Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid/SquidGuard NONE/409 and DNS issue

    Scheduled Pinned Locked Moved Cache/Proxy
    69 Posts 9 Posters 19.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM @shawn8888
      last edited by

      @shawn8888 Transparent mode isn't buggy per se, it's just that you have to consider other things when using it. You're trying to intercept a data stream that is trying to prevent you from doing so. You either need to install a trusted cert on every device that will use your transparent proxy to void MitM browser errors when using Splice/Bump, or no certs and you use Splice All. If transparent mode works for you then use that but I find explicit mode has less hassles.

      Are you sure that your proxy works? What happens if you manually set a browser to use it?

      1 Reply Last reply Reply Quote 0
      • S
        shawn8888 @aGeekhere
        last edited by

        @ageekhere
        I reboot pfSense and client pc. wpad is still not working.

        @KOM
        "Splice All" is recommended in order to use squidguard, which is the main reason I use squid for.

        My proxy ONLY works at Transparent mode.
        I have tried turning off Transparent mode and setting proxy manually (set IP and port 3128) on my PC. But it seems that a lot of things are not working. For example, I can open speedteset.net, but when I hit "go" button, it never starts.

        KOMK 1 Reply Last reply Reply Quote 0
        • KOMK
          KOM @shawn8888
          last edited by

          @shawn8888 When running in explicit mode, how does it not work exactly? What browser error are you getting? Squid normally just works right out of the box.

          S 1 Reply Last reply Reply Quote 0
          • S
            shawn8888 @KOM
            last edited by

            @kom
            What do you mean by "explicit mode"?
            Does that mean:
            Disable both "Transparent mode" and "Enable SSL filtering.", and manually set clients to use ip:3128 as proxy?

            KOMK 1 Reply Last reply Reply Quote 0
            • KOMK
              KOM @shawn8888
              last edited by

              @shawn8888 Yes. Explicit means not transparent, no SSL interception. Clients can be manually set or use WPAD once you determine squid is working properly.

              1 Reply Last reply Reply Quote 0
              • S
                shawn8888
                last edited by shawn8888

                @kom

                My proxy now works on explicit mode.
                I turned off "Transparent HTTP Proxy" and "HTTPS/SSL Interception".
                I also turned off the lan rules, which you suggest for wpad bypass some devices earlier.

                d5221e8e-3edb-4e70-bdd6-5b0236204dff-image.png

                This allows all LAN devices to go Internet directly by default, right? All my LAN devices can access Internet at this moment.

                1. I tested on my iPad to set wifi manually use proxy at IP:3128. It worked. the only thing not working so far is speedtest.net go button. It stays at connecting forever.

                bbb6981c-2bfc-4486-8e5c-5cac37f3d0aa-image.png

                f331f5d5-448a-4f47-b9ec-dfc51b9fa5af-image.png

                1. I tested my PC.
                  firefox, set proxy in option:

                f6ae6639-f7ee-4bd1-a098-28f792691b87-image.png

                I find that only http websites get blocked by squidguard. And https blocked websites can passthrough. Is it because https websites are bypassed due to "HTTPS/SSL Interception" being off?

                I also tried Chrome and set the proxy like this:
                c550de9b-baec-46f6-98bc-dfcadbfe072a-image.png

                It's funny that Chrome can not only see squidguard blocks http websites, but also https ones!
                speedtest.net go button still not working.
                Another thing doesn't work is the local websites. It gives me Access Denied error:

                fd39ca15-264d-461c-9da1-fc9aa9acf660-image.png

                So I guess the explicit mode works, but I still need wpad or transparent working so I don't have to deal with the clients...

                KOMK 1 Reply Last reply Reply Quote 0
                • KOMK
                  KOM @shawn8888
                  last edited by KOM

                  @shawn8888 Lots to unpack here.

                  This allows all LAN devices to go Internet directly by default, right?

                  You didn't show your complete LAN rule set so I don't know but I can assume the last rule is the default Allow All rule. Btw you can do the block with just one rule by making a port alias called WebPorts that contains 80,443.

                  I tested on my iPad to set wifi manually use proxy at IP:3128. It worked. the only thing not working so far is speedtest.net go button.

                  No idea about that but it seems to be a common thing with speedtests and proxies.

                  I tested my PC. firefox, set proxy in option

                  I notice you didn't set the https proxy or check the checkbox to use the same proxy for ftp and https. You need to do one or the other.

