Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid https filtering squidguard acl target list - erratic behaviour

    Scheduled Pinned Locked Moved Cache/Proxy
    1 Posts 1 Posters 352 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      frscm
      last edited by

      Hi there,

      having worked with pfsense for more than 10 years now in a multi sites configuration, we are now facing something that never occured before, which could be described as an erratic behaviour in squid https filtering : some websites specified in squidgard target categories pass through the web filtering, and some don't. It might have started since we upgraded our pfsenses to 2.5.2, but we are not really sure.

      We made some investigations using a very simplified pfsense configuration as follows :

      • fresh install of pfsense 2.5.2 whith only squid and squidguard installed
      • squid with default configuration, transparent mode and SSL man in the middle filtering activated (with an internal CA created through the certificate manager with default parameters)
      • squidguard : created a target categorie with two URLs, parisaeroport.fr and visitstrasbourg.fr, and denying this in Common ACL target rules list.

      Here is the surprise : parisaeroport.fr is blocked as intended, but visitstrasbourg.fr is not blocked at all, without any clear records in squid logs that could highlight that difference.

      We double checked, it is not a cache problem, but we might have missed something in squid configuration ? Any help would be much appreciated!
      Thanks a lot in advance.

      Here is the squidguard configuration file :

      # ============================================================
      # SquidGuard configuration file
      # This file generated automaticly with SquidGuard configurator
      # (C)2006 Serg Dvoriancev
      # email: dv_serg@mail.ru
      # ============================================================
      
      logdir /var/squidGuard/log
      dbhome /var/db/squidGuard
      
      # 
      dest target_test {
      	domainlist target_test/domains
      	log block.log
      }
      
      # 
      rew safesearch {
      	s@(google..*/search?.*q=.*)@&safe=active@i
      	s@(google..*/images.*q=.*)@&safe=active@i
      	s@(google..*/groups.*q=.*)@&safe=active@i
      	s@(google..*/news.*q=.*)@&safe=active@i
      	s@(yandex..*/yandsearch?.*text=.*)@&fyandex=1@i
      	s@(search.yahoo..*/search.*p=.*)@&vm=r&v=1@i
      	s@(search.live..*/.*q=.*)@&adlt=strict@i
      	s@(search.msn..*/.*q=.*)@&adlt=strict@i
      	s@(.bing..*/.*q=.*)@&adlt=strict@i
      	s@(duckduckgo..*/?.*q=.*)@&kp=1@i
      	s@(rambler..*/?.*query=.*)@&adult=family@i
      	s@(qwant..*/?.*q=.*)@&s=2@i
      	s@(ecosia..*/search.*q=.*)@&safesearch=2@i
      	s@(onesearch..*/yhs/search.*)@&vm=r@i
      	log block.log
      }
      
      # 
      acl  {
      	# 
      	default  {
      		pass !target_test all
      		redirect http://192.168.10.9:80/sgerror.php?url=403%20&a=%a&n=%n&i=%i&s=%s&t=%t&u=%u
      		log block.log
      	}
      }
      

      and the squid configuration :

      # This file is automatically generated by pfSense
      # Do not edit manually !
      
      http_port 192.168.10.9:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
      
      http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
      
      https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
      
      icp_port 0
      digest_generation off
      dns_v4_first off
      pid_filename /var/run/squid/squid.pid
      cache_effective_user squid
      cache_effective_group proxy
      error_default_language fr
      icon_directory /usr/local/etc/squid/icons
      visible_hostname localhost
      cache_mgr admin@localhost
      access_log /var/squid/logs/access.log
      cache_log /var/squid/logs/cache.log
      cache_store_log none
      netdb_filename /var/squid/logs/netdb.state
      pinger_enable on
      pinger_program /usr/local/libexec/squid/pinger
      sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
      tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
      tls_outgoing_options capath=/usr/local/share/certs/
      tls_outgoing_options options=NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
      tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS
      sslcrtd_children 5
      
      logfile_rotate 0
      debug_options rotate=0
      shutdown_lifetime 3 seconds
      # Allow local network(s) on interface(s)
      acl localnet src  192.168.10.0/24
      forwarded_for on
      uri_whitespace strip
      
      acl dynamic urlpath_regex cgi-bin ?
      cache deny dynamic
      
      cache_mem 64 MB
      maximum_object_size_in_memory 256 KB
      memory_replacement_policy heap GDSF
      cache_replacement_policy heap LFUDA
      minimum_object_size 0 KB
      maximum_object_size 4 MB
      cache_dir ufs /var/squid/cache 100 16 256
      offline_mode off
      cache_swap_low 90
      cache_swap_high 95
      cache deny all
      # Add any of your own refresh_pattern entries above these.
      refresh_pattern ^ftp:    1440  20%  10080
      refresh_pattern ^gopher:  1440  0%  1440
      refresh_pattern -i (/cgi-bin/|?) 0  0%  0
      refresh_pattern .    0  20%  4320
      
      
      #Remote proxies
      
      
      # Setup some default acls
      # ACLs all, manager, localhost, and to_localhost are predefined.
      acl allsrc src all
      acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535 
      acl sslports port 443 563  
      
      acl purge method PURGE
      acl connect method CONNECT
      
      # Define protocols used for redirects
      acl HTTP proto HTTP
      acl HTTPS proto HTTPS
      
      # SslBump Peek and Splice
      # http://wiki.squid-cache.org/Features/SslPeekAndSplice
      # http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
      # Match against the current step during ssl_bump evaluation [fast]
      # Never matches and should not be used outside the ssl_bump context.
      #
      # At each SslBump step, Squid evaluates ssl_bump directives to find
      # the next bumping action (e.g., peek or splice). Valid SslBump step
      # values and the corresponding ssl_bump evaluation moments are:
      #   SslBump1: After getting TCP-level and HTTP CONNECT info.
      #   SslBump2: After getting TLS Client Hello info.
      #   SslBump3: After getting TLS Server Hello info.
      # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
      # they can be used there for custom configuration.
      acl step1 at_step SslBump1
      acl step2 at_step SslBump2
      acl step3 at_step SslBump3
      http_access allow manager localhost
      
      http_access deny manager
      http_access allow purge localhost
      http_access deny purge
      http_access deny !safeports
      http_access deny CONNECT !sslports
      
      # Always allow localhost connections
      http_access allow localhost
      
      request_body_max_size 0 KB
      delay_pools 1
      delay_class 1 2
      delay_parameters 1 -1/-1 -1/-1
      delay_initial_bucket_level 100
      delay_access 1 allow allsrc
      
      # Reverse Proxy settings
      
      
      # Package Integration
      url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
      url_rewrite_bypass off
      url_rewrite_children 16 startup=8 idle=4 concurrency=0
      
      # Custom options before auth
      
      
      # Set YouTube safesearch restriction
      acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
      request_header_access YouTube-Restrict deny all
      request_header_add YouTube-Restrict none youtubedst
      ssl_bump peek step1
      ssl_bump bump all
      # Setup allowed ACLs
      # Allow local network(s) on interface(s)
      http_access allow localnet
      # Default block all to be sure
      http_access deny allsrc
      
      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.