Squid3-dev blocks Windows update and other updates



  • Pfsense 2.1.3 32-bit
    Ram 4 GB
    HDD 128 GB SSD
    CPU AMD Athlon 3400+ 64-bit
    1 Wan
    1 Lan

    Packages:
    pfBlocker 1.0.2
    Squid3-dev 3.3.10 pkg 2.2.2

    SSL and Squidclam are enabled on a Transparent proxy. I can browse to SSL sites without a problem.

    I am having trouble getting Squid to allow Windows Update (Win 7) and others like JAVA to connect to the MS/Oracle/etc. update server and pull the update.  The error I get in the Windows Update window is 80072F8F.

    If I bypass the proxy for the computer I want to update, then the update works without complaining.

    I have tried changing the Remote Cert Checks and Certificate Adapt options, but no combination fixes this.
    I also have the Dynamic Content Caching enabled for Windows Update.

    Can someone provide some ideas to get Squid3 to allow Windows Update (etc.) to work?  Thanks!



  • The following needs to be in your squid.conf file, not sure how to add it via the GUI. You may need to add other sites to bypass SSLbump also.

    | acl broken_sites dstdomain .update.microsoft.com

    ssl_bump none broken_sites |



  • excuse me sir, solved this prob? :)



  • try that, not working for me. Maybe missing some more domains….



  • maybe this will help for the domain list?

    https://technet.microsoft.com/en-us/library/bb693717.aspx



  • thx sir, but i dont know how set this type of domain: *.update.microsoft.com

    In squid i needed strictly setup all domain or it can use * ?



  • I have not been able to get this to work either for Windows update.  I did get minecraft working with this method.  Is it possible to use Windows update with HTTPS transparent proxy?



  • Squid wildcard is a . instead of *

    If you try it on acls, just try to remove * and keep .update.microsoft.com



  • thx sir, i try that, hope that will work.  ;)



  • Hello,

    Windows update is not working with me too, below what i have for windows update

    acl windowsupdate dstdomain windowsupdate.microsoft.com
    acl windowsupdate dstdomain update.microsoft.com
    acl windowsupdate dstdomain download.windowsupdate.com
    acl windowsupdate dstdomain redir.metaservices.microsoft.com
    acl windowsupdate dstdomain images.metaservices.microsoft.com
    acl windowsupdate dstdomain c.microsoft.com
    acl windowsupdate dstdomain www.download.windowsupdate.com
    acl windowsupdate dstdomain wustat.windows.com
    acl windowsupdate dstdomain crl.microsoft.com
    acl windowsupdate dstdomain sls.microsoft.com
    acl windowsupdate dstdomain productactivation.one.microsoft.com
    acl windowsupdate dstdomain ntservicepack.microsoft.com
    acl windowsupdate dstdomain watson.microsoft.com

    acl CONNECT method CONNECT
    acl wuCONNECT dstdomain update.microsoft.com

    http_access allow CONNECT wuCONNECT localnet
    http_access allow CONNECT wuCONNECT localhost
    http_access allow windowsupdate localnet
    http_access allow windowsupdate localhost

    but i still get error 80072f8f while trying to update.

    access.log:

    1422878282.386    76 192.168.1.58 TCP_MISS/200 391 HEAD http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
    1422878282.521    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
    1422878283.051    76 192.168.1.124 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
    1422878286.460    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream

    I have squid3-dev with squidGuard 3 installed

    I have more than 70 pcs and i have to fix this urgently, any clue ?

    Thanks

    Ayman



  • I generated a tcpdump when this was happening and poked around the contents.  I found the URL fe2.update.microsoft.com

    I added that URL AND windowsupdate.microsoft.com to my squid.conf (with ssl_bump none as well for each) it seems to be updating now

    Hope it helps.

    ~Vinbot



  • acl windowsupdate dstdomain windowsupdate.microsoft.com
    acl windowsupdate dstdomain update.microsoft.com
    acl windowsupdate dstdomain download.windowsupdate.com

    Could you not just use .microsoft.com, .windowsupdate.com and .windows.com to replace all of that?

    I've played with Squid3 dynamic caching with Windows Update and I always ended up in a situation where it would download the entire file for every segment it's trying to download.  100 MB of patches required downloading many gigabytes of data, as each segment request would cause the entire file to be downloaded again and again.  My traffic graph would show my WAN being fully saturated for an hour or more and hardly anything coming in to LAN from Squid.

