Pfsense 2.4.4 + Squid 3.5 Прозрачный прокси. windows update & store не работает



  • В общем сам прозрачный прокси настроил, всё супер все работает squidGuard пока не активировал(То есть там всё разрешено) Подскажите пожалуйста что куда надо допилить что бы наконец заработали update & store функции windows.

    squid config

    # This file is automatically generated by pfSense
    # Do not edit manually !
    
    http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    
    http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    
    https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    
    icp_port 0
    digest_generation off
    dns_v4_first off
    pid_filename /var/run/squid/squid.pid
    cache_effective_user squid
    cache_effective_group proxy
    error_default_language ru
    icon_directory /usr/local/etc/squid/icons
    visible_hostname MyNet-Firewall
    cache_mgr admin@admin.ru
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    netdb_filename /var/squid/logs/netdb.state
    pinger_enable on
    pinger_program /usr/local/libexec/squid/pinger
    sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
    sslcrtd_children 5
    sslproxy_capath /usr/local/share/certs/
    sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
    sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
    sslproxy_flags DONT_VERIFY_PEER
    sslproxy_cert_adapt setValidBefore all
    
    logfile_rotate 32
    debug_options rotate=32
    shutdown_lifetime 3 seconds
    # Allow local network(s) on interface(s)
    acl localnet src  192.168.1.0/24
    forwarded_for on
    httpd_suppress_version_string on
    uri_whitespace strip
    
    
    cache_mem 1024 MB
    maximum_object_size_in_memory 1048576 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    minimum_object_size 0 KB
    maximum_object_size 4194304 MB
    cache_dir ufs /var/squid/cache 4096 16 256
    offline_mode off
    cache_swap_low 80
    cache_swap_high 85
    acl donotcache dstdomain "/var/squid/acl/donotcache.acl"
    cache deny donotcache
    cache allow all
    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
    refresh_pattern .    0  20%  4320
    
    
    #Remote proxies
    
    
    # Setup some default acls
    # ACLs all, manager, localhost, and to_localhost are predefined.
    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535 
    acl sslports port 443 563 8080 
    
    acl purge method PURGE
    acl connect method CONNECT
    
    # Define protocols used for redirects
    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    
    # SslBump Peek and Splice
    # http://wiki.squid-cache.org/Features/SslPeekAndSplice
    # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
    # Match against the current step during ssl_bump evaluation [fast]
    # Never matches and should not be used outside the ssl_bump context.
    #
    # At each SslBump step, Squid evaluates ssl_bump directives to find
    # the next bumping action (e.g., peek or splice). Valid SslBump step
    # values and the corresponding ssl_bump evaluation moments are:
    #   SslBump1: After getting TCP-level and HTTP CONNECT info.
    #   SslBump2: After getting TLS Client Hello info.
    #   SslBump3: After getting TLS Server Hello info.
    # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
    # they can be used there for custom configuration.
    acl step1 at_step SslBump1
    acl step2 at_step SslBump2
    acl step3 at_step SslBump3
    
    
    
    http_access allow manager localhost
    
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    
    # Always allow localhost connections
    http_access allow localhost
    
    quick_abort_min 0 KB
    quick_abort_max 0 KB
    request_body_max_size 5000 KB
    reply_body_max_size 5000 KB allsrc 
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    # Throttle extensions matched in the url
    acl throttle_exts urlpath_regex -i "/var/squid/acl/throttle_exts.acl"
    delay_access 1 allow throttle_exts
    delay_access 1 deny allsrc
    
    # Reverse Proxy settings
    
    
    # Package Integration
    url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
    url_rewrite_bypass off
    url_rewrite_children 16 startup=8 idle=4 concurrency=0
    
    # Custom options before auth
    
    acl DiscoverSNIHost at_step SslBump1
    acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/etc/squid/url.nobump"
    ssl_bump splice NoSSLIntercept
    ssl_bump peek DiscoverSNIHost
    ssl_bump bump all
    
    acl sglog url_regex -i sgr=ACCESSDENIED
    http_access deny sglog
    ssl_bump peek step1
    ssl_bump bump all
    # Setup allowed ACLs
    # Allow local network(s) on interface(s)
    http_access allow localnet
    # Default block all to be sure
    http_access deny allsrc
    
    icap_enable on
    icap_send_client_ip on
    icap_send_client_username on
    icap_client_username_encode off
    icap_client_username_header X-Authenticated-User
    icap_preview_enable on
    icap_preview_size 1024
    
    icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
    adaptation_access service_avi_req allow all
    icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
    adaptation_access service_avi_resp allow all
    
    

    alt text


  • Global Moderator



  • @asamat не помогло...


  • Global Moderator

    What is "WPAD" Alias?
    Your LAN rules look to strict - did you try to create Allow rule for all IPs/domains from topic I sent you?



  • @asamat I added all the proxy server: access control - ACLs - White
    WPAD port = 80



  • Доброго

    Книга мудрости (в закладки Йесть всЬО !) - https://www.netgate.com/docs/pfsense/cache-proxy/wpad-autoconfigure-for-squid.html
    https://forum.netgate.com/topic/100342/guide-to-filtering-web-content-http-and-https-with-pfsense-2-3
    https://forum.it-monkey.net/index.php?topic=23.0
    https://nguvu.org/pfsense/pfsense-baseline-setup/
    https://www.youtube.com/playlist?list=PLQ7gVTPc8Kmij4-2RpiQMAQjkj3XkolGI

    https://forum.it-monkey.net/index.php?topic=19.0

    Зы. В правилах fw (на скринах) в dst указывайте LAN addr для WPAD и сквида. Иначе вы всё во вне разрешаете по этим портам.
    Зы. Последние 2 правила на ЛАН - лишние. У пф дефаулт полиси и так block all.



  • @werter Спасибо большое ! Буду разбираться !