ClamAV de PfSense no me funciona

starnix

@lucasll
Metiendome en la página https://www.eicar.org --> link "download testfile" y clickando sobre los zips, me deja ejecutar y guardarlo sin ningún problema.

Si me meto en el enlace directo con http http://2016.eicar.org/download/eicar.com me sale lo siguiente:

En la barra de direcciones aparece mi dominio acompañado de lo siguiente

http://2016.eicar.org/download/eicar.com

starnix

@DaddyGo Does this mean that it will only work with pages that have an http certificate? well, nowadays almost no page uses http, now almost all uses https, then it is almost useless

DaddyGo

You understand the situation exactly well.
ClamAV cannot scan https pages due to MITM

DaddyGo

For a long time there was a problem with the redirect url and own pfSense system domain name,
in case it works well, this page should get you

starnix

@DaddyGo The person above gave me that same website, one with https and one with http.
If I try to enter the web page with https, I enter without problem and I can download the zips without any problem.

Instead in http I get the image that I have attached

DaddyGo

Yes this is a fairly common test page among IT professionals.
In my example, I used that too.
As I mentioned, this configuration is a problem (redirect url):

Anyway, try to upgrade to 2.4.5, it's your responsibility, but I can say that we've upgraded nearly 25 pfSense devices on our system without any problems. If you are using a virtual machine, be careful.

In 2.4.5 there is a pair of Squid and along with ClamAV update and patch

lucasll

@starnix
También puedes hacer pruebas configurando el proxy explícitamente en el navegador. Es decir, sin modo transparente.

starnix

@lucasll Para configurarlo como tu dices simplemente desactivo la opción de modo transparente y ya?

starnix

@DaddyGo I will try to update my pfsense in case that is what gives error

DaddyGo

The non-transparent mode (implicit) requires multiple configurations, which can be inconvenient on a large system

https://docs.netgate.com/pfsense/en/latest/cache-proxy/wpad-autoconfigure-for-squid.html
https://www.ssltrust.com.au/help/setup-guides/setup-squid-proxy