Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid3-dev blocks Windows update and other updates

    Cache/Proxy
    17
    28
    17.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      MIT
      last edited by

      Pfsense 2.1.3 32-bit
      Ram 4 GB
      HDD 128 GB SSD
      CPU AMD Athlon 3400+ 64-bit
      1 Wan
      1 Lan

      Packages:
      pfBlocker 1.0.2
      Squid3-dev 3.3.10 pkg 2.2.2

      SSL and Squidclam are enabled on a Transparent proxy. I can browse to SSL sites without a problem.

      I am having trouble getting Squid to allow Windows Update (Win 7) and others like JAVA to connect to the MS/Oracle/etc. update server and pull the update.  The error I get in the Windows Update window is 80072F8F.

      If I bypass the proxy for the computer I want to update, then the update works without complaining.

      I have tried changing the Remote Cert Checks and Certificate Adapt options, but no combination fixes this.
      I also have the Dynamic Content Caching enabled for Windows Update.

      Can someone provide some ideas to get Squid3 to allow Windows Update (etc.) to work?  Thanks!

      1 Reply Last reply Reply Quote 0
      • W
        wcrowder
        last edited by

        The following needs to be in your squid.conf file, not sure how to add it via the GUI. You may need to add other sites to bypass SSLbump also.

        | acl broken_sites dstdomain .update.microsoft.com

        ssl_bump none broken_sites |

        1 Reply Last reply Reply Quote 0
        • A
          agixdota
          last edited by

          excuse me sir, solved this prob? :)

          1 Reply Last reply Reply Quote 0
          • M
            marian78
            last edited by

            try that, not working for me. Maybe missing some more domains….

            pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              maybe this will help for the domain list?

              https://technet.microsoft.com/en-us/library/bb693717.aspx

              1 Reply Last reply Reply Quote 0
              • M
                marian78
                last edited by

                thx sir, but i dont know how set this type of domain: *.update.microsoft.com

                In squid i needed strictly setup all domain or it can use * ?

                pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

                1 Reply Last reply Reply Quote 0
                • cwagzC
                  cwagz
                  last edited by

                  I have not been able to get this to work either for Windows update.  I did get minecraft working with this method.  Is it possible to use Windows update with HTTPS transparent proxy?

                  Netgate 6100 MAX

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Squid wildcard is a . instead of *

                    If you try it on acls, just try to remove * and keep .update.microsoft.com

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • M
                      marian78
                      last edited by

                      thx sir, i try that, hope that will work.  ;)

                      pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

                      1 Reply Last reply Reply Quote 0
                      • A
                        ayman
                        last edited by

                        Hello,

                        Windows update is not working with me too, below what i have for windows update

                        acl windowsupdate dstdomain windowsupdate.microsoft.com
                        acl windowsupdate dstdomain update.microsoft.com
                        acl windowsupdate dstdomain download.windowsupdate.com
                        acl windowsupdate dstdomain redir.metaservices.microsoft.com
                        acl windowsupdate dstdomain images.metaservices.microsoft.com
                        acl windowsupdate dstdomain c.microsoft.com
                        acl windowsupdate dstdomain www.download.windowsupdate.com
                        acl windowsupdate dstdomain wustat.windows.com
                        acl windowsupdate dstdomain crl.microsoft.com
                        acl windowsupdate dstdomain sls.microsoft.com
                        acl windowsupdate dstdomain productactivation.one.microsoft.com
                        acl windowsupdate dstdomain ntservicepack.microsoft.com
                        acl windowsupdate dstdomain watson.microsoft.com

                        acl CONNECT method CONNECT
                        acl wuCONNECT dstdomain update.microsoft.com

                        http_access allow CONNECT wuCONNECT localnet
                        http_access allow CONNECT wuCONNECT localhost
                        http_access allow windowsupdate localnet
                        http_access allow windowsupdate localhost

                        but i still get error 80072f8f while trying to update.

                        access.log:

                        1422878282.386    76 192.168.1.58 TCP_MISS/200 391 HEAD http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
                        1422878282.521    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
                        1422878283.051    76 192.168.1.124 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
                        1422878286.460    76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream

                        I have squid3-dev with squidGuard 3 installed

                        I have more than 70 pcs and i have to fix this urgently, any clue ?

                        Thanks

                        Ayman

                        1 Reply Last reply Reply Quote 0
                        • V
                          vinbot
                          last edited by

                          I generated a tcpdump when this was happening and poked around the contents.  I found the URL fe2.update.microsoft.com

                          I added that URL AND windowsupdate.microsoft.com to my squid.conf (with ssl_bump none as well for each) it seems to be updating now

                          Hope it helps.

                          ~Vinbot

                          1 Reply Last reply Reply Quote 0
                          • KOMK
                            KOM
                            last edited by

                            acl windowsupdate dstdomain windowsupdate.microsoft.com
                            acl windowsupdate dstdomain update.microsoft.com
                            acl windowsupdate dstdomain download.windowsupdate.com
                            …

                            Could you not just use .microsoft.com, .windowsupdate.com and .windows.com to replace all of that?

