<![CDATA[Squid port 3128 and Firewall Rules]]>Hello fellow Netgate community members.

Can you please help? I have Squid running on ports 3128 and 3129 with custom enabled some splice some bump rules. I keep noticing a default Netgate deny all rule in my logs. I have even attempted to create a rule from 192.168.1.1 and 127.0.0.1 source port 3128 to any Lan device. However I keep seeing logs that it is blocked with or without the rule. WLAN = WIRELESS LAN destinations are lan devices.

Here is the logs I see

Screenshot 2023-10-21 at 11.11.50 AM.png

Now think this is the Squid proxy or Squid cache responding to requests, however why is it show as blocked?? Does the auto rule not include Squid? Leading to if I add a rule for this condition why does it never show states and continue to block it??

I think I have some small setting off, as it should approve the proxy to respond to client requests from the cache right?

Everything is working on the system, however the proxy logs show lots of miss for 127.0.0.1 so I think this is the cache being blocked automatically with or without ACLs set up to approve it.

]]>https://forum.netgate.com/topic/183554/squid-port-3128-and-firewall-rulesRSS for NodeTue, 17 Mar 2026 00:13:23 GMTSat, 21 Oct 2023 18:23:02 GMT60<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sun, 12 Jan 2025 17:00:27 GMT]]>Could it be set flags SYN ACK ? and or state type keep or sloppy ?

]]>https://forum.netgate.com/post/1202422https://forum.netgate.com/post/1202422Sun, 12 Jan 2025 17:00:27 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 20:07:49 GMT]]>@mcury

Thanks all I see is WAN blocks now !! YES!!! THANK YOU

Screenshot 2023-10-21 at 1.07.06 PM.png

]]>https://forum.netgate.com/post/1131260https://forum.netgate.com/post/1131260Sat, 21 Oct 2023 20:07:49 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:55:34 GMT]]>@JonathanLee said in Squid port 3128 and Firewall Rules:

@mcury Thanks!!!! that helps a lot I no longer see double requests for everything and it all still works!!! The XBOX uses transparent and UpNp and all the devices that know about the proxy don't need the transparent!!! YES!!!

Oh, good to hear that :)

]]>https://forum.netgate.com/post/1131258https://forum.netgate.com/post/1131258Sat, 21 Oct 2023 19:55:34 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:54:49 GMT]]>@mcury Thanks!!!! that helps a lot I no longer see double requests for everything and it all still works!!! The XBOX uses transparent and UpNp and all the devices that know about the proxy don't need the transparent!!! YES!!!

]]>https://forum.netgate.com/post/1131257https://forum.netgate.com/post/1131257Sat, 21 Oct 2023 19:54:49 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:43:36 GMT]]>@JonathanLee said in Squid port 3128 and Firewall Rules:

How do you bypass for example one host like 192.168.1.17 from the SSL intercept but still make it use the the transparent proxy?

1- Disable transparent proxy
2- You would have to create the transparent NAT manually, using a ! in the source, with that IP address.
3- That NAT would have to redirect outbound TCP 443 connections to 127.0.0.1 3128.

Test like that, if doesn't work, try to change the port in the 3rd step to 3129.

I think that will do it.
95214dee-5a00-4b21-af44-733c5d20aa41-image.png

Note that you would also need to create one for port 80.

]]>https://forum.netgate.com/post/1131255https://forum.netgate.com/post/1131255Sat, 21 Oct 2023 19:43:36 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:38:08 GMT]]>@mcury How do you bypass for example one host like 192.168.1.17 from the SSL intercept but still make it use the the transparent proxy?

]]>https://forum.netgate.com/post/1131254https://forum.netgate.com/post/1131254Sat, 21 Oct 2023 19:38:08 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:29:49 GMT]]>@JonathanLee said in Squid port 3128 and Firewall Rules:

@mcury Yes I do have both, my XBOX uses the transparent side

Have you bypassed all other hosts that don't need transparent proxy in the Squid settings ?

Disable transparent proxy for one sec and test.

If it works, enable it again and try to bypass clients that are pointing to the proxy (explicit) in the transparent settings.

]]>https://forum.netgate.com/post/1131253https://forum.netgate.com/post/1131253Sat, 21 Oct 2023 19:29:49 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:24:42 GMT]]>@mcury Yes I do have both, my XBOX uses the transparent side

]]>https://forum.netgate.com/post/1131251https://forum.netgate.com/post/1131251Sat, 21 Oct 2023 19:24:42 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:15:09 GMT]]>@JonathanLee

# default deny rules
#---------------------------------------------------------------------------
block in log inet all ridentifier 1000000103 label "Default deny rule IPv4"
block out log inet all ridentifier 1000000104 label "Default deny rule IPv4"

I suppose you have transparent proxy also enabled ? For systems that can't set a proxy by hand ?
If that is the case, disable transparent proxy for one second to see if it is not related to the rdr pass you have up there

