Squid-reverse

cjbujold

Trying to determine if Squid-reverse can do what I need.

We have 2 HTTPS sites each with a different name coming via one Internet Line to PFsense. Can I send, based on it's HTTPS name, one site to one server and the second to a different server.

For example: https://site1.something.com go to server 1 and Https://site2.abc.net to server2 both have different certificates.

If so what would be the reverse proxy configuration?

Thanks

cjb

trendchiller

i really have to admin, i never testet this constellation ;-)
have a try and let me know…
the configuration should be the same as with HTTP (see the before examples)

good lock

Nachtfalke

Is it possible to use squid-reverse and squidguard together ?
SquidGuard installs always squid2.7 package.

marcelloc

Nachtfalke,

you can try to install squidguard, remove squid2 and install squid-reverse.

Nachtfalke

@marcelloc:

Nachtfalke,

you can try to install squidguard, remove squid2 and install squid-reverse.

If I try to remove squid it removes squidguard, too.

pkg_delete squid

Is not working because of dependencies

pkg_delete -r squid

removes squidguard

marcelloc

Maybe it will need a full compile to solve this.

Matthias

I'm having an issue trying to install squid-reverse and some other packages. I'm currently running pfSense-Full-Update-2.1-DEVELOPMENT-i386-20111125-1741.tgz which can be found here http://files.pfsense.org/jimp/ipv6/

Here is the output from the package installation:


Beginning package installation for squid-reverse .
Downloading package configuration file... done.
Saving updated package information... done.
Downloading squid-reverse and its dependencies... 
Checking for package installation... 
 Downloading http://files.pfsense.org/packages/8/All/libwww-5.4.0_4-i386.pbi ...  (extracting)

 Downloading http://files.pfsense.org/packages/8/All/squid_radius_auth-1.10-i386.pbi ...  (extracting)

 Downloading http://files.pfsense.org/packages/8/All/squid-3.1.19-i386.pbi ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/squid-3.1.19-i386.pbi.
of libwww-5.4.0_4-i386.pbi
			squid_radius_auth-1.10-i386.pbi
			squid-3.1.19-i386 failed!

Installation aborted.Backing up libraries... 
Removing package...
Starting package deletion for libwww-5.4.0_4-i386.pbi
			squid_radius_auth-1.10-i386.pbi
			squid-3.1.19-i386...done.
Removing squid-reverse components...
Tabs items... done.
Menu items... done.
Services... done.
Loading package instructions...
Include file squid.inc could not be found for inclusion.
Deinstall commands... 
Not executing custom deinstall hook because an include is missing.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
Cleaning up... Failed to install package.

Installation halted.

Trying to browse to the URLs http://files.pfsense.org/packages/8/All/squid-3.1.19-i386.pbi and http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/squid-3.1.19-i386.pbi result in 404's.

trendchiller

Hi !
we'll have to have a look why the pbi's are not built :-(
sorry…

gwhynott

is there a way I could roll back to the 2.x package of squid without breaking anything? when i removed the package the older 2.x didn't show up as an option to install. I'm not sure what I'll break if i do an install using pkg_add.

after upgrading to 3 it has broken my QOS tagging, (see post http://forum.pfsense.org/index.php/topic,47643.0.html for details). rebooting didn't help nor did trying different vaules in in the ACLs.

we relied on the tagging to manage our traffic, it was a beautiful thing when it worked. 8)

thanks,
greg

Nachtfalke

If you do not need squid-reverse then just use squid2 package.

Because the squid configuration files for squid2 and squid3 seems to be equal it would be probably no problem to do a:

pkg_add -r http://files.pfsense.org/packages/amd64/8/All/squid-2.7.9_1.tbz

If you need squid-reverse then install it from GUI(, delete (pkg_delete) squid3 and add (pkg_add) squid2.x

gwhynott

@Nachtfalke:

If you do not need squid-reverse then just use squid2 package.
If you need squid-reverse then install it from GUI(, delete (pkg_delete) squid3 and add (pkg_add) squid2.x

i was using the squid-reverse for the OWA access / reverse-proxy functions. I'd like to get it back if possible, the previous version of squid-reverse, not squid2 or squid3 packages.

-g

Nachtfalke

@gwhynott:

@Nachtfalke:

If you do not need squid-reverse then just use squid2 package.
If you need squid-reverse then install it from GUI(, delete (pkg_delete) squid3 and add (pkg_add) squid2.x

i was using the squid-reverse for the OWA access / reverse-proxy functions. I'd like to get it back if possible, the previous version of squid-reverse, not squid2 or squid3 packages.