                            I've played with Squid3 dynamic caching with Windows Update and I always ended up in a situation where it would download the entire file for every segment it's trying to download.  100 MB of patches required downloading many gigabytes of data, as each segment request would cause the entire file to be downloaded again and again.  My traffic graph would show my WAN being fully saturated for an hour or more and hardly anything coming in to LAN from Squid.

                            I have more than 70 pcs and i have to fix this urgently, any clue ?

                            For that many users, why not run WSUS?

                            1 Reply Last reply Reply Quote 0
                            • F
                              Firzze
                              last edited by

                              Hi, :)
                              So with ssl filtering, windows update does not want to do this. There in there a manipulation to do to solve this problem.
                              Sorry for my bad english  ;D

                              1 Reply Last reply Reply Quote 0
                              • A
                                Abhishek
                                last edited by

                                I am also facing same issue as reported by poster , if any one have solution to this kindly update this thread ,if i bypass source Ip from proxy server settings i am able to update

                                2.3-RC (amd64)
                                built on Mon Apr 04 17:09:32 CDT 2016
                                FreeBSD 10.3-RELEASE
                                Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                darkstat 3.1.2_1
                                Lightsquid 3.0.3_1
                                mailreport 3.0_1
                                pfBlockerNG 2.0.9_1  
                                RRD_Summary 1.3.1_2
                                snort 3.2.9.1_9  
                                squid 0.4.16_1  
                                squidGuard 1.14_1
                                syslog-ng 1.1.2_2

                                1 Reply Last reply Reply Quote 0
                                • A
                                  aGeekhere
                                  last edited by

                                  This was a main reason why I switch to a wpad.

                                  Never Fear, A Geek is Here!

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    Abhishek
                                    last edited by

                                    @aGeekHere:

                                    This was a main reason why I switch to a wpad.

                                    So are you telling moving from transparent proxy to non transparent proxy will fix my issue ?

                                    2.3-RC (amd64)
                                    built on Mon Apr 04 17:09:32 CDT 2016
                                    FreeBSD 10.3-RELEASE
                                    Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                    darkstat 3.1.2_1
                                    Lightsquid 3.0.3_1
                                    mailreport 3.0_1
                                    pfBlockerNG 2.0.9_1  
                                    RRD_Summary 1.3.1_2
                                    snort 3.2.9.1_9  
                                    squid 0.4.16_1  
                                    squidGuard 1.14_1
                                    syslog-ng 1.1.2_2

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aGeekhere
                                      last edited by

                                      I could not get windows updates to work through HTTPS/SSL interception, and dealing with the CA were a pain.

                                      Windows updates using wpad with squid proxy works.

                                      Never Fear, A Geek is Here!

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        Abhishek
                                        last edited by

                                        so u disabled Https interception ?    i have no issue deploying cert since i am using AD gpmc

                                        2.3-RC (amd64)
                                        built on Mon Apr 04 17:09:32 CDT 2016
                                        FreeBSD 10.3-RELEASE
                                        Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                        darkstat 3.1.2_1
                                        Lightsquid 3.0.3_1
                                        mailreport 3.0_1
                                        pfBlockerNG 2.0.9_1  
                                        RRD_Summary 1.3.1_2
                                        snort 3.2.9.1_9  
                                        squid 0.4.16_1  
                                        squidGuard 1.14_1
                                        syslog-ng 1.1.2_2

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          aGeekhere
                                          last edited by

                                          You first have to decide if you want to use a transparent proxy or non transparent proxy with wpad

                                          If you want to try using non transparent proxy with wpad here are a few links
                                          https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
                                          https://forum.pfsense.org/index.php?topic=93060.0

                                          Note: non transparent proxy with wpad you disable HTTPS/SSL interception and Transparent HTTP proxy.

                                          Let me know if you get stuck

                                          Never Fear, A Geek is Here!

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            Abhishek
                                            last edited by

                                            So i cant use Https inspection with wpad ?  As far as i understood wpad is a method of delivering proxy server info such as IP address and port number so we don't need to manually configure all client PC's proxy serttings manually in Non Transparent proxy case

                                            IF using transparent proxy there is no need of configuring wpad

                                            2.3-RC (amd64)
                                            built on Mon Apr 04 17:09:32 CDT 2016
                                            FreeBSD 10.3-RELEASE
                                            Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                            darkstat 3.1.2_1
                                            Lightsquid 3.0.3_1
                                            mailreport 3.0_1
                                            pfBlockerNG 2.0.9_1  
                                            RRD_Summary 1.3.1_2
                                            snort 3.2.9.1_9  
                                            squid 0.4.16_1  
                                            squidGuard 1.14_1
                                            syslog-ng 1.1.2_2

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.