Squid Reverse-proxy - "Address already in use"

tracks62

Hi all,

I have a problem with Pfsense (2.4.4) and Squid reverse-proxy. If I want start with WebGui, nothing is happening and no new line in cache.log file.
When I start Squid in command ligne, it start and works but there is a error message :

2018/10/18 19:36:18 kid1| Starting Squid Cache version 3.5.27 for amd64-portbld-freebsd11.2...
2018/10/18 19:36:18 kid1| Service Name: squid
2018/10/18 19:36:18 kid1| commBind: Cannot bind socket FD 19 to xxx.xxx.xxx.20:80: (48) Address already in use
2018/10/18 19:36:18 kid1| commBind: Cannot bind socket FD 21 to xxx.xxx.xxx.20:443: (48) Address already in use
2018/10/18 19:36:18| pinger: Initialising ICMP pinger ...

I check my open ports, I nothing on 80 or 444

USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     php-fpm    99507 4  udp4   *:*                   *:*
root     syslogd    95601 8  udp4   *:514                 *:*
dhcpd    dhcpd      57141 7  udp4   *:67                  *:*
root     ntpd       52333 21 udp4   *:123                 *:*
root     ntpd       52333 23 udp4   xxx.xxx.xxx.20:123      *:*
root     ntpd       52333 24 udp4   xxx.xxx.xxx.23:123      *:*
root     ntpd       52333 26 udp4   192.168.2.1:123       *:*
root     ntpd       52333 29 udp4   127.0.0.1:123         *:*
root     nginx      51549 6  tcp4   *:7001                *:*
root     nginx      51487 6  tcp4   *:7001                *:*
root     nginx      51166 6  tcp4   *:7001                *:*
unbound  unbound    47194 5  udp4   *:53                  *:*
unbound  unbound    47194 6  tcp4   *:53                  *:*
unbound  unbound    47194 7  tcp4   127.0.0.1:953         *:*
root     sshd       14331 5  tcp4   *:500                 *:*
root     php-fpm    337   4  udp4   *:*                   *:*
root     php-fpm    336   4  udp4   *:*                   *:*
root     php-fpm    334   4  udp4   *:*                   *:*

My config file :

# This file is automatically generated by pfSense
# Do not edit manually !

http_port 192.168.2.1:3128
icp_port 0
digest_generation off
dns_v4_first off
pid_filename /var/run/squid/squid.pid
cache_effective_user squid
cache_effective_group proxy
error_default_language en
icon_directory /usr/local/etc/squid/icons
visible_hostname localhost
cache_mgr admin@localhost
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable on
pinger_program /usr/local/libexec/squid/pinger

logfile_rotate 365
debug_options rotate=365
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  192.168.2.0/24
forwarded_for on
httpd_suppress_version_string on
uri_whitespace strip

acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic

cache_mem 64 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir ufs /var/squid/cache 500 16 256
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
refresh_pattern .    0  20%  4320


#Remote proxies


# Setup some default acls
# ACLs all, manager, localhost, and to_localhost are predefined.
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 7001 3128 3129 1025-65535
acl sslports port 443 563 7001

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings
http_port xxx.xxx.xxx.20:80 accel defaultsite=MySite.fr vhost
https_port xxx.xxx.xxx.20:443 accel cert=/usr/local/etc/squid/xxx.crt key=/usr/local/etc/squid/xxx.key   tls-dh=prime256v1:/dh-parameters.2048 cipher=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!SHA1:!MD5:!PSK \
 options=NO_SSLv2,NO_SSLv3,CIPHER_SERVER_PREFERENCE,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE defaultsite=MySite.fr vhost

http_port xxx.xxx.xxx.20:80 accel defaultsite=MySite.fr vhost
https_port xxx.xxx.xxx.20:443 accel cert=/usr/local/etc/squid/xxx.crt key=/usr/local/etc/squid/xxx.key  tls-dh=prime256v1:/dh-parameters.2048 cipher=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!SHA1:!MD5:!PSK \
 options=NO_SSLv2,NO_SSLv3,CIPHER_SERVER_PREFERENCE,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE defaultsite=MySite.fr vhost

#
cache_peer 192.168.2.2 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on round-robin name=rvp_SitePlaquette

#
cache_peer 192.168.2.3 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on round-robin name=rvp_Demoportail


# Redirect:
acl rdr_dst_SiteUtilisateurREDIR dstdomain portail.MySite.fr
acl rdr_path_SiteUtilisateurREDIR urlpath_regex ^/.*$
deny_info https://portail.MySite.fr rdr_path_SiteUtilisateurREDIR
http_access deny HTTP rdr_dst_SiteUtilisateurREDIR rdr_path_SiteUtilisateurREDIR

# Redirect:
acl rdr_dst_DemoPortailREDIR dstdomain demoportail.MySite.fr
acl rdr_path_DemoPortailREDIR urlpath_regex ^/.*$
deny_info https://demoportail.MySite.fr rdr_path_DemoPortailREDIR
http_access deny HTTP rdr_dst_DemoPortailREDIR rdr_path_DemoPortailREDIR

acl rvm_Demoportail url_regex -i ^https://demoportail.MySite.fr/.*$
acl rvm_SiteUtilisateur url_regex -i ^https://portail.MySite.fr/*
cache_peer_access rvp_Demoportail allow rvm_Demoportail
cache_peer_access rvp_SiteUtilisateur allow rvm_SiteUtilisateur
cache_peer_access rvp_Demoportail deny allsrc
cache_peer_access rvp_SiteUtilisateur deny allsrc
never_direct allow rvm_Demoportail
never_direct allow rvm_SiteUtilisateur
http_access allow rvm_Demoportail
http_access allow rvm_SiteUtilisateur

deny_info TCP_RESET allsrc

# Custom options before auth


# Setup allowed ACLs
# Allow local network(s) on interface(s)
http_access allow localnet
# Default block all to be sure
http_access deny allsrc

last information, I changed the default port of Web Gui to 7001 and I configured for local access only.
I really do not understand where the problem can come from ...

Do you have any idea about the reason for this problem ?