Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 3.3.4 package for pfsense with ssl filtering

    Cache/Proxy
    72
    305
    276.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      exograpix
      last edited by

      Is there is any way to run havp with squid-dev package, squid is working ok, but without antivirus, it is bit incomplete, please suggest.

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        IMHO, havp is old and obsolete but if you are not using ssl filtering, you may configure the same way you do on squid2

        I'm working to get antivirus tab working for this -dev version.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • E
          exograpix
          last edited by

          Any alternate antivirus working with ssl filtering.

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @exograpix:

            Any alternate antivirus working with ssl filtering.

            Not yet.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • P
              Pankar
              last edited by

              Hello,

              I have installed 3.3.8-dev and reinstalled lightsquid.

              Problem is that the Proxysquid realtime stat, is either not showing client sessions at all, or, when it does, the list lines remain null and the following warning occurs several times (as many as the sessions):

              gethostbyaddr(): Address is not a valid IPv4 or IPv6 address in /usr/local/www/sqstat/sqstat.class.php on line 426

              Has anyone seen that before?

              Thank you in advance.

              1 Reply Last reply Reply Quote 0
              • C
                ccarreraalza
                last edited by

                I have a question.
                I'm using squid 3.3.8-devel, well, when I go to facebook page shows me the warning I give exception and shows me confirm the facebook page but incompletely, as well as also the paypal page, and this because it is within the site of faccebook or https paypal there are other pages that are to be displayed, but they all come with an X.

                as could validate the certificate on them to the web page or paypal facebook full display?

                thanks

                Google translator, sorry not mastered the English perfectly

                1 Reply Last reply Reply Quote 0
                • T
                  totalimpact
                  last edited by

                  Any tips to getting this working with dansguardian?

                  downloaded all the libs, installed Dans and then squid-dev, checked the boxes under squid to enable transparent mode and https MITM, installed Dans, and selected the same CA/Cert on pf.

                  Can see pages getting proxy'd, but no filtering is happening.

                  1 Reply Last reply Reply Quote 0
                  • M
                    Mozart
                    last edited by

                    Is it possible to update the Squid3-dev package so that I can add a couple of options to the reverse proxy part? I want to disable certain unsafe protocols like sslv2. Here is an example of the line in the config file that I updated:
                    https_port 172.28.252.101:443 accel cert=/usr/pbi/squid-amd64/etc/squid/52038c08be9a9.crt key=/usr/pbi/squid-amd64/etc/squid/52038c08be9a9.key defaultsite=some.site.com vhost options=NO_SSLv2:NO_TLSv1 cipher=ALL:!aNULL:!eNULL:!LOW:!EXP:!ADH:!RC4+RSA:+HIGH:+MEDIUM:!SSLv2

                    I would like it if there would be an option in the GUI to do this. My workaround at the moment is editing the /usr/local/pkg/squid_reverse.inc file on line 85. I added the options there so they will stay in place in case I make an update to the reverse proxy.

                    1 Reply Last reply Reply Quote 0
                    • E
                      exograpix
                      last edited by

                      Any news or timeline or alternative  of antivirus package compatible with squid -dev version.

                      Thanks

                      1 Reply Last reply Reply Quote 0
                      • L
                        leojoe
                        last edited by

                        amd64
                        http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

                        i386
                        http://e-sac.siteseguro.ws/pfsense/8/All/ldd/

                        Hello All, Have tried to open the link above but displays forbidden? Anyone can check whats going on. Cannot start the Squid3 - dev for missing libraries.

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke
                          last edited by

                          @leojoe:

                          amd64
                          http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

                          i386
                          http://e-sac.siteseguro.ws/pfsense/8/All/ldd/

                          Hello All, Have tried to open the link above but displays forbidden? Anyone can check whats going on. Cannot start the Squid3 - dev for missing libraries.

                          I don't have any problems with these links. Try another browser or clear your browser's cache.

                          1 Reply Last reply Reply Quote 0
                          • L
                            leojoe
                            last edited by

                            @Nachtfalke:

                            @leojoe:

                            amd64
                            http://e-sac.siteseguro.ws/pfsense/8/amd64/All/ldd/

                            i386
                            http://e-sac.siteseguro.ws/pfsense/8/All/ldd/

                            Hello All, Have tried to open the link above but displays forbidden? Anyone can check whats going on. Cannot start the Squid3 - dev for missing libraries.

                            I don't have any problems with these links. Try another browser or clear your browser's cache.

                            yeah it's working now.

                            1 Reply Last reply Reply Quote 0
                            • Z
                              ZGruk
                              last edited by

                              I'm having a really weird issue with squid. I've got squid and dansguardian, and I added local authentication to squid.
                              I defined 3 users in the squid GUI, one named admin, and two others.
                              The "admin" user works as intended. It blocks access unless I log in, and once I do, it works fine. None of the other users work.
                              When I try to log in with them, it acts like they don't exist or I put the wrong password in. I thought maybe it was linked somehow to the pfSense user "admin" but

                              A) the squid admin password is different from the pfSense password and
                              B) adding a pfSense user with one of the other names doesn't help.

                              Any idea what could be causing this?

                              Separately, do we know if SSL man-in-the-middle works with dansguardian? Older posts suggest that it doesn't, but I wondered if it had been fixed more recently.

                              1 Reply Last reply Reply Quote 0
                              • W
                                wheelz
                                last edited by

                                I'm seeing some SSL disconnects which are very similar to this bug:  http://bugs.squid-cache.org/show_bug.cgi?id=3659.  However this was supposed to have been resolved some time ago and changing the read_timeout does not fix it.  Any ideas?