    I have more than 70 pcs and i have to fix this urgently, any clue ?

    For that many users, why not run WSUS?



  • Hi, :)
    So with ssl filtering, windows update does not want to do this. There in there a manipulation to do to solve this problem.
    Sorry for my bad english  ;D



  • I am also facing same issue as reported by poster , if any one have solution to this kindly update this thread ,if i bypass source Ip from proxy server settings i am able to update



  • This was a main reason why I switch to a wpad.



  • @aGeekHere:

    This was a main reason why I switch to a wpad.

    So are you telling moving from transparent proxy to non transparent proxy will fix my issue ?



  • I could not get windows updates to work through HTTPS/SSL interception, and dealing with the CA were a pain.

    Windows updates using wpad with squid proxy works.



  • so u disabled Https interception ?    i have no issue deploying cert since i am using AD gpmc



  • You first have to decide if you want to use a transparent proxy or non transparent proxy with wpad

    If you want to try using non transparent proxy with wpad here are a few links
    https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
    https://forum.pfsense.org/index.php?topic=93060.0

    Note: non transparent proxy with wpad you disable HTTPS/SSL interception and Transparent HTTP proxy.

    Let me know if you get stuck



  • So i cant use Https inspection with wpad ?  As far as i understood wpad is a method of delivering proxy server info such as IP address and port number so we don't need to manually configure all client PC's proxy serttings manually in Non Transparent proxy case

    IF using transparent proxy there is no need of configuring wpad



  • So i cant use Https inspection with wpad

    wpad is only used to auto configure a non transparent proxy.

    transparent proxy there is no need of configuring wpad

    You cannot have both.



  • So i cant use Https inspection with wpad ?

    You can't use the HTTPS Interception feature of pfSense because it goes along with Transparent mode.  If you use an explicit proxy (not transparent) and WPAD auto-detection, then you don't need to worry about certs or group policy.  You will still be able to filter HTTPS streams and your users won't get a browser warning.  The only glitch is that some mobiles, specifically Android, don't do WPAD so those users must manually configure the proxy.



  • The issue with the actual version of squid for pfsense is , that the acl "ssl::server_name" isnt available.

    The available acl dstdomain shouldnt be used for that, because the information that dstdomain tries to compare are encrypted at these moment.

    You could read the description http://lists.squid-cache.org/pipermail/squid-users/2015-July/004429.html

    Another issue with Windows Update is , that Microsoft use self signed certificate that are not signed by VeriSign.
    There would be 2 solutions for the 2nd issue , ignoring cert errors or import the certificate.



  • Create Aliases Called add WindowsUpdate and the following list for the networking group
    157.54.0.0/15
    157.56.0.0/14
    157.60.0.0/16
    65.52.0.0/14
    70.37.0.0/17
    70.37.128.0/18
    207.46.0.0/16
    131.107.0.0/16
    66.119.144.0/20
    23.96.0.0/13
    204.79.195.0/24
    204.79.196.0/23
    208.76.44.0/22
    208.68.136.0/21
    216.220.208.0/20
    209.240.192.0/19
    204.14.180.0/22
    206.191.224.0/19
    192.92.90.0/24
    208.84.0.0/21
    104.40.0.0/13
    192.197.157.0/24
    204.231.192.0/24
    104.208.0.0/13
    129.75.0.0/16
    204.79.179.0/24
    64.4.0.0/18
    167.220.0.0/17
    167.220.128.0/18
    167.220.192.0/19
    192.92.214.0/24
    207.68.128.0/18
    13.64.0.0/11
    13.96.0.0/13
    13.104.0.0/14
    146.147.0.0/16
    52.145.0.0/16
    52.146.0.0/15
    52.148.0.0/14
    52.152.0.0/13
    52.160.0.0/11
    52.224.0.0/11
    52.96.0.0/12
    52.112.0.0/14
    52.120.0.0/14
    52.125.0.0/16
    52.126.0.0/15
    52.130.0.0/15
    52.132.0.0/14
    52.136.0.0/13
    138.196.0.0/16
    150.171.0.0/16
    40.74.0.0/15
    40.76.0.0/14
    40.80.0.0/12
    40.96.0.0/12
    40.112.0.0/13
    40.120.0.0/14
    40.124.0.0/16
    40.125.0.0/17
    40.64.0.0/13
    40.126.128.0/17
    40.127.0.0/16
    40.126.0.0/18
    204.13.120.0/21
    204.152.18.0/23
    Then you go to Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
    Enter the created alliase called WindowsUpdate
    And this way it fixes all the updates for Windows with Transparent Proxy



  • Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
    157.54.0.0/15
    157.56.0.0/14
    157.60.0.0/16
    65.52.0.0/14
    70.37.0.0/17
    70.37.128.0/18
    207.46.0.0/16
    131.107.0.0/16
    66.119.144.0/20
    23.96.0.0/13
    204.79.195.0/24
    204.79.196.0/23
    208.76.44.0/22
    208.68.136.0/21
    216.220.208.0/20
    209.240.192.0/19
    204.14.180.0/22
    206.191.224.0/19
    192.92.90.0/24
    208.84.0.0/21
    104.40.0.0/13
    192.197.157.0/24
    204.231.192.0/24
    104.208.0.0/13
    129.75.0.0/16
    204.79.179.0/24
    64.4.0.0/18
    167.220.0.0/17
    167.220.128.0/18
    167.220.192.0/19
    192.92.214.0/24
    207.68.128.0/18
    13.64.0.0/11
    13.96.0.0/13
    13.104.0.0/14
    146.147.0.0/16
    52.145.0.0/16
    52.146.0.0/15
    52.148.0.0/14
    52.152.0.0/13
    52.160.0.0/11
    52.224.0.0/11
    52.96.0.0/12
    52.112.0.0/14
    52.120.0.0/14
    52.125.0.0/16
    52.126.0.0/15
    52.130.0.0/15
    52.132.0.0/14
    52.136.0.0/13
    138.196.0.0/16
    150.171.0.0/16
    40.74.0.0/15
    40.76.0.0/14
    40.80.0.0/12
    40.96.0.0/12
    40.112.0.0/13
    40.120.0.0/14
    40.124.0.0/16
    40.125.0.0/17
    40.64.0.0/13
    40.126.128.0/17
    40.127.0.0/16
    40.126.0.0/18
    204.13.120.0/21
    204.152.18.0/23
    Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
    Escrevem os aliases criado chamado WindowsUpdate
    e desta forma você pode atualizar todas as versões do Windows com proxy transparente



  • Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
    157.54.0.0/15
    157.56.0.0/14
    157.60.0.0/16
    65.52.0.0/14
    70.37.0.0/17
    70.37.128.0/18
    207.46.0.0/16
    131.107.0.0/16
    66.119.144.0/20
    23.96.0.0/13
    204.79.195.0/24
    204.79.196.0/23
    208.76.44.0/22
    208.68.136.0/21
    216.220.208.0/20
    209.240.192.0/19
    204.14.180.0/22
    206.191.224.0/19
    192.92.90.0/24
    208.84.0.0/21
    104.40.0.0/13
    192.197.157.0/24
    204.231.192.0/24
    104.208.0.0/13
    129.75.0.0/16
    204.79.179.0/24
    64.4.0.0/18
    167.220.0.0/17
    167.220.128.0/18
    167.220.192.0/19
    192.92.214.0/24
    207.68.128.0/18
    13.64.0.0/11
    13.96.0.0/13
    13.104.0.0/14
    146.147.0.0/16
    52.145.0.0/16
    52.146.0.0/15
    52.148.0.0/14
    52.152.0.0/13
    52.160.0.0/11
    52.224.0.0/11
    52.96.0.0/12
    52.112.0.0/14
    52.120.0.0/14
    52.125.0.0/16
    52.126.0.0/15
    52.130.0.0/15
    52.132.0.0/14
    52.136.0.0/13
    138.196.0.0/16
    150.171.0.0/16
    40.74.0.0/15
    40.76.0.0/14
    40.80.0.0/12
    40.96.0.0/12
    40.112.0.0/13
    40.120.0.0/14
    40.124.0.0/16
    40.125.0.0/17
    40.64.0.0/13
    40.126.128.0/17
    40.127.0.0/16
    40.126.0.0/18
    204.13.120.0/21
    204.152.18.0/23
    Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
    Escrevem os aliases criado chamado WindowsUpdate
    e desta forma você pode atualizar todas as versões do Windows com proxy transparente



  • ramalave's solution worked fine for me.



  • @ramalave , thanks for the list of networks. It helped in my case as well with squid in transparent mode.
    Are there any other solutions available to fix Windows Updates issues when squid works in transparent mode?
    Thanks!


Log in to reply