Pfsense with squid and squidGuard blocks http access



  • I have to install a PFsense firewall for a captive portal for a small exhibition place. It will be a free hotspot without authentification.
    I used Pfsense. I installed the firewall without problem. The Pfsense is used as DNS server and gateway. For legal reason I have to filter sites and prevent pornographic websites for example. I installed squid and squidguard with a blacklist and problems then began.
    The situation is :
    a). transparent proxy + blacklist + firewall = https websites are OK but very slow but http does not work ("about blank" is written in the address bar)
    b). If "Allow users on interface" is unchecked, we can go on any websites but porno websites are not blocked and according to logs, proxy does not seem to be used.
    c). If transparent proxy is not checked and parameters are put manually in the browser's configuration (192.168.1.1 port 3128) then http and https are blocked. I even can not have access anymore to pfsense web interface.

    If Squid and SquidGuard are not running evrything is OK so it seems that the firewall has no problem.
    Tranparent proxy is necessary as people are visitors and they have to browse the internet automatically.

    Thank you for your help and sorry for my English.  :P

    For information here is the proxy config :

    
    # Do not edit manually !
    http_port 192.168.1.1:3128
    http_port 127.0.0.1:3128 transparent
    icp_port 0
    
    pid_filename /var/run/squid.pid
    cache_effective_user proxy
    cache_effective_group proxy
    error_directory /usr/local/etc/squid/errors/French
    icon_directory /usr/local/etc/squid/icons
    visible_hostname localhost
    cache_mgr admin@localhost
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    logfile_rotate 365
    shutdown_lifetime 3 seconds
    # Allow local network(s) on interface(s)
    acl localnet src  192.168.1.0/255.255.255.0
    uri_whitespace strip
    
    cache_mem 1500 MB
    maximum_object_size_in_memory 200 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    cache_dir ufs /var/squid/cache 3000 16 256
    minimum_object_size 0 KB
    maximum_object_size 4 KB
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    
    # No redirector configured
    
    # Setup some default acls
    acl all src 0.0.0.0/0.0.0.0
    acl localhost src 127.0.0.1/255.255.255.255
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535 
    acl sslports port 443 563  
    acl manager proto cache_object
    acl purge method PURGE
    acl connect method CONNECT
    acl dynamic urlpath_regex cgi-bin ?
    cache deny dynamic
    http_access allow manager localhost
    
    # Allow external cache managers
    acl ext_manager_1 src 127.0.0.1 
    http_access allow manager ext_manager_1
    acl ext_manager_2 src 192.168.1.1 
    http_access allow manager ext_manager_2
    
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    
    # Always allow localhost connections
    http_access allow localhost
    
    request_body_max_size 0 KB
    reply_body_max_size 0 deny all
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow all
    
    # Custom options
    redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
    redirector_bypass off
    url_rewrite_children 5
    # Setup allowed acls
    # Allow local network(s) on interface(s)
    http_access allow localnet
    # Default block all to be sure
    http_access deny all
    
    


  • Hi wxcv,

    I have a similar issue.  I've installed v2.0.2 on an oldish laptop Dell (D610) with 1GB RAM and 20GB HDD.

    I installed squid, but did not configure it.

    I experience similar symptoms although mine says "out of swap space".  Have you managed to get any closer to the root cause?

    Regards,
    Wikus



  • I could not solve my problem although I spent hours trying to. I tried to uninstall squid and squidguard and noticed that some features stayed in memory when I installed them again. So I tried to uninstall them with CLI directly on the server and all dependencies and conf files. Then I installed the packages again with the GUI and impossible to make Squid start again. So this looked like a complete disaster.  :'(
    I decided to install a completely new pfsense but I may choose to use only the firewall and captive portal and put the proxy on another server (Debian maybe) with Squid and blacklists only. However, as I am a newbie I do not know how I will have to link the firewall and the proxy server.
    For your "swap space problem" I think you can solve it trying to configure cache size, log rotations or things like that, I can't remember exactly. I have the impression (but I am not a specialist) that 20Gb is not big if you enabled logs. I read things about this in tutorials when I was looking for answers to my problems, if I can find them again I will give you the URLs.



  • Thanks very much for your help!  Unfortunately it seems I have other issues with my setup.  Unfortunately I'm also a newbie at this… :-)

    I actually re-installed and started over.  Here is my other problem: http://forum.pfsense.org/index.php/topic,60348.msg324803.html#msg324803



  • Hi,
    I struggled for many days with the same issue. Here is how I succeeded.

    Make sure it is a new install.

    DO NOT INSTALL SQUID.

    Install squidguard. Squidguard seems to install squid components again and breaks squid.

    Now install squid3

    Configure squid, enable captive portal patch and save

    Configure squidguard, save and apply

    Go back to squid and save again.

    Go to Status>Services and start squid then squidguard if not started.

    Configure captive portal.

    Other solutions are offered on-line but none of them were successful for me. Every time I installed squid first squid failed.
    Even removing the packages and re-installing in this order does not work as well.
    I have been able to duplicate this process numerous times. I hope it works for you



  • Thank you. I've just read your message : so strange…
    I will try it but I did not use Squid3 because I had read that it was unstable. I had installed the previous version. Had you tried with the other version before or always with squid3? Was it ok with the previous version too?



  • It works!  ;D
    Thank you sooooooooooooooooooo much!
    I tried so many different and complicated things that I am so disppointed that it was such a detail !
    @ futare
    I do not know if it could help but I found today a very good article here : http://fafadiatech.blogspot.fr/2012/05/build-your-own-unified-threat.html
    It explains how to calculate cach size and many other things.
    Hope you'll find information which will help you.


Locked