Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgate 3100 URL unknown

    Scheduled Pinned Locked Moved
    Official Netgate® Hardware
    4
    47
    4.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Hmm, let me check. The 23.09 release testing has taken over all my spare cycles right now.

      M 1 Reply Last reply Reply Quote 0
      • M
        michael_samer @stephenw10
        last edited by

        @stephenw10 :
        Hi Steve
        any update or still locked into 23.09 testing?
        If it helps I'd draw a networking diagram how the data flow works and how you'd reproduce it (quite simple actually).
        Cheers
        Michael

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Sorry 23.09 is using all my time. With any luck that should be imminent though and then I can look at it. And you can go straight to 23.09 at that point.

          I'll try to get the setup replicated before that.

          M 1 Reply Last reply Reply Quote 0
          • M
            michael_samer @stephenw10
            last edited by

            @stephenw10 Hi Steve, do you have any knowledge when the tech team is able to dig into the case? We are stuck since May which is getting harder to cope with with every week going by.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes, I'm digging into this again today.

              M 1 Reply Last reply Reply Quote 0
              • M
                michael_samer @stephenw10
                last edited by

                @stephenw10 said in Netgate 3100 URL unknown:

                Yes, I'm digging into this again today.

                Hi; I'm looking forward to :-)

                1 Reply Last reply Reply Quote 1
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Ok I have this working with chained Squid instances.

                  Can you remind me what the special authentication requirement was that meant Squid was needed? It works ine with basic authentication but if I can test something closer to whatever the Bluecoat needs hat would be better.

                  M 1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Oh I see your reply on the ticket! Testing LDAP....

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      michael_samer @stephenw10
                      last edited by

                      @stephenw10 : Hi Steve
                      I've included the squdi conf in the TAC ticket. The login is just unusual for the LDPA style which is about 80 characters long, but not so much special.
                      When you chained squids are working: does the lowest box have an internet DNS resolver (or some way to resolve inet DNSes) or (like we) only local addresses? My first ticket about this case was about the SRV call and the 503 reply from our uplink proxy.
                      Afair I did a picture (TAC ticket) how the boxes are connected and what they "see".

                      1 Reply Last reply Reply Quote 1
                      • M
                        michael_samer @stephenw10
                        last edited by

                        @stephenw10 said in Netgate 3100 URL unknown:

                        Oh I see your reply on the ticket! Testing LDAP....

                        not sure if digiging into the LDAP helps at all: the problem only occurs on modern pfsense versions but not on older so the basic call must have changed, not the squid config.

                        In the tcp_dump we at first did one of your techs told us why we (our local DNS) answers the DNS call with NX_Domain so the initiation is running wrong. It was never answered or called after so I'm not sure if the failed DNS lookup is then forwarded to the proxy and answered there so no need to worry there.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Yeah I agree using LDAP auth instead of local seems unlikely.

                          My test box does currently have local DNS resolution. I'll try removing that.

                          I don't think this is an SRV issue though since the pkg servers have been using that for years. And that you still saw this issue in 22.05.1 which would have been using the same known working Squid version but with the new pkg system.

                          By far the most significant thing that changed is that the pkg servers used by the dynamic repo system require client certs to access them. To do that through a proxy obviously relies on the proxy correctly passing the cert from the client to the upstream server.

                          More recently the pkg binary switched from fetch to curl which added at least one known bug but should not be an issue when using local Squid.

                          Steve

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            michael_samer @stephenw10
                            last edited by

                            @stephenw10 said in Netgate 3100 URL unknown:

                            Yeah I agree using LDAP auth instead of local seems unlikely.

                            My test box does currently have local DNS resolution. I'll try removing that.

                            I'd use a DNS entry (system-general) for 127.0.0.1 so "all" DNS requests are answered NX_DOMAIN, which is the same for Inet Addresses in our situation. While this might not be the problem, it's quite unusual and the DNS Patch needed (host overwrite) shows one of the LAN -to- LAN Firewalls compared to Internet Firewalls.

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              michael_samer @michael_samer
                              last edited by

                              Hi Steve
                              have you done any further tests so far? Did you change the DNS accordingly?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                I was able to review this again today. I replied on your ticket.

                                I think we need to see exactly how you were configuring DNS in 22.05 that worked.

                                Steve

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  michael_samer @stephenw10
                                  last edited by

                                  @stephenw10 said in Netgate 3100 URL unknown:

                                  I was able to review this again today. I replied on your ticket.

                                  I think we need to see exactly how you were configuring DNS in 22.05 that worked.

                                  Steve

                                  Hi Steve
                                  I already pasted the screenshot with the "Google DNS workaround" and here as text:

                                  DNS Resolver:
                                  Host Overrides
                                  4 4.8.8.in-addr.arpa 4.4.8.8
                                  8 8.8.8.in-addr.arpa 8.8.8.8
                                  Domain Overrides
                                  4.4.8.8.in-addr.arpa 127.0.0.1
                                  8.8.8.8.in-addr.arpa 127.0.0.1

                                  This was a workaround for anything above 22.01. In V21.x we had no workarounds needed to use our construct as we (want to) do now.

                                  My advise: disable the DNS parent in your second box and you will experience the problem. Our workaround for 22.01+ Update checks is just one point to a solution: The new dynamic Repos do not use the Proxy to resolve their names.

                                  Cheers
                                  Michael

                                  M 1 Reply Last reply Reply Quote 0
                                  • M
                                    michael_samer @michael_samer
                                    last edited by

                                    Hi Steve
                                    my TAC Ticket vanished again (like 4month ago). Can you make it visible again?

                                    Cheers
                                    Michael

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Hi Michael,
                                      I think your new ticket was merged into the old one which should have opened it again.

                                      I was able to get back to this today along with one of our developers. I think we have a handle on the issue. Or at least an issue that would prevent this working in your situation.

                                      We will probably more questions for you tomorrow on the ticket.

                                      Steve

                                      M 1 Reply Last reply Reply Quote 0
                                      • M
                                        michael_samer @stephenw10
                                        last edited by

                                        @stephenw10 well the new ticket does not include any info/replies of the old call and the call was vanished a week when I opened a new ticket with the new information what we collected so far. I find it quite disturbing when replies/tickets "vanish" as the logical checks are no longer plausible or understandable. Anyway let's see what comes next.
                                        Cheers
                                        Michael

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          It should be on there I can see the replies internally.

                                          I replied on the ticket. We finally replicated the issue and it looks to be how Squid is handling the SRV requests/records. Digging continues.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post