway pfSense is intercepting all http on a squid instance ?

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          aGeekhere
                                          last edited by

                                          @kpoman:

                                          Is there any way to force safesearch (google youtube etc…) if your DNS is on a Windows Server AD but your gateway pfSense is intercepting all http on a squid instance ?

                                          Read the DNS resolver part in the guide and see if you can use that method.

                                          Never Fear, A Geek is Here!

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jopeme
                                            last edited by

                                            I see a problem with this option and it is that many of my clients have problems to watch YouTube videos, when they search from Google, since it shows that they are restricted videos and that you have to register.

                                            Click add under Host overrides
                                            Host = www
                                            Domain = youtube.com
                                            IP =  216.239.38.120
                                            Description = youtube
                                            Save
                                            NOTE: Safe search for youtube is not as advanced as google safe search, which results in a lot of safe content be filtered out.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.