]]>https://forum.netgate.com/post/1131250https://forum.netgate.com/post/1131250Sat, 21 Oct 2023 19:15:09 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:06:50 GMT]]>@mcury said in Squid port 3128 and Firewall Rules:

cat /tmp/rules.debug

Screenshot 2023-10-21 at 12.06.25 PM.png

Rule

]]>https://forum.netgate.com/post/1131249https://forum.netgate.com/post/1131249Sat, 21 Oct 2023 19:06:50 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:05:03 GMT]]>@mcury Yes I have floating rules for traffic shaping

Screenshot 2023-10-21 at 12.04.45 PM.png

]]>https://forum.netgate.com/post/1131247https://forum.netgate.com/post/1131247Sat, 21 Oct 2023 19:05:03 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 19:01:19 GMT]]>@JonathanLee Its blocking out connections, from pfsense to the host, with a default deny ipv4 rule?

Check with cat /tmp/rules.debug in the shell, search for that rule.

Do you have any floating rules ?

]]>https://forum.netgate.com/post/1131246https://forum.netgate.com/post/1131246Sat, 21 Oct 2023 19:01:19 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:57:33 GMT]]>@mcury any other ideas?

]]>https://forum.netgate.com/post/1131245https://forum.netgate.com/post/1131245Sat, 21 Oct 2023 18:57:33 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:55:54 GMT]]>Screenshot 2023-10-21 at 11.54.31 AM.png

Dang still blocks

Screenshot 2023-10-21 at 11.55.25 AM.png

]]>https://forum.netgate.com/post/1131244https://forum.netgate.com/post/1131244Sat, 21 Oct 2023 18:55:54 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:54:53 GMT]]>@JonathanLee said in Squid port 3128 and Firewall Rules:

Changed to conservative optimization

I think that will do it..

]]>https://forum.netgate.com/post/1131243https://forum.netgate.com/post/1131243Sat, 21 Oct 2023 18:54:53 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:53:13 GMT]]>@mcury Done set it back to how I had it.

Screenshot 2023-10-21 at 11.52.33 AM.png

Rules normalized

Screenshot 2023-10-21 at 11.51.48 AM.png

Changed to conservative optimization

]]>https://forum.netgate.com/post/1131242https://forum.netgate.com/post/1131242Sat, 21 Oct 2023 18:53:13 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:51:02 GMT]]>@JonathanLee said in Squid port 3128 and Firewall Rules:

Maybe they are my URL blocks that still try to connect?

I can't see how could be that.

]]>https://forum.netgate.com/post/1131241https://forum.netgate.com/post/1131241Sat, 21 Oct 2023 18:51:02 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:49:34 GMT]]>@JonathanLee Leave only one rule, clients to default gateway, TCP port 3128.
Leave this rule with default settings.

Try this:

a7333a87-54fd-4f1c-9ba4-ce1e61b399df-image.png

There, where you see Firewall Optimization Options, change to conservative.

Note that this option will increase memory usage of the firewall.

]]>https://forum.netgate.com/post/1131240https://forum.netgate.com/post/1131240Sat, 21 Oct 2023 18:49:34 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:49:31 GMT]]>@mcury Maybe they are my URL blocks that still try to connect?

]]>https://forum.netgate.com/post/1131239https://forum.netgate.com/post/1131239Sat, 21 Oct 2023 18:49:31 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:46:15 GMT]]>@mcury I even have any flag set for all the rules tested

Screenshot 2023-10-21 at 11.45.20 AM.png

]]>https://forum.netgate.com/post/1131237https://forum.netgate.com/post/1131237Sat, 21 Oct 2023 18:46:15 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:44:27 GMT]]>@mcury I wonder why it keeps doing it, it does it for every single lan device in the logs all day. But everything is working on the user end.

]]>https://forum.netgate.com/post/1131236https://forum.netgate.com/post/1131236Sat, 21 Oct 2023 18:44:27 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:41:33 GMT]]>@JonathanLee If that is not a TCP:S, it should be an out of state connection.
Could be asymmetric route but I don't think that is the case.

All you need is to allow clients to connect to their gateway IP address (pfsense), on port 3128.

Port 3128 will handle SSL connections too. I don't remember ever having to use port 3129.

]]>https://forum.netgate.com/post/1131235https://forum.netgate.com/post/1131235Sat, 21 Oct 2023 18:41:33 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:42:42 GMT]]>this was also tested

Screenshot 2023-10-21 at 11.42.21 AM.png

]]>https://forum.netgate.com/post/1131233https://forum.netgate.com/post/1131233Sat, 21 Oct 2023 18:42:42 GMT<![CDATA[Reply to Squid port 3128 and Firewall Rules on Sat, 21 Oct 2023 18:40:19 GMT]]>this was also tested

Screenshot 2023-10-21 at 11.39.55 AM.png

]]>https://forum.netgate.com/post/1131232https://forum.netgate.com/post/1131232Sat, 21 Oct 2023 18:40:19 GMT