Squid/SquidGuard NONE/409 and DNS issue

KOM

@shawn8888 Something is wrong with your config. You don't need WPAD if you're still running transparent mode. It's one or the other.

aGeekhere

@kom
I think if you go direct with the WPAD the transparent proxy will see traffic going directly through port 80/443 and will redirect the traffic through the proxy again. So by adding the bypass in squid it prevents it from being routed through the transparent proxy.

If you turn off the transparent proxy and just rely on the WPAD some software may have connection issues.

shawn8888

@kom
If I disable transparent mode, then all my devices lost Internet. So honestly, at this point, I don't know if WPAD or transparent mode is working.
However, twitter image/video now works both on my PC and my iPad, and it didn't work before.

aGeekhere

@shawn8888
A way to test if the WPAD is working is temporary turn off the transparent proxy and make sure autoconfig in turn on. If you internet browser uses the proxy then it is working.

shawn8888

@ageekhere

What do you mean "autoconfig"?
I followed the help here:

If I turn off transparent mode and change firefox network settings:

Still no Internet. So I guess WPAD never worked...

KOM

@shawn8888 What happens when you try to resolve 'wpad' or 'wpad.yourdomain.lol' on your network? Does it come back with the IP address of the server holding the wpad.dat file? IIRC your wpad.dat file to live on an http server or a trusted https server. Any cert errors will stop the wpad file from being read.

shawn8888

@kom
I think I have followed all the steps on doc page.
Ping/dns is fine, and I can download the wpad.dat file from the browser.

One question though:
If the transparent mode works, why do you need wpad? Is that because transparent mode is bugy?

aGeekhere

@shawn8888
To set auto config in windows go to
Control Panel - Internet Properties - connections - LAN settings and select Automatically detect settings.

Make sure programs are set to Use system proxy settings.
Test with chrome for now as firefox in the past had an outstanding bug with auto configuring a proxy which i am not sure if it was fixed.

"If the transparent mode works, why do you need wpad? Is that because transparent mode is bugy?"

From memory transparent proxy can break certificates resulting in a failed connection, though someone with more knowledge would have to confirm the technical details.

Also in your WPAD add to the top

if (shExpMatch(host, "ENTER YOUR PFSENSE DOMAIN HERE")) return "DIRECT";

use https://app.thorsen.pm/proxyforurl for testing the WPAD for errors

shawn8888

@ageekhere

Thank you guys for the endless help. I haven't given up because of you!

My Internet properties look good.
Chrome also points to Auto detect.
My wpad.dat now looks like below and the proxy tester didn't complain
I also tested on my iPhone, iPad, same as my PC. As soon as I disable transparent mode, Internet drops.
I checked my iOS -> wifi -> HTTP PROXY -> Configure Proxy -> Automatic
All my devices can download the wpad.dat file from the browser:
http://192.168.100.1/wpad.dat

function FindProxyForURL(url,host)
{
if (shExpMatch(host, "pfsense.mydomain.com")) 
  return "DIRECT";

if (isInNet(myIpAddress(), "192.168.100.155", "255.255.255.0")) 
  return "DIRECT";

  return "PROXY 192.168.100.1:3128";
}

aGeekhere

@shawn8888
I think i see the issue

Under Additional BOOTP/DHCP Options change to

252 String "http://192.168.1.1/wpad.dat"
252 String "http://192.168.1.1/wpad.da"
252 String "http://192.168.1.1/proxy.pac"

Under DNS ResolverGeneral Settings Host Overrides add

wpad	YourPfsenseDomain	192.168.1.1	wpad

https://docs.netgate.com/pfsense/en/latest/recipes/http-client-proxy-wpad.html?highlight=wpad

"A WPAD host may be supplied via DHCP numbered option 252 (string value containing the entire URL to the WPAD file) or DNS, which is easy to do with the built-in DNS forwarder."

Make sure you get the correct YourPfsenseDomaid, something like pfsensedomain.local
You can check in windows by using cmd and look for Connection - specific DNS suffix

shawn8888

@ageekhere
no luck.
From what I read, you only need DHCP or dns resolver. I tried both, and still the same.
Even though I am complete newbie about wireshark, I gave it a shot. And I cannot even find string "wpad" in the logs.

aGeekhere

@shawn8888 Try Resetting the States, Diagnostics States Reset States.
Also try restarting your pc and router.

