Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SquidGuard seems do not filtering traffic

    Scheduled Pinned Locked Moved Cache/Proxy
    1 Posts 1 Posters 1.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Someone
      last edited by

      pfSense 2.3.4-RELEASE (i386) (FreeBSD 10.3-RELEASE-p19), upgraded from one of old previous releases, with installed

      • Squid 0.4.36_3 (squid-3.5.24_2)
      • squidGuard 1.16.2 (squidGuard-1.4_15)

      Subnet 172.16.0.0/16, proxy IP: 172.16.254.1:54321

      After pfSense upgrade squid and squidGuard was deinstalled, manually checked (by "pkg info" in console) that there're no any other versions installed. Then, squid and SG installed and checked again.
      Squid runs in "simple" mode: no SSL intercept, no transparent proxy. All works OK.
      SG shows it's running, blacklist downloaded (ShallaList) and installed, our own group ACLs created, targets pointed. Everything seems ok.
      Manually created own blacklist (named "MDS_blk_all"), added site to it, selected "Deny" to it to all. Nothing is vlocked

      But SG doesn't filter any rule. When changing something in SG "Save" button pressed, then "Apply" button pressed too.

      Below are configs:
      squid.conf

      # This file is automatically generated by pfSense
      # Do not edit manually !
      
      http_port 172.16.254.1:54321
      icp_port 0
      digest_generation off
      dns_v4_first on
      pid_filename /var/run/squid/squid.pid
      cache_effective_user squid
      cache_effective_group proxy
      error_default_language ru
      icon_directory /usr/local/etc/squid/icons
      visible_hostname 172.16.254.1
      cache_mgr admin@localhost
      access_log /var/squid/logs/access.log
      cache_log /var/squid/logs/cache.log
      cache_store_log none
      netdb_filename /var/squid/logs/netdb.state
      pinger_enable on
      pinger_program /usr/local/libexec/squid/pinger
      
      logfile_rotate 31
      debug_options rotate=31
      shutdown_lifetime 3 seconds
      # Allow local network(s) on interface(s)
      acl localnet src  172.16.0.0/16
      forwarded_for on
      httpd_suppress_version_string on
      uri_whitespace strip
      dns_nameservers 8.8.8.8 
      acl dynamic urlpath_regex cgi-bin ?
      cache deny dynamic
      
      cache_mem 8 MB
      maximum_object_size_in_memory 32 KB
      memory_replacement_policy heap GDSF
      cache_replacement_policy heap LFUDA
      minimum_object_size 0 KB
      maximum_object_size 4 MB
      cache_dir ufs /var/squid/cache 100 16 256
      offline_mode off
      cache_swap_low 90
      cache_swap_high 95
      cache allow all
      # Add any of your own refresh_pattern entries above these.
      refresh_pattern ^ftp:    1440  20%  10080
      refresh_pattern ^gopher:  1440  0%  1440
      refresh_pattern -i (/cgi-bin/|?) 0  0%  0
      refresh_pattern .    0  20%  4320
      
      #Remote proxies
      
      # Setup some default acls
      # ACLs all, manager, localhost, and to_localhost are predefined.
      acl allsrc src all
      acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  54321 3129 1025-65535 
      acl sslports port 443 563  5222 5223
      
      acl purge method PURGE
      acl connect method CONNECT
      
      # Define protocols used for redirects
      acl HTTP proto HTTP
      acl HTTPS proto HTTPS
      acl allowed_subnets src 127.0.0.0/8
      http_access allow manager localhost
      
      # Allow external cache managers
      acl ext_manager src 172.16.254.1
      http_access allow manager ext_manager
      
      http_access deny manager
      http_access allow purge localhost
      http_access deny purge
      http_access deny !safeports
      http_access deny CONNECT !sslports
      
      # Always allow localhost connections
      http_access allow localhost
      
      request_body_max_size 0 KB
      delay_pools 1
      delay_class 1 2
      delay_parameters 1 -1/-1 -1/-1
      delay_initial_bucket_level 100
      delay_access 1 allow allsrc
      
      # Reverse Proxy settings
      
      # Package Integration
      url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
      url_rewrite_bypass off
      url_rewrite_children 16 startup=8 idle=4 concurrency=0
      
      # Custom options before auth
      
      # Setup allowed ACLs
      # Allow local network(s) on interface(s)
      http_access allow allowed_subnets
      http_access allow localnet
      # Default block all to be sure
      http_access deny allsrc
      
