Squid 3.3.4 package for pfsense with ssl filtering

ipis

I hope all missing libs are included soon. I really wan't to block certain secured sites on my work. And I think this version is amazing.

Does anyone has a workaround in fetching libs?

Nachtfalke

@ipis:

I hope all missing libs are included soon. I really wan't to block certain secured sites on my work. And I think this version is amazing.

Does anyone has a workaround in fetching libs?

Just try with this command:

cd /usr/local/lib

and in this folder:


fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libasn1.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libgssapi.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libheimntlm.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libhx509.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libkrb5.so.10
fetch http://e-sac.siteseguro.ws/pfsense/8/All/ldd/libroken.so.10

Perhaps you have to check the file permissions after you copied the files.

Or download the libs via your webbrowser and copy these files to pfsense using the GUI:
DIAGNOSTICS –> Command Prompt

ipis

Thanks Nachtfalke

How stupid i'am. I a'm using the word "ALL" instead of "All" plus. I erase all my config to squid, I uncheked everything before re-fetching. Thanks again :)

ipis

Hi. Its already working fine but I've noticed that the other browser like google chrome. I've noticed that it wont trust the certificate when entering into secured sites. It says the Certificate is not trusted and theres no option for the user to continue and accept it. Unlike to other browser theres an optio to get the certificate and continue to the website. Or to trust the cerficate.. Is this normal, or theres a way to overcome this? Thanks

marcelloc

@ipis:

Is this normal, or theres a way to overcome this? Thanks

Yes, to avoid these erros, play with squid cert options and include pfsense CA as a trusted CA on each browsers. This way you will not get any ssl error for https sites.

Services that use same ssl port(tor, ultrasurf) will always fail.

ipis

Thanks marcelloc. I've fixed the certificated error. also I re-enabled the transparent ssl and it helps :)

ipis

Hi, I have a question. I just visited a government agency website, its an organization that handles employers contribution. or employees contribution. Ive noticed that after accepting the certificate and continuing to website. The website did not respond and it says webpage not avalable. According to other forums ubuntu to be exact, theres a site that sometimes block this kind of interception, i mean we will not be availbe to continue that's why they added some code.

Can we adopt their code to our pfsense? I think their added it in squid.conf

marcelloc

@ipis:

Can we adopt their code to our pfsense? I think their added it in squid.conf

If you find what code is it, I can add to squid.conf.

ipis

Hi marcerlloc, check this pic that ive uploaded

1.jpg_thumb

2.jpg_thumb

ipis

Hi, marcelloc i successfully entered that website. But this website www.sss.gov.ph
prevents my network

marcelloc

These pics shows stardard ssl squid configuration.

ipis

You mean it doesn't have something to do with the website? Maybe I mis configured. On the other hand, I've noticed something when connecting to facebook. It seems like the page is broken, I couldn't see the pictures and other posts. I've tried to disable my squid guard and let the squid3-dev handle the internet, but the outcome is the same. But when i tried not to proxy the internet, only using the direct firewall rules on lan, the page seems fixed. Is there a workaround on this?

marcelloc

Can you test on firefox with firebug extension enabled on network tab?

ipis

I don't have that firebug option in my firefox. By the way I also tried this on my other browser but still no luck

ipis

Also when I put the source ip, it bypassess the squidguard, and the website seems fixed also..

ipis

I'm thinking of Using Version 3.3.4, maybe I won't have that kind of issue on fb, is that possible?

marcelloc

@ipis:

I don't have that firebug option in my firefox.

It's a firefox extension/plugin. Just install it and enable.

ipis

Hi i just install the plugin but it doesn't fixed the issue, but i think the issue is came from ssl filtering, because when I disable the ssl filtering, and restart the pfsense. It returned to normal, and when I get back on using ssl filtering the site is broken again. Did I did something wrong? I set my ssl listening port to 3129, while my squid port is in 3128, both are set to LAN interface. Also i set my safe ports to 80, 443 and acl ports to 443 only.

Can you give me other config options? How can i used port 3128 on both squid port and ssl port man in the middle. can we do the tunneling?

marcelloc

@ipis:

Hi i just install the plugin but it doesn't fixed the issue.

This plugin is usefull to debug the problem, not to fix ssl issues.

Enable it, select net tab and access the site with ssl enabled.

This way you will see all connections and check what is going fine and whats is failing.

bb.com.br.png
bb.com.br.png_thumb

ipis

Ok I will try that in my work on tuesday. Today is holiday in my country. Nways last time I also noticed that disbling or unchecking the "Allow users on the interface" and providing network subnet on acl tab will cause the ssl filterng not to work. Automatically squidguard will stop.

I Also tried disabling squidguard, and tried to filter the secured site in proxy server alone by putting its domain name in blacklist field on acl tab, example: youtube.com, but it fails. Seems like ssl is not filtering because i can still go to the site.

Another thing can you please teach me how will I install squid dev package using shell? Because i want to edit squid.conf manually. What I wan't to do temporaryly while we are fixing this error is to disable ssl filtering by default and enable it only on sp
ecific website along with specific ip address. This way i can block the access to specific people only and let the other employees access it without errors. Sounds good idea i guess. Thanks in advance!