Squid3 - New GUI with sync, normal and reverse proxy

[pizetta]

Hi,
At "Proxy server: Traffic management" we can manage a single delay pool with the options: Per-host throttling / Overall bandwidth throttling / Maximum upload size.
I need to manage many groups of delay pools and set to different networks/Ips. This is very usefull, are you going to implement this?

Thanks in advance.

[marcelloc]

@pizetta:

I need to manage many groups of delay pools and set to different networks/Ips. This is very usefull, are you going to implement this?

No plans for this feature yet. But if you need it, you can post a bountry or make a donation  for that  ;)

Do you have any config sample for this?

[pizetta]

Something like this…

delay_pools 3                                     ######3 delay pools
delay_class 1 2
delay_parameters 1 -1/-1 12800/12800
delay_access 1 allow client_100k           ######limited clients 100kbps

delay_class 2 2
delay_parameters 2 -1/-1 25600/25600
delay_access 2 allow clientes_200k       ######limited clients 200kbps

delay_class 3 2
delay_parameters 3 -1/-1 38400/38400
delay_access 3 allow clientes_300k      ######limited clients 300kbps

I wish to manage as many pools as I can, grouping users to limit the use of internet. I'll take a look at bounties.
Best regards!

[yosu]

Hi,

I am using package squid3 version 3.1.19 pkg 2.0.5_2.

In /usr/local/pkg/squid.inc I think this line:

http_access deny CONNECT !sslports

should be:

http_access deny connect !sslports

Also in reverse proxy web gui I need to set port 443 in order to https work. If I left blank reverse HTTPS port, it doesn't open port 443.

Also the reverse proxy HTTPS always redirect to the reverse HTTPS default site. Don't mind what mappings you use.

HTTP reverse proxy works fine.

Best regards.

[nutt318]

When using the Reverse Proxy in theory will it redirect the traffic based upon the URL?

I've got 2 internal webservers with one public IP, should I be able to route the traffic based upon server1.mydomain.com to 192.168.1.50 and say server2.mydomain.com to 192.168.1.51 ?

It seems I've configured the reverse proxy properly and added a rule to allow http traffic to each private address but i'm not having any luck.

Anyone have any ideas or a detailed instructions?

[marcelloc]

@nutt318:

When using the Reverse Proxy in theory will it redirect the traffic based upon the URL?

I've got 2 internal webservers with one public IP, should I be able to route the traffic based upon server1.mydomain.com to 192.168.1.50 and say server2.mydomain.com to 192.168.1.51 ?

yes,

@nutt318:

It seems I've configured the reverse proxy properly and added a rule to allow http traffic to each private address but i'm not having any luck.

what you got on squid access log?

[nutt318]

Here is what I see in the access.log file /var/squid/logs - I only see internal traffic. Shouldn't I see attempts from public IP's that are trying to access the web servers?

1338991913.168 179241 MY.DESKTOP.I.P TCP_MISS/504 1290 GET http://domain1.mydomain.com/ - DIRECT/MY.PUBLIC.I.P text/html

I'll try and add some screenshots of my setup

EDIT: added screenshots

[marcelloc]

The setup looks fine, I'll try to simulate it.

[yosu]

@nutt318:

Make URI textbox blank in order to get:

acl test1 url_regex -i http://test1.mydomain.com.*$

Now you get:

acl test1 url_regex -i test1.mydomain.com/http://test1.mydomain.com.*$

You can look at /usr/local/etc/squid/squid.conf in a ssh shell.

Best regards.

[nutt318]

That made it work from internal on the LAN, but I still cant get to it from the outside.

Any other ideas?

Thanks!

[cjbujold]

Unable to get reverse squid 3 to work.  Here is my configuration, if somebody can help.  The example i'm trying to get to work is 2 web servers; one on port 80 and another on port 8081.  The request comes to port 80 should be pickedup by squid and depending on the URL squid should send the request either to port 80 of the web server or to port 8081.  The test Im using is www goes to port 80 and helpdesk goes to port 8081.  When I try it, everythings goes to port 80. Port 8081 is never sent aqnything and the helpdesk goes to port 80.