      

      squidGuard.conf

      logdir /var/squidGuard/log
      dbhome /var/db/squidGuard
      
      # 
      time all_time {
      	weekly * 00:00-23:59
      	weekly * 00:00-23:59
      }
      
      # All MDS inet users
      src ALL_172 {
      	ip     172.16.4.59
      	log block.log
      }
      
      # 
      dest blk_BL_adv {
      	domainlist blk_BL_adv/domains
      	urllist blk_BL_adv/urls
      	redirect http://172.16.254.1:80/sgerror.php?url=blank_img&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      	log block.log
      }
      
      ....
      Big list of destinations
      ....
      # Block mp3|wav|avi|mp4|mpeg4|ac3|flv
      dest MDS_blk_media {
      	expressionlist MDS_blk_media/expressions
      }
      
      # Blacklist for all
      dest MDS_blk_all {
      	domainlist MDS_blk_all/domains
      	expressionlist MDS_blk_all/expressions
      	redirect http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      	log block.log
      }
      
      # 
      rew banner {
      	s@yandex.ru@http://job.ru@r
      	s@@@r
      }
      
      # 
      rew safesearch {
      	s@(google..*/search?.*q=.*)@&safe=active@i
      	s@(google..*/images.*q=.*)@&safe=active@i
      	s@(google..*/groups.*q=.*)@&safe=active@i
      	s@(google..*/news.*q=.*)@&safe=active@i
      	s@(yandex..*/yandsearch?.*text=.*)@&fyandex=1@i
      	s@(search.yahoo..*/search.*p=.*)@&vm=r&v=1@i
      	s@(search.live..*/.*q=.*)@&adlt=strict@i
      	s@(search.msn..*/.*q=.*)@&adlt=strict@i
      	s@(.bing..*/.*q=.*)@&adlt=strict@i
      	log block.log
      }
      
      # 
      acl  {
      	# All MDS inet users
      	ALL_172  within all_time {
      		pass !MDS_blk_all MDS_white_all all
      		redirect http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      		log block.log
      		} else {
      		pass !MDS_blk_all MDS_white_all all
      		redirect http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      		log block.log
      	}
      	# 
      	default  {
      		pass MDS_white_all !in-addr !MDS_blk_all !MDS_blk_media !blk_BL_sex_education !blk_BL_sex_lingerie !blk_BL_urlshortener !blk_BL_violence none
      		redirect http://172.16.254.1:80/sgerror.php?url=403%20&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      		rewrite banner
      		log block.log
      	}
      }
      

      squidGuard.log

      15.05.2017 14:53:31	[squid_reconfigure] Add new redirector options to Squid config.
      15.05.2017 14:53:31	[squid_reconfigure] Remove old redirector options from Squid config.
      15.05.2017 14:53:31	[sg_reconfigure] Save squidGuard config to '/usr/local/etc/squidGuard/squidGuard.conf'.
      15.05.2017 14:53:31	[sg_redirector_base_url] Select redirector base url (http://172.16.254.1:80/sgerror.php?url=403%20&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u)
      15.05.2017 14:53:31	[sg_create_config] Add Default
      15.05.2017 14:53:31	[sg_create_config] Add ACL's: ALL_172;
      15.05.2017 14:53:31	[sg_redirector_base_url] Select redirector base url (http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u)
      15.05.2017 14:53:31	[sg_redirector_base_url] Select redirector base url (http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u)
      15.05.2017 14:53:31	[sg_create_config] Add rewrites: banner; safesearch;
      15.05.2017 14:53:31	[sg_create_config] Add destinations: MDS_white_all; MDS_blk_media; MDS_blk_all;
      15.05.2017 14:53:31	[sg_redirector_base_url] Select redirector base url (http://172.16.254.1:80/sgerror.php?url=blank&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u)
      15.05.2017 14:53:31	[sg_create_config] Added: blk_BL_adv; ... blk_webtv; .
      15.05.2017 14:53:31	[sg_redirector_base_url] Select redirector base url (http://172.16.254.1:80/sgerror.php?url=blank_img&msg=&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u)
      15.05.2017 14:53:31	[sg_create_config] Add blacklist entries
      15.05.2017 14:53:31	[sg_create_config] Add sources: ALL_172
      15.05.2017 14:53:31	[sg_create_config] Add times: all_time
      15.05.2017 14:53:31	[squidguard_rebuild_db] Start rebuild DB.
      

      What's wrong?

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.