-g

Then install squid-reverse package from GUI
SSH to your pfsense, uninstall (pkg_delete) squid3 and install (pkg_add) squid2.7.

pkg_add -r http://files.pfsense.org/packages/amd64/8/All/squid-2.7.9_1.tbz

gwhynott

Then install squid-reverse package from GUI
SSH to your pfsense, uninstall (pkg_delete) squid3 and install (pkg_add) squid2.7.
pkg_add -r http://files.pfsense.org/packages/amd64/8/All/squid-2.7.9_1.tbz

squid2 != squid-reverse (based on squid2) from my understanding. or am i wrong?

there was (about 2 weeks ago) 3 squid packages you could install from the list, squid2, squid3 and squid-reverse.

thanks,
greg

trendchiller

Nachtfalke is right, it you install squid2 by pkg_add it'll work

the package name has nothing to do with the version of squid…

gwhynott

@trendchiller:

the package name has nothing to do with the version of squid…

thanks for the clarification trendchiller.

-g

trendchiller

:)

Cino

@trendchiller I had time to test and so far so good. Able to have it point to 4 different servers behind squid. Wildcard sub-host works good!.. I still have to test HTTPS but i'm not in rush to test…

Only drawback I have found are global settings. I like having forwarded_for off, via off for proxy but need them on when using reverse-proxy so the web server correctly puts the IPs in its logs. To work around this, I created another squid.conf file just for reverse-proxy and started another instance of squid on the box.... Major benefit here:I can keep access.log separate and pretty soon turn off logging for reverse-proxy since the web servers keep their own logs. And have different global settings.

I ended up hacking squid.inc so it would stop/restart both instances of squid. This way I don't need to start the second instance from the cmdline.

Is it pretty? No but works for me :-) Not sure if I'll keep it this way, may just go back to using pound but found squid reverse-proxy is faster then pound... and faster is good...lol...

wheelz

I'm trying to get the dansguardian package and the squid-reverse package to work together using ntlm single sign on. In the guides I have it says this:

As Samba-3.x has it's own authentication helper there is no need to build any of the Squid
authentication helpers for use with Samba-3.x (and the helpers provided by Squid won't work if you
do). You do however need to enable support for the NTLM scheme if you plan on using this. Also
you may want to use the wbinfo_group helper for group lookups
–enable-auth="ntlm,basic"
--enable-external-acl-helpers="wbinfo_group"

I'm not that familiar with how pfsense packages are compiled. Is the squid-reverse package compiled with these options? Or is that even the right question to ask? (trying to muddle my way though this to help)

Cino

i can't speak for the developer but here is the output of squid -v


Squid Cache: Version 3.1.19
configure options:
  '--with-default-user=squid'
  '--bindir=/usr/local/sbin'
  '--sbindir=/usr/local/sbin'
  '--datadir=/usr/local/etc/squid'
  '--libexecdir=/usr/local/libexec/squid'
  '--localstatedir=/var/squid'
  '--sysconfdir=/usr/local/etc/squid'
  '--with-logdir=/var/log/squid'
  '--with-pidfile=/var/run/squid/squid.pid'
  '--enable-removal-policies=lru heap'
  '--disable-linux-netfilter'
  '--disable-linux-tproxy'
  '--disable-epoll'
  '--disable-translation'
  '--enable-auth=basic digest negotiate ntlm'
  '--enable-basic-auth-helpers=DB NCSA PAM MSNT SMB squid_radius_auth LDAP SASL YP'
  '--enable-digest-auth-helpers=password ldap'
  '--enable-external-acl-helpers=ip_user session unix_group wbinfo_group ldap_group'
  '--enable-ntlm-auth-helpers=smb_lm'
  '--enable-negotiate-auth-helpers=squid_kerb_auth'
  '--enable-storeio=ufs diskd aufs'
  '--enable-disk-io=AIO Blocking DiskDaemon DiskThreads'
  '--enable-delay-pools'
  '--enable-ssl'
  '--with-openssl=/usr'
  '--enable-ssl-crtd'
  '--enable-icmp'
  '--enable-cache-digests'
  '--enable-wccpv2'
  '--enable-referer-log'
  '--enable-useragent-log'
  '--enable-arp-acl'
  '--enable-ipfw-transparent'
  '--enable-pf-transparent'
  '--enable-ipf-transparent'
  '--enable-follow-x-forwarded-for'
  '--disable-ecap'
  '--disable-loadable-modules'
  '--disable-kqueue'
  '--prefix=/usr/local'
  '--mandir=/usr/local/man'
  '--infodir=/usr/local/info/'
  '--build=i386-portbld-freebsd8.1'
  'build_alias=i386-portbld-freebsd8.1'
  'CC=cc'
  'CFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include  -I/usr/include -DLDAP_DEPRECATED -fno-strict-aliasing'
  'LDFLAGS= -L/usr/local/lib -L/usr/local/lib -rpath=/usr/lib:/usr/local/lib -L/usr/lib'
  'CPPFLAGS=-I/usr/local/include'
  'CXX=c++'
  'CXXFLAGS=-O2 -pipe -I/usr/local/include -I/usr/local/include -I/usr/include -DLDAP_DEPRECATED -fno-strict-aliasing'
  'CPP=cpp'
  --with-squid=/usr/ports/www/squid31/work/squid-3.1.19 --enable-ltdl-convenience

from what i can tell, the options are enabled

wheelz

Oh… heh... still learning some commands. :) thx