Pfsense, alias and subdomains needed

kranzfr3d

hello folks,

this is my first post and i have have trouble configuring this, so hopefully i had hit the right forum for my question:

my goal is an proxy-server without caching functionalty, something like a (surf-)gateway only.
this makes sense, because i want to block all outbound except some internet sites, two of them need https!
so squid is wrong for my configuration, right?

my configuration works, but no subdomains are working :(
for example:
working:
http://domain.org
http://www.domain.org/someurl
https://domain.org
https://www.domain.org/someurl

not working:
http://subdomain.domain.org
https://subdomain.domain.org

this is my configuration:
i installed a new "clean" pfsense, latest version
under Firewall–> Alias: i configured as alias (hosts) something like "www.domain.org" (without ""), description named here "destinationALIAS"
under Firewall--> Rules--> LAN:
i deactivated the standard ipv4 and ipv6 rules
i created a new rule:
Action: Pass
interface: LAN
protocol: any
source: any
port: any
destination: single host or alias - name choosen "destinationALIAS"

but why i cannot use subdomains? they are blocked....
i prefer to use as alias "*.domain.org" or "*domain.org", but its rejected.

if you need detailed informations i can them deliver tomorrow, but please help me out... thanks!
is there a simple way to get subdomains working?

gr33z

edit: configuration specified

podilarius

I use


.*domain.org

in my ACLs. This takes care of any domain and subdomain.
How are you blocking or allowing secure http (https)?

kranzfr3d

Hello podilarius,

thanks for your reply!

In your ACL? Do you mean a configuration with squid? i dont want to use squid :(
I got secure http (https) not to work with squid…so i dont want to block it.

I tried to use your pattern ".*domain.org" (without "") as Alias (Firewall --> Alias) as Host - but it isn't accepted, too :(
Error:
The following input errors were detected:

.*domain.org is not a valid host alias.

gr33z

podilarius

Yes. I was talking about squid config. Wildcards are not permitted in FW rules or Aliases to my knowledge. Firewall rules must resolve to something. As far as I know only the proxy software is smart enough for that. You might be able to use snort, but I have not messed with that in a long time.

kranzfr3d

Hello again,

ok, so if i'm using squid3x, then https-sites are not working - can you give me hints for that, please?

gr33z

podilarius

according to the proxy config, you can use a man-in-the-middle approach. It requires that you setup a WPAD/PAC in DNS or DHCP. This is new to me, but reading up on it looks promising. I am using my proxy only as a way to control site my girls should not be seeing. They can get to https sites though. This might be a way to circumvent that limitation.
Please post if you have any success, if you use it.