The squid.conf file reverse proxy section looks like this: (XXX is equal to mydomainname)

Reverse Proxy settings

http_port 192.168.XXX.XXX:80 accel defaultsite=XXXX.ca vhost
http_port 156.34.XXX.XXX:80 accel defaultsite=XXXX.ca vhost
#XXXX HelpDesk
cache_peer 192.168.XXX.15 parent 8081 0 proxy-only no-query originserver login=PASS name=XXXXHelpDesk

acl XXXXHelpDesk url_regex -i http://helpdesk.XXXX.ca/.$
acl XXXXHelpDesk url_regex -i http://helpdesk.XXXX.com/.$
cache_peer_access XXXXHelpDesk allow XXXXXHelpDesk
cache_peer_access XXXXHelpDesk allow XXXXHelpDesk
cache_peer_access XXXXHelpDesk deny allsrc
cache_peer_access XXXXHelpDesk deny allsrc
never_direct allow XXXXHelpDesk
never_direct allow XXXXHelpDesk
http_access allow XXXXHelpDesk
http_access allow XXXXHelpDesk

deny_info TCP_RESET allsrc

Custom options


[nutt318]

Sounds like the same issue I'm having, however it looks like one of your mappings isnt ON. Maybe that will fix it, if so I need to look over my config again.

[nutt318]

I looked at my squid.config file at its basically the same as cjbujold's.

Is there anything else to try, or does anyone have any idea why this isnt working?

Thanks for the help.

[IGIdeus]

Hi,

There is no possible to restart/start squid service from dashboard and services GUI pages.

Best regards
IGIdeus

[IGIdeus]

Hi,

IMHO squid as a package for firewall should be hardened a little bit more.
From my perspective ACL safe_ports should include only 21, 80, 443 and 1025-65535 ports, ACL SSL should include only 443 port. All other ports should be added manually.
There could be information about other ports in description of the options.

The brilliant function could be possibility to manage the ACLs like in Webmin or like firewall rules in pfSense.

Best regards
IGIdeus

[marcelloc]

@IGIdeus:

There is no possible to restart/start squid service from dashboard and services GUI pages.

Apply this patch on your 2.0.1 install to fix restart service option
https://github.com/bsdperimeter/pfsense/commit/6ae78f0808747893f30b867c51b744dfe39e2190

@IGIdeus:

From my perspective ACL safe_ports should include only 21, 80, 443 and 1025-65535 ports, ACL SSL should include only 443 port. All other ports should be added manually.

the current list (21 70 80 210 280 443 488 563 591 631 777 901 1025-65535) is not that big. I think(and in some cases I remove) that 1025-65535 is the most "unsecure" port range on this array. You can chage it editing squid.inc file.

@IGIdeus:

The brilliant function could be possibility to manage the ACLs like in Webmin or like firewall rules in pfSense.

It's on the todo list, but I need some free time to finish.

[nutt318]

@marcelloc:

The setup looks fine, I'll try to simulate it.

Did you ever have a chance to simulate the reverse proxy traffic?

[blasterreal]

Pfsense 2.0.1 32 BIT

Squid services not started :(

-php: /pkg_edit.php: The command '/usr/local/sbin/squid -k shutdown' returned exit code '1', the output was 'FATAL: Bungled squid.conf line 4: http_port 127.0.0.1:3128 intercept Squid Cache (Version 2.7.STABLE9): Terminated abnormally.'

-squid[54825]: Bungled squid.conf line 4: http_port 127.0.0.1:3128 intercept

[marcelloc]

@Blasterreal:

Squid Cache (Version 2.7.STABLE9)

Did you installed squidguard after squid? force a squid3 reinstall, check config, apply settings and test again.

[blasterreal]

Thanks its working ;)