                  I find that only http websites get blocked by squidguard.

                  Get squid working first before you worry about that. Disable squidguard until you have squid working.

                  Is it because https websites are bypassed due to "HTTPS/SSL Interception" being off?

                  That might be because you didn't set the https proxy.

                  Another thing doesn't work is the local websites.

                  Either use the site's LAN IP address, or use split DNS to resolve your domain to its LAN IP instead of its public IP.

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    shawn8888 @KOM
                    last edited by

                    @kom

                    You are right! After I "check the checkbox to use the same proxy for ftp and https" Firefox works the same as Chrome for https websites.

                    If squid doesn't work for certain websites like speedtest.net, how to set them as exceptions?

                    The local website is an oddball:
                    The ping shows the dns is solved as a local IP, 192.168.100.155
                    But no matter dns or ip, it all shows as Access Denied by squid. And it only not working for this tt-rss site, other local websites with the same domain but different ports are OK:
                    Working ones:
                    http://syn1.mydomain.com:5000/
                    http://syn1.mydomain.com:8080/
                    http://syn1.mydomain.com:5076/

                    NOT Working:
                    http://syn1.mydomain.com:181/tt-rss/
                    http://192.168.100.155:181/tt-rss/

                    Logs:
                    e289159d-cc88-48bc-a337-9b5e3b991f5c-image.png

                    KOMK 1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM @shawn8888
                      last edited by

                      @shawn8888 Squid only works with ports that are part of its safe_ports list. You can't just go to any port. In pfSense, you can find this under Services - Squid proxy - ACLs - Squid Allowed Ports.

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        shawn8888 @KOM
                        last edited by

                        @kom
                        I added port 181 below and tt-rss finally works! Thanks again!
                        Squid Allowed Ports -> ACL SafePorts

                        KOMK 1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM @shawn8888
                          last edited by

                          @shawn8888 Now you can start trying to get wpad working, then squidguard.

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            shawn8888 @KOM
                            last edited by

                            @kom
                            I will give it a couple of days to see if most of the problems can be solved in explicit mode before testing wpad again.
                            Thanks!

                            KOMK 1 Reply Last reply Reply Quote 0
                            • KOMK
                              KOM @shawn8888
                              last edited by

                              @shawn8888 WPAD solves the problem of having to manually configure proxy setting on every device so it's kind of important to get it working. You can also push a proxy via DHCP option 252. I would do both, and don't forget to add your block rule on LAN to prevent people from going around the proxy.

                              1 Reply Last reply Reply Quote 0
                              • S
                                shawn8888
                                last edited by

                                After a week testing, I can confirm that NONE/409 issue is gone with the explicit mode. It seems that the issue only happens with the transparent mode.

                                WPAD is still a hit and miss. I will test it more later. Right now I set all the devices need to go through squid manually.

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  aGeekhere @shawn8888
                                  last edited by

                                  @shawn8888 @shawn8888 You can always try the Wpad Unofficial package https://github.com/marcelloc/Unofficial-pfSense-packages/tree/master/pkg-wpad

                                  Never Fear, A Geek is Here!

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    shawn8888 @aGeekhere
                                    last edited by

                                    @ageekhere

                                    It doesn't install. :(

                                    4ac949b1-f7ec-4ff8-b358-d16ee69a3d21-image.png

                                    KOMK 1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM @shawn8888
                                      last edited by

                                      @shawn8888 I don't see any error. Did you look for the menu?

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        shawn8888 @KOM
                                        last edited by

                                        @kom
                                        The install command, the last one, finishes in less than a second
                                        I cannot find wpad in "Installed Packages" or any change on the menu.

                                        A 1 Reply Last reply Reply Quote 0
                                        • A
                                          aGeekhere @shawn8888
                                          last edited by

                                          @shawn8888 first follow this step https://github.com/marcelloc/Unofficial-pfSense-packages

                                          You have to first enable Unofficial pfSense packages

                                          Never Fear, A Geek is Here!

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            shawn8888 @aGeekhere
                                            last edited by

                                            @ageekhere

                                            I ran the command in ssh. No change. Then I reboot pfsense. still the same. I don't know what I did wrong.

                                            fetch -q -o /usr/local/etc/pkg/repos/Unofficial.conf https://raw.githubusercontent.com/marcelloc/Unofficial-pfSense-packages/master/Unofficial_25.conf
                                            A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.