Software which doesn't work with pfSense+Squid
-
Hello,
I have a problem with a software, it requires a connexion to internet and it doesn't work since we have set pfSense. It's not possible to specify the proxy's settings in this software (I'm in touch with the support).
My FW rules block all traffic that doesn't go through pfSense, so I think the software doesn't automaticaly detect my proxy settings. Even if the proxy's settings in internet explorer is set to manual, the software doesn't work.
Any ideas?
Thanks!
-
So I take your running proxy in pfsense? Transparent or explicit, since you say you point browser to proxy I take it explicit.
Bypass the proxy for the machine that is running the application, does it work then?
Details are key here if you want help, exactly how do you have the proxy setup on pfsense? What application are you trying to run that isn't working?
-
@johnpoz said in Software which doesn't work with pfSense+Squid:
So I take your running proxy in pfsense? Transparent or explicit, since you say you point browser to proxy I take it explicit.
Bypass the proxy for the machine that is running the application, does it work then?
Details are key here if you want help, exactly how do you have the proxy setup on pfsense? What application are you trying to run that isn't working?
Hello,
Thank you for your answer. Yes proxy in pfsense, explicit (or WPAD).
The problem seems to come from my FW rules:
As I said, my traffic is forced to go through pfSense. If I deactivate the 2 rules that block traffic, the software works.
-
Well if your application is not proxy aware - then yeah that would be a problem..
Where is the application trying to go - and open that up for direct access. This happens all the time in the corp world behind proxy when some nonsense app users "need" doesn't understand how to use a proxy.
What is the specific application - maybe their is a way to make it use a proxy? Or maybe easy to determine which dest you have to open, etc.
Not sure what you think that last rule with dest 127.0.0.1 is going to do when you have a any any allow rule above it..
-
The easiest way around this is to create an alias called ProxyExempt for example, and then add all clients that you want to that alias. Then add a firewall rule just above your tcp80,443 block that allows ProxyExempt out on those same ports. That's how I do it:
