Problem with Squid-Reverse proxy

dan104

I am trying to use squid reverse proxy on latest pfsense I386

Has DNS and mixed set of port gateways forwarded

I have installed the squid3 20_1_5 package and try as I may I can not get things to work.

Here is my config concepts
Pfsence is public IP on WAN side
Backside is basic private lan (192.168.0.x)
4 servers with mixed ports
.69:80 -> IIS box using headers to select from a handful of sites
.69:81 ->Yawcam live feed
.40:8080 -> Remote controlled Webcam
.40:80 -> IIS box using headers to select from addional and failover sites (disregarded at this point)
.140:5150 -> Rabit based sensor collection box – Web interface
.120:80 -> Webmail site

Objectives:
Birdcam.domain.com -> .69:81
www.domain.com ->.69:80
wel.domain.com -.140:5150
www.*.domain.com ->.69:80
backyardcam.domain -> .40:8080

Steps I took:

Installed squid3 pkg from pfsense
Defined 4 servers
Mapped sites based on url to server
Set listen port to 80 and IP to 127.0.0.1
Set PF Webgui to port 180 and turned off redirect
Created firewall rule for Wan side input on 80 -> 127.0.0.1
Enabled squid logging
Enabled Squid and all of the mapping and servers
Started Squid service watched real-time log viewer
Injected http requests from outside source

Results:
From SSH terminal ps –a shows no squid processes
Realtime log shows nothing
Services show squid running
http request time out

smels like either squid is not starting or I am not listening on right ports.

Thoughts??????

marcelloc

dan104,

If you listen squid on loopback, you need a nat rule to forward traffic from wan to 127.0.0.1 but if you listen on wan address, you just need the firewall rule.

You have 6 ports to forward, so I suggest you to create servers based on your ports.

host_69_81 (host .69 port 81)
host_69_80 (host .69 port 80)
host_40_8080 (host .40 port 8080)
host_40_80 (host .40 port 80)
host_140_5150 (host .140 port 5150)
host_120_80 (host .120 port 80)

Currente package version, creates only one squid conf instead of multiple daemons. This way, you need to publish all your sites on wan_ip:80 for all http traffic and wan_ip:443 for all ssl traffic.

The host header on mappings will forward the request to the server the way you want:

uri: Birdcam.domain.com host:host_69_81
uri: www.domain.com host:host_69_80
uri: wel.domain.com host:host_140_5150
uri: www.*.domain.com host:host_69_80
uri: backyardcam.domain host:host_40_8080

att,
Marcello Coutinho

dan104

Thank you for the prompt answers!

When you say lisen on wan address I assume you are saying the public ID, which I tried but maybe I had other errors.

My current set up is almost the same as you suggested, except the 127…. I do have a firewall rule forwarding port 80 on WAN to 127.... But need to go look at the NAT settings tonight.

There are lots of option on the GEN tab, any ones that are must do's and other that are avoid for nows?

Thank you again
Dan

dan104

Tried what I thought you said and still no traffic Attaching my config.xml file
Any thoughts?

Dan

Still_not_working.txt

marcelloc

dan104,

Remove your xml from previous post, It's not safe exposing your firewall config to the world :(

I've tried to access your ip on http and https without success.

try these steps:

Remove the nats for your internal web servers
listen reverse squid on 80
apply a firewall rule on wan allowing access from any to interface_address port 80 and port 443
check on console/ssh if squid is running and listening on ports 80/443 using netstat -an | grep -i listen
test using tcpdump(on console/ssh) if you get any http/https traffic to wan_address at port 80,443