Squid and ACLs

[mcury]

@JonathanLee said in Squid and ACLs:

TAC wants me to move my 8080 rule to the top next tonight.

That is a good idea, but if I'm right, that alone won't help.
As I see it, you are getting intercepted by the proxy while going to the pfsense's GUI.

Also note that NAT is processed first than a firewall rule in the pipeline.. So, if I'm right, moving that rule won't solve the problem..

Edit:
Found the link, it wasn't jimp, memory failed me..
https://forum.netgate.com/topic/110072/squid-dnsbl-problem

Edit2 :

Oh, it would be easier to just change the firewall management port, choose any port that is not being used by any services in the firewall and not being intercepted by the transparent proxy.

[JonathanLee]

@mcury thanks for the information

[JonathanLee]

@mcury is port 8080 used by something else? My GUI is currently set to port 8080.

[mcury]

@JonathanLee said in Squid and ACLs:

@mcury is port 8080 used by something else? My GUI is currently set to port 8080.

No, not by default.
But some websites use that port, so it is usual to see users include that port in the allowed ports in the Squid settings.

If its not there, then, I don't think this is the problem.

Just to be clear, my suspicious is that the NAT that transparent proxy creates is intercepting that port when you are accessing the GUI, and sending it to the proxy 3128.

[JonathanLee]

@mcury I got it. It should also work to add bypass 192.168.1.1:8080 on the Squid bypass settings right

[mcury]

@JonathanLee said in Squid and ACLs:

It should also work to add bypass 192.168.1.1:8080 on the Squid bypass settings right

Yes, just bypass connections to destination 192.168.1.1.

Usually, most of the times if not always, you don't want to proxy connections to local networks, so I would bypass everything to:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

As far as I remember, you said a few weeks ago when we were trying to fix your Nintendo Switch problem, that you use both modes, transparent and explicit.

So, you need to make sure that you bypass these networks for both methods.

For transparent mode, you need to include those networks in Squid configuration, or if you created the NAT manually, include those networks there, you can use that reverse destination alias as previously mentioned in that thread.

For explicit mode, you would need to set it in the browser settings, or through the PAC file.

[JonathanLee]

Thanks I got the PAC file working. I bet 23.05.01 had some default Netgate proxy rules that 23.09 doesn't include.

[mcury]

@JonathanLee said in Squid and ACLs:

Thanks I got the PAC file working. I bet 23.05.01 had some default Netgate proxy rules that 23.09 doesn't include.

hm.. could be but I don't think so.

[JonathanLee]

It was this old separators that were deleted however still listed in the 23.05.01 config.xml file.

It mixed up every rule on the config.xml side and left it looking correct on the GUI side. I just deleted them and it fixed it for my 23.09.01

[mcury]

@JonathanLee said in Squid and ACLs:

It was this old separators that were deleted however still listed in the 23.05.01 config.xml file.

It mixed up every rule on the config.xml side and left it looking correct on the GUI side. I just deleted them and it fixed it for my 23.09.01

Oh, that certainly wasn't a easy shot, good work =)

[JonathanLee]

@mcury I also had to disable some ethernet rules that all the sudden showed a lot of activity