                                1 Reply Last reply Reply Quote 0
                                • Z
                                  ZGruk
                                  last edited by

                                  Update to add: I tried adding an "administrator" and an "admin2" account. "administrator" works, "admin2" doesn't. Very strange. Perhaps I should try "administrador" (spanish) or "administrateur" (french) next  :P

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jomcy
                                    last edited by

                                    hi,
                                    i tried to install squid 3.3.5 followed  your document and all went smooth. but not showing in package list. please help me install it.
                                    i just want transparent proxy for dynamic caching nothing more. can you please suggest me a stable proxy version for cache YouTube and other video sites
                                    jomcy

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      duanes
                                      last edited by

                                      Has anyone tried to use the "Time" setting to change squidguard filtering on this version of squid?

                                      I don't know if this is a squid or a squidguard error, but the filters NEVER switch from On-Time to Off-Time and vice-versa…. ie, the "recalc trigger time" event never happens.

                                      This has been a bug for YEARS, but I cannot seem to get any of the code developers interested in looking at the problem.  They all point to a client caching problem, but that is definitely not the case.  Squidguard log shows the redirect every time.

                                      :(
                                      Thanks for listening.

                                      See:
                                      https://forum.pfsense.org/index.php?topic=72251
                                      https://forum.pfsense.org/index.php?topic=59671
                                      https://forum.pfsense.org/index.php/topic,43352.0.html    (nearly 7000 views!)

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        erwintwr
                                        last edited by

                                        Hi guys

                                        I am having a problem using transparent SSL man in the middle, and skype. Skype client connects, but it doesnt seem to complete the process, as no contants come online.

                                        I currently managed  to get transparent Squid3 Dev and Squidguard 3 working with SSL Man in the middle configured with a CA cert generated by the pfsense box - it works beaufitully, especially since this allows squidguard to apply access rules to HTTPS sites, which previously required cumbersome DNS work arounds.)

                                        If i bypass the source IP on the proxy, skype works, and also if i switch off SSL man in the middle it works as well, which both has obvious drawbacks.

                                        Can somebody maybe point me in the right direction as to what could cause this issue? (or what to do to resolve this)
                                        I have not changed any filter rules or added any  NAT on the firewall side ( thus it is stock)

                                        If there is a way to bypass skype traffic from the squid proxy, we can look at that as well

                                        some entries from the squid log is generated below :

                                        1393247653.671    680 192.168.2.11 TCP_MISS/200 394 GET http://conn.skype.com/ - HIER_DIRECT/91.190.216.81 text/html
                                        1393247654.337    640 192.168.2.11 TCP_MISS/200 515 GET http://ui.skype.com/ui/0/6.3.60.105./en/getlatestversion? - HIER_DIRECT/157.56.114.104 text/html
                                        1393247654.403      0 192.168.2.11 NONE/400 3535 CNT 1CON185 - HIER_NONE/- text/html
                                        1393247654.640    700 192.168.2.11 TCP_MISS/200 1290 GET http://api.skype.com/users/adriaan.klopper/profile/avatar - HIER_DIRECT/91.190.216.7 image/jpeg
                                        1393247654.914    259 192.168.2.11 TCP_MISS/200 1290 GET http://api.skype.com/users/alfred.modiba/profile/avatar - HIER_DIRECT/91.190.216.7 image/jpeg
                                        1393247655.256    317 192.168.2.11 TCP_MISS/200 3338 GET http://api.skype.com/users/annelize.smit3/profile/avatar - HIER_DIRECT/91.190.216.7 image/jpeg
                                        1393247655.391      0 192.168.2.11 NONE/400 3535 CNT 2CON185 - HIER_NONE/- text/html
                                        1393247655.522    256 192.168.2.11 TCP_MISS/200 1290 GET http://api.skype.com/users/live:bernardi222/profile/avatar - HIER_DIRECT/91.190.216.7 image/jpeg
                                        1393247663.465      0 192.168.2.11 NONE/400 3535 CNT 3CON185 - HIER_NONE/- text/html
                                        1393247686.127      0 192.168.2.11 NONE_ABORTED/000 0 GET https://forum.pfsense.org/Themes/flagrantly202/images/bbc/bbc_hoverbg.gif - HIER_NONE/- -
                                        1393247710.685      0 192.168.2.11 NONE/400 3535 CNT 4CON185 - HIER_NONE/- text/html

                                        any ideas welcome

                                        thank you guys!

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          serialdie
                                          last edited by

                                          @duanes:

                                          Has anyone tried to use the "Time" setting to change squidguard filtering on this version of squid?

                                          I don't know if this is a squid or a squidguard error, but the filters NEVER switch from On-Time to Off-Time and vice-versa…. ie, the "recalc trigger time" event never happens.

                                          This has been a bug for YEARS, but I cannot seem to get any of the code developers interested in looking at the problem.  They all point to a client caching problem, but that is definitely not the case.  Squidguard log shows the redirect every time.

                                          :(
                                          Thanks for listening.

                                          See:
                                          https://forum.pfsense.org/index.php?topic=72251
                                          https://forum.pfsense.org/index.php?topic=59671
                                          https://forum.pfsense.org/index.php/topic,43352.0.html    (nearly 7000 views!)

                                          I feel your pain.
                                          My work around this was to create a cronjob to HUP squid each off time.

                                          1 Reply Last reply Reply Quote 0
                                          • U
                                            usabug
                                            last edited by

                                            I have the same issue . I cannot find a way to allow skype to work .
                                            I use trasparent proxy for 80/443 with mitm. if someone knows a way hot to get it work please share it with us !!!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post