Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Guide to filtering web content (http and https) with pfsense 2.3

    Scheduled Pinned Locked Moved Documentation
    190 Posts 54 Posters 225.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marksantos
      last edited by

      the problem is default acl. when i try do deny all, the whitelist website can't load some images, when i try to allow default acl the whitelist website, can load images but the browsing of the whitelist are very slow.

      1 Reply Last reply Reply Quote 0
      • M
        marksantos
        last edited by

        i'll try the whitelist website can only access and the other can block.

        1 Reply Last reply Reply Quote 0
        • M
          marksantos
          last edited by

          hi sir, how about gmail, how to allow gmail in whitelist, i tried add gmail.com in whitelist but still block the access.

          1 Reply Last reply Reply Quote 0
          • A
            aGeekhere
            last edited by

            In squidguard set Default access [all] to allow. Now only block the categories you want. You can use shallalist for categories.

            Never Fear, A Geek is Here!

            1 Reply Last reply Reply Quote 1
            • 4
              4o4rh
              last edited by

              dns resolver doesn't start when i include the forcegoogle.conf in the custom options.

              if i remove it, it works just fine.

              1 Reply Last reply Reply Quote 0
              • A
                aGeekhere
                last edited by

                did you make the forecegoogle.conf file?

                Never Fear, A Geek is Here!

                4 1 Reply Last reply Reply Quote 0
                • 4
                  4o4rh @aGeekhere
                  last edited by

                  @aGeekhere problem was, i followed the initial instructions by putting the youtube and bing into the host overrides, then copied the whole forcegoogle section without checking the contents.

                  In has youtube with a different address and bing. Removed those and it works.

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnchon
                    last edited by

                    i have follow the topic to do the filter but when i just activate transparent mode only i get this message " 400 Bad Request
                    The plain HTTP request was sent to HTTPS port
                    nginx"

                    May i know what happen for this ?

                    1 Reply Last reply Reply Quote 0
                    • A
                      aGeekhere
                      last edited by

                      only using the transparent can cause connection issues, in this guide i have it as a fallback for programs which do not have proxy settings.

                      First setup WPAD or manually configure devices to use proxy
                      then configure windows to auto use the proxy in lan settings
                      then set up the transparent proxy with mitm splace all to catch programs with no proxy settings

                      Never Fear, A Geek is Here!

                      J 1 Reply Last reply Reply Quote 1
                      • J
                        johnchon @aGeekhere
                        last edited by

                        @aGeekhere

                        1. But at firewall rules already forward all Lan to proxy still need to setup WPAD ?
                        2. At proxy settings i have Enable Transparent Proxy Settings & SSL Man In the Middle Filtering by spice all.
                        3. Because i have filter social network and shopping and youtube website.
                        1 Reply Last reply Reply Quote 0
                        • A
                          aGeekhere
                          last edited by

                          @johnchon said in Guide to filtering web content (http and https) with pfsense 2.3:

                          But at firewall rules already forward all Lan to proxy still need to setup WPAD ?

                          When you only use Transparent you can get connection issues. Try this, configure your device to use the proxy,for windows it is under lan settings (WPAD automates this).

                          Next make sure your web browser is using the proxy.

                          Do you still get connection issues?

                          Never Fear, A Geek is Here!

                          J 2 Replies Last reply Reply Quote 0
                          • J
                            johnchon @aGeekhere
                            last edited by

                            @aGeekhere i have both enable tranparent and the SSL filter, when only enable using transparent mode only all website running good. No issues for connection. i'm using firefox for auto detect proxy server.

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnchon @aGeekhere
                              last edited by

                              @aGeekhere when using manual for firefox proxy IP:192.168.0.1 and port :3128 , then the connection issues

                              1 Reply Last reply Reply Quote 0
                              • A
                                aGeekhere
                                last edited by

                                for firefox there is a bug where if you set it to use system proxy settings it will not connect https://bugzilla.mozilla.org/show_bug.cgi?id=621429

                                manually configure firefox to use the proxy

                                Never Fear, A Geek is Here!

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  johnchon @aGeekhere
                                  last edited by

                                  @aGeekhere i have set to use manual for IP 192.168.0.1 and port :3128, and tick use this proxy for all protocol but the connection issues also.

                                  1 Reply Last reply Reply Quote 0
                                  • High_VoltageH
                                    High_Voltage @aGeekhere
                                    last edited by

                                    @aGeekhere I know this is an old topic and all, but I just wanted to express my deepest gratitude to you ageekhere, I have been struggling with squid, pfsense, and trying to get crap to just freaking work for a few weeks to a month now, I am FAR from the most knowledgeable or experienced in this crap, but this is what I'm passionate about as a hobby of mine (hopefully career in the not so far off span of time) and all of my knowledge is self taught, trial and error, a handful of catastrophes (NOTE A POWER SUPPLY SHOULD NEVER, EVER, SOUND LIKE AN ARC WELDER, IF IT DOES, YOU JUST NUKED IT, TAKE MY WORD FOR THIS ONE XD) and a LOT of hard earned money spend in this hobby of mine, to the degree you'd think illicit substances would be cost saving!!! jokes aside though (seriously, bad joke, but I can't help myself because I spend so much money on this hobby its sickening/nauseating to think about!) I do this stuff for fun, and out of all the guides I have followed so far, yours has a HANDFUL of points that I had missed in my attempts to set up wpad/squid/all of this stuff, and so far so good, so I just wanted to pop on here, resurrect an old thread, and say THANK YOU!

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aGeekhere
                                      last edited by

                                      I still run this setup and everything is working fine, a lot of trial and error went into getting this to work.
                                      Cloudflare's new 1.1.1.2 and 1.1.1.3 is a new thing that can be added to this setup
                                      https://community.cloudflare.com/t/pfsense-and-1-1-1-3-not-blocking-adult-content/164747/10
                                      they are still working on DoT for 1.1.1.3.

                                      Never Fear, A Geek is Here!

                                      1 Reply Last reply Reply Quote 0
                                      • N
                                        nancyvinci Banned
                                        last edited by

                                        Wow! Thanks for this amazing guide!

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.