ClamAV de PfSense no me funciona
-
ClamAV only works for http traffic, anyway, a firewall is not a good solution for virus protection.
The proxy interface and the transparent proxy interface should be the LAN
-
@starnix
Prueba este test. Es un poco clásico, pero te ayudará.
https://www.eicar.org --> link "download testfile"Enlace directo http (o sea, no https):
http://2016.eicar.org/download/eicar.com -
@lucasll
Metiendome en la página https://www.eicar.org --> link "download testfile" y clickando sobre los zips, me deja ejecutar y guardarlo sin ningún problema.Si me meto en el enlace directo con http http://2016.eicar.org/download/eicar.com me sale lo siguiente:
En la barra de direcciones aparece mi dominio acompañado de lo siguiente
http://2016.eicar.org/download/eicar.com
-
@DaddyGo Does this mean that it will only work with pages that have an http certificate? well, nowadays almost no page uses http, now almost all uses https, then it is almost useless
-
You understand the situation exactly well.
ClamAV cannot scan https pages due to MITM -
For a long time there was a problem with the redirect url and own pfSense system domain name,
in case it works well, this page should get you
-
@DaddyGo The person above gave me that same website, one with https and one with http.
If I try to enter the web page with https, I enter without problem and I can download the zips without any problem.Instead in http I get the image that I have attached
-
Yes this is a fairly common test page among IT professionals.
In my example, I used that too.
As I mentioned, this configuration is a problem (redirect url):
Anyway, try to upgrade to 2.4.5, it's your responsibility, but I can say that we've upgraded nearly 25 pfSense devices on our system without any problems. If you are using a virtual machine, be careful.
In 2.4.5 there is a pair of Squid and along with ClamAV update and patch
-
@starnix
También puedes hacer pruebas configurando el proxy explícitamente en el navegador. Es decir, sin modo transparente. -
@lucasll Para configurarlo como tu dices simplemente desactivo la opción de modo transparente y ya?
-
@DaddyGo I will try to update my pfsense in case that is what gives error
-
The non-transparent mode (implicit) requires multiple configurations, which can be inconvenient on a large system
https://docs.netgate.com/pfsense/en/latest/cache-proxy/wpad-autoconfigure-for-squid.html
https://www.ssltrust.com.au/help/setup-guides/setup-squid-proxy
