• 0 Votes
    11 Posts
    4k Views
    C

    @Patch @stephenw10 Thanks for your help! Replacing the switch fixed the issue! I factory reset the TP Link managed switch and it's working now too. It's sometimes the simple stuff you over look on the troubleshooting path that trip you up.

    I could not determine any reason why the TP Link managed switch was preventing the Proxmox GUI from coming up. I checked everything before I reset it.

    Thanks again!

  • 0 Votes
    8 Posts
    3k Views
    F

    @Gertjan Other one are missing,

    because of google being blocked in china, cellphones and multiple chinese garbage browsers (360browser, etc...) are usually using one of these URL:

    https://connect.rom.miui.com/generate_204 (Xiaomi) http://www.qualcomm.cn/generate_204 (Huawei) http://www.265.com/generate_204 (Google Chrome, Asus cellphones. This website is owned by google)

    I also heard that nintendo devices are using http://conntest.nintendowifi.net for captive portal detection
    but anyway, i don't think that's very important..

  • 0 Votes
    7 Posts
    1k Views
    stephenw10S

    Almost certainly not the same issue.

    But small packet pass (initial handshake) big packets fail (TLS exchange) does sounds like it could be MTU.

    Why are you running 2.3.5 though? Unless you have a very good reason not to you should upgrade before doing anything else.

    Steve

  • 0 Votes
    8 Posts
    3k Views
    B

    All..... The script came from user Remzej. I have it on a cron job to check every 5 minutes (we are a busy proxy environment)...

    */2 * * * * root /usr/bin/nice -n20 /usr/local/bin/php-cgi -f /usr/local/pkg/monitor_memory_usage.php

    #!/usr/local/bin/php-cgi -f
    <?php
    /*

    monitor_memory_usage.php

    part of pfSense (https://www.pfsense.org)

    Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)

    All rights reserved.

    Licensed under the Apache License, Version 2.0 (the "License");

    you may not use this file except in compliance with the License.

    You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software

    distributed under the License is distributed on an "AS IS" BASIS,

    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

    See the License for the specific language governing permissions and

    limitations under the License.
    */
    require_once('config.inc');
    require_once('util.inc');
    require_once('squid.inc');
    global $config;

    // Monitor memory usage by remzej
    // Get SWAP usage funtion
    function swap_usage() {
    exec("/usr/sbin/swapinfo", $swap_info);
    $swap_used = "";
    foreach ($swap_info as $line) {
    if (preg_match('/(\d+)%$/', $line, $matches)) {
    $swap_used = $matches[1];
    break;
    }
    }
    return $swap_used;
    }

    // Get memory usage function
    function mem_usage() {
    $memory = "";
    exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
    "vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

    $totalMem = $memory[0]; $availMem = $memory[1] + $memory[2] + $memory[3]; $usedMem = $totalMem - $availMem; $memUsage = round(($usedMem * 100) / $totalMem, 0); return $memUsage;

    }

    // Get memory and SWAP usage value
    $memusage_pct = mem_usage();
    $swapusage_pct = swap_usage();

    // Display memory usage
    echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
    echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

    // If memory usage is above 90%, stop and restart squid services.
    if (($memusage_pct > 90) or ($swapusage_pct > 80)) {
    squid_stop_monitor();
    if (is_service_running('squid')) {
    stop_service("squid");
    }
    squid_restart_services();
    log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent, Swap Usage is $swap_usage percent, stopping and restarting services.")));
    }
    log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and Swap Usage is $swapusage_pct")));
    ?>

  • 0 Votes
    14 Posts
    5k Views
    P

    You can still do some filtering on HTTPS without the MITM. On E2 Guardian, I have multiple groups setup, some which have MITM enabled and some such as in your case that are for Guest Wi-Fi where I can't properly sneak in the CA. On Squid I believe this is referred to as Bump and Splice all.

    For my guest Wi-Fi setups, I just use the non-MITM method. This is where the proxy is able to see the domain name without the resource path at the end in order to decide if a website should be let through or not. MITM would obviously allow the proxy to look at the entire URL with the resource path and make a informed decision as to whether or not to allow a website through. I prefer it way more than DNS level filtering as it's more flexible. You can set it up for specific users while others can browse those sites just fine.

    If you've got sometime, I recommend you give E2 Guardian a shot. It worked out a lot better than Squid in my use case and it has the added benefit of actual phrase filtering.