Squid Reverse-proxy - "Address already in use"



  • Hi all,

    I have a problem with Pfsense (2.4.4) and Squid reverse-proxy. If I want start with WebGui, nothing is happening and no new line in cache.log file.
    When I start Squid in command ligne, it start and works but there is a error message :

    2018/10/18 19:36:18 kid1| Starting Squid Cache version 3.5.27 for amd64-portbld-freebsd11.2...
    2018/10/18 19:36:18 kid1| Service Name: squid
    2018/10/18 19:36:18 kid1| commBind: Cannot bind socket FD 19 to xxx.xxx.xxx.20:80: (48) Address already in use
    2018/10/18 19:36:18 kid1| commBind: Cannot bind socket FD 21 to xxx.xxx.xxx.20:443: (48) Address already in use
    2018/10/18 19:36:18| pinger: Initialising ICMP pinger ...
    

    I check my open ports, I nothing on 80 or 444

    USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
    root     php-fpm    99507 4  udp4   *:*                   *:*
    root     syslogd    95601 8  udp4   *:514                 *:*
    dhcpd    dhcpd      57141 7  udp4   *:67                  *:*
    root     ntpd       52333 21 udp4   *:123                 *:*
    root     ntpd       52333 23 udp4   xxx.xxx.xxx.20:123      *:*
    root     ntpd       52333 24 udp4   xxx.xxx.xxx.23:123      *:*
    root     ntpd       52333 26 udp4   192.168.2.1:123       *:*
    root     ntpd       52333 29 udp4   127.0.0.1:123         *:*
    root     nginx      51549 6  tcp4   *:7001                *:*
    root     nginx      51487 6  tcp4   *:7001                *:*
    root     nginx      51166 6  tcp4   *:7001                *:*
    unbound  unbound    47194 5  udp4   *:53                  *:*
    unbound  unbound    47194 6  tcp4   *:53                  *:*
    unbound  unbound    47194 7  tcp4   127.0.0.1:953         *:*
    root     sshd       14331 5  tcp4   *:500                 *:*
    root     php-fpm    337   4  udp4   *:*                   *:*
    root     php-fpm    336   4  udp4   *:*                   *:*
    root     php-fpm    334   4  udp4   *:*                   *:*
    

    My config file :

    # This file is automatically generated by pfSense
    # Do not edit manually !
    
    http_port 192.168.2.1:3128
    icp_port 0
    digest_generation off
    dns_v4_first off
    pid_filename /var/run/squid/squid.pid
    cache_effective_user squid
    cache_effective_group proxy
    error_default_language en
    icon_directory /usr/local/etc/squid/icons
    visible_hostname localhost
    cache_mgr admin@localhost
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    netdb_filename /var/squid/logs/netdb.state
    pinger_enable on
    pinger_program /usr/local/libexec/squid/pinger
    
    logfile_rotate 365
    debug_options rotate=365
    shutdown_lifetime 3 seconds
    # Allow local network(s) on interface(s)
    acl localnet src  192.168.2.0/24
    forwarded_for on
    httpd_suppress_version_string on
    uri_whitespace strip
    
    acl dynamic urlpath_regex cgi-bin \?
    cache deny dynamic
    
    cache_mem 64 MB
    maximum_object_size_in_memory 256 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    minimum_object_size 0 KB
    maximum_object_size 4 MB
    cache_dir ufs /var/squid/cache 500 16 256
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    cache allow all
    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
    refresh_pattern .    0  20%  4320
    
    
    #Remote proxies
    
    
    # Setup some default acls
    # ACLs all, manager, localhost, and to_localhost are predefined.
    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 7001 3128 3129 1025-65535
    acl sslports port 443 563 7001
    
    acl purge method PURGE
    acl connect method CONNECT
    
    # Define protocols used for redirects
    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    http_access allow manager localhost
    
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    
    # Always allow localhost connections
    http_access allow localhost
    
    request_body_max_size 0 KB
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow allsrc
    
    # Reverse Proxy settings
    http_port xxx.xxx.xxx.20:80 accel defaultsite=MySite.fr vhost
    https_port xxx.xxx.xxx.20:443 accel cert=/usr/local/etc/squid/xxx.crt key=/usr/local/etc/squid/xxx.key   tls-dh=prime256v1:/dh-parameters.2048 cipher=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!SHA1:!MD5:!PSK \
     options=NO_SSLv2,NO_SSLv3,CIPHER_SERVER_PREFERENCE,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE defaultsite=MySite.fr vhost
    
    http_port xxx.xxx.xxx.20:80 accel defaultsite=MySite.fr vhost
    https_port xxx.xxx.xxx.20:443 accel cert=/usr/local/etc/squid/xxx.crt key=/usr/local/etc/squid/xxx.key  tls-dh=prime256v1:/dh-parameters.2048 cipher=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!SHA1:!MD5:!PSK \
     options=NO_SSLv2,NO_SSLv3,CIPHER_SERVER_PREFERENCE,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE defaultsite=MySite.fr vhost
    
    #
    cache_peer 192.168.2.2 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on round-robin name=rvp_SitePlaquette
    
    #
    cache_peer 192.168.2.3 parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on round-robin name=rvp_Demoportail
    
    
    # Redirect:
    acl rdr_dst_SiteUtilisateurREDIR dstdomain portail.MySite.fr
    acl rdr_path_SiteUtilisateurREDIR urlpath_regex ^/.*$
    deny_info https://portail.MySite.fr rdr_path_SiteUtilisateurREDIR
    http_access deny HTTP rdr_dst_SiteUtilisateurREDIR rdr_path_SiteUtilisateurREDIR
    
    # Redirect:
    acl rdr_dst_DemoPortailREDIR dstdomain demoportail.MySite.fr
    acl rdr_path_DemoPortailREDIR urlpath_regex ^/.*$
    deny_info https://demoportail.MySite.fr rdr_path_DemoPortailREDIR
    http_access deny HTTP rdr_dst_DemoPortailREDIR rdr_path_DemoPortailREDIR
    
    acl rvm_Demoportail url_regex -i ^https://demoportail.MySite.fr/.*$
    acl rvm_SiteUtilisateur url_regex -i ^https://portail.MySite.fr/*
    cache_peer_access rvp_Demoportail allow rvm_Demoportail
    cache_peer_access rvp_SiteUtilisateur allow rvm_SiteUtilisateur
    cache_peer_access rvp_Demoportail deny allsrc
    cache_peer_access rvp_SiteUtilisateur deny allsrc
    never_direct allow rvm_Demoportail
    never_direct allow rvm_SiteUtilisateur
    http_access allow rvm_Demoportail
    http_access allow rvm_SiteUtilisateur
    
    deny_info TCP_RESET allsrc
    
    # Custom options before auth
    
    
    # Setup allowed ACLs
    # Allow local network(s) on interface(s)
    http_access allow localnet
    # Default block all to be sure
    http_access deny allsrc
    

    last information, I changed the default port of Web Gui to 7001 and I configured for local access only.
    I really do not understand where the problem can come from ...

    Do you have any idea about the reason for this problem ?