Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED]Help needed: bypass squid and squidGuard for iTunes, AppleStore, Android

    Scheduled Pinned Locked Moved
    Cache/Proxy
    7
    17
    8.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sichent Banned
      last edited by

      Not exactly correct; the version of Squid in pfSense is good enough to use the SNI info from the HTTPS connection being established.
      The acl you need to use is ssl::server_name

      For example this what we use when filtering all connections except spliced in Web Safety (does not apply to SquidGuard!!):

      acl ssl_exclude_domains ssl::server_name "/opt/websafety/etc/squid/ssl/exclude/domains.conf"

      ssl_bump peek step1 all
      ssl_bump splice ssl_exclude_domains
      ssl_bump stare step2 all
      ssl_bump bump all

      I am not sure where to put that in pfSense UI - but should not be very complex to find.

      1 Reply Last reply Reply Quote 0
      • G
        GL
        last edited by

        thanks for your input, I will try this we and will let everybody know the outcome.
        Cross our fingers…
        I think this will be a very important input for most of the "home" users.
        ciao,
        GL

        1 Reply Last reply Reply Quote 0
        • G
          GL
          last edited by

          I implemented the solution and for now it seems working, I am testing it.
          here a step by step guide of what i implemented.

          1. Go to Services->Squid Proxy Server

          2. Enable and configure HTTPS transparent proxy

          3. Go to the bottom of the page, click Show Advanced Options

          4. Cut and past the following text in the box "Custom Options (Before Auth)":

          acl ssl_exclude_domains ssl::server_name "/usr/local/etc/squid/exclude_domains.conf"

          ssl_bump peek step1 all
          ssl_bump splice ssl_exclude_domains
          ssl_bump stare step2 all
          ssl_bump bump all

          1. wait to save

          2. connect with secure shell to pfsense and login

          3. choose option 8 "Shell"

          4. cd /usr/local/etc/squid

          5. ee exclude_domains.conf

          6. input the following text :

          .apple.com
          .mzstatic.com
          .icloud.com
          .dropbox.com
          .microsoft.com
          .oneDrive.com
          .live.com
          .messenger.live.com
          .skype.com
          .trouter.com
          .login.live.com
          .whatsapp.com
          .whatsapp.net

          1. press "esc" then press "a", again press "a"

          2. go back to pfsense webgui and save your squid configuration

          3. restart squid service

          The configuration in exclude_domains.conf should let you use your Apple devices with iTunes and Apple store, let you use WhatsApp, sync with iCloud (pls check also allowed ports in your firewall rules), sync with OneDrive, let your skype work with https transparent proxy, allow you to update with Microsoft in Win10.

          I am still testing, if someone will implement it, pls let us know the outcomes.

          V 1 Reply Last reply Reply Quote 2
          • G
            GL
            last edited by

            Adding support also for Android devices.

            Add following entries to exclude_domains.conf file:

            .ggpht.com
            .play.googleapis.com
            android.clients.google.com
            www.googleapis.com
            .gvt1.com

            It seems working for me, up to now.

            1 Reply Last reply Reply Quote 0
            • G
              GL
              last edited by

              Adding following entries to exclude_domains.conf you should bypass Netflix. I am still testing this.

              .netflix.com
              .llnwd.net
              .edgesuite.net
              .nflximg.com
              .nflxvideo.net

              1 Reply Last reply Reply Quote 0
              • G
                GL
                last edited by

                Up to today no main issues found.
                Everything seems working well.
                Thanks to sichent for his help and suggestion!

                1 Reply Last reply Reply Quote 0
                • T
                  tapout72
                  last edited by

                  @gl said in [SOLVED]Help needed: bypass squid and squidGuard for iTunes, AppleStore, Android:

                  acl ssl_exclude_domains ssl::server_name "/usr/local/etc/squid/exclude_domains.conf"
                  ssl_bump peek step1 all
                  ssl_bump splice ssl_exclude_domains
                  ssl_bump stare step2 all
                  ssl_bump bump all

                  GL, I know this is an old thread but I tried your solution to try and bypass netflix. However, I get a Privacy error NET::ERR_CERT_AUTHORITY_INVALID on every site I try to access after applying the Custom Options (Before Auth).

                  Any ideas on where I went wrong?

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    rob_kae @tapout72
                    last edited by

                    @tapout72 did you manage to sort this? I have the same problem.

                    1 Reply Last reply Reply Quote 0
                    • V
                      vlurk @GL
                      last edited by

                      I implemented this solution in pfSense 2.7.0 and you can make this solution resilient to package updates by leveraging the whitelist in the ACL tab. In the default config of the package, you can already splice exceptions and bump everything by default. The alias of the acl it creates for sslbump is simply sslwhitelist. And you can reference it in custom options, so this solution would look like this:

                      ssl_bump peek step1 all
                      ssl_bump splice sslwhitelist
                      ssl_bump stare step2 all
                      ssl_bump bump all

                      Note that the ACL accepts regex! Which is what I use exclusively. Here is an example of a regex to match microsoft.com domain and subdomains:

                      (^|.)microsoft.com$

                      I now get all the domains I have defined logged as TCP_TUNNEL, so I can tell this is working well too.

                      A 1 Reply Last reply Reply Quote 1
                      • A
                        azmodeuz @vlurk
                        last edited by

                        @vlurk Thank you for this guide. I have the same issue but with Viber. How can I use your settings for viber desktop App

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post