KOM

@shawn8888 Transparent mode isn't buggy per se, it's just that you have to consider other things when using it. You're trying to intercept a data stream that is trying to prevent you from doing so. You either need to install a trusted cert on every device that will use your transparent proxy to void MitM browser errors when using Splice/Bump, or no certs and you use Splice All. If transparent mode works for you then use that but I find explicit mode has less hassles.

Are you sure that your proxy works? What happens if you manually set a browser to use it?

shawn8888

@ageekhere
I reboot pfSense and client pc. wpad is still not working.

@KOM
"Splice All" is recommended in order to use squidguard, which is the main reason I use squid for.

My proxy ONLY works at Transparent mode.
I have tried turning off Transparent mode and setting proxy manually (set IP and port 3128) on my PC. But it seems that a lot of things are not working. For example, I can open speedteset.net, but when I hit "go" button, it never starts.

KOM

@shawn8888 When running in explicit mode, how does it not work exactly? What browser error are you getting? Squid normally just works right out of the box.

shawn8888

@kom
What do you mean by "explicit mode"?
Does that mean:
Disable both "Transparent mode" and "Enable SSL filtering.", and manually set clients to use ip:3128 as proxy?

KOM

@shawn8888 Yes. Explicit means not transparent, no SSL interception. Clients can be manually set or use WPAD once you determine squid is working properly.

shawn8888

@kom

My proxy now works on explicit mode.
I turned off "Transparent HTTP Proxy" and "HTTPS/SSL Interception".
I also turned off the lan rules, which you suggest for wpad bypass some devices earlier.

This allows all LAN devices to go Internet directly by default, right? All my LAN devices can access Internet at this moment.

I tested on my iPad to set wifi manually use proxy at IP:3128. It worked. the only thing not working so far is speedtest.net go button. It stays at connecting forever.

I tested my PC.
firefox, set proxy in option:

I find that only http websites get blocked by squidguard. And https blocked websites can passthrough. Is it because https websites are bypassed due to "HTTPS/SSL Interception" being off?

I also tried Chrome and set the proxy like this:

It's funny that Chrome can not only see squidguard blocks http websites, but also https ones!
speedtest.net go button still not working.
Another thing doesn't work is the local websites. It gives me Access Denied error:

So I guess the explicit mode works, but I still need wpad or transparent working so I don't have to deal with the clients...

KOM

@shawn8888 Lots to unpack here.

This allows all LAN devices to go Internet directly by default, right?

You didn't show your complete LAN rule set so I don't know but I can assume the last rule is the default Allow All rule. Btw you can do the block with just one rule by making a port alias called WebPorts that contains 80,443.

I tested on my iPad to set wifi manually use proxy at IP:3128. It worked. the only thing not working so far is speedtest.net go button.

No idea about that but it seems to be a common thing with speedtests and proxies.

I tested my PC. firefox, set proxy in option

I notice you didn't set the https proxy or check the checkbox to use the same proxy for ftp and https. You need to do one or the other.

I find that only http websites get blocked by squidguard.

Get squid working first before you worry about that. Disable squidguard until you have squid working.

Is it because https websites are bypassed due to "HTTPS/SSL Interception" being off?

That might be because you didn't set the https proxy.

Another thing doesn't work is the local websites.

Either use the site's LAN IP address, or use split DNS to resolve your domain to its LAN IP instead of its public IP.

shawn8888

@kom

You are right! After I "check the checkbox to use the same proxy for ftp and https" Firefox works the same as Chrome for https websites.

If squid doesn't work for certain websites like speedtest.net, how to set them as exceptions?

The local website is an oddball:
The ping shows the dns is solved as a local IP, 192.168.100.155
But no matter dns or ip, it all shows as Access Denied by squid. And it only not working for this tt-rss site, other local websites with the same domain but different ports are OK:
Working ones:
http://syn1.mydomain.com:5000/
http://syn1.mydomain.com:8080/
http://syn1.mydomain.com:5076/

NOT Working:
http://syn1.mydomain.com:181/tt-rss/
http://192.168.100.155:181/tt-rss/

Logs: