Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid3-dev blocks Windows update and other updates

    Scheduled Pinned Locked Moved Cache/Proxy
    28 Posts 17 Posters 18.4k Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A Offline
      aGeekhere
      last edited by

      So i cant use Https inspection with wpad

      wpad is only used to auto configure a non transparent proxy.

      transparent proxy there is no need of configuring wpad

      You cannot have both.

      Never Fear, A Geek is Here!

      1 Reply Last reply Reply Quote 0
      • KOMK Offline
        KOM
        last edited by

        So i cant use Https inspection with wpad ?

        You can't use the HTTPS Interception feature of pfSense because it goes along with Transparent mode.  If you use an explicit proxy (not transparent) and WPAD auto-detection, then you don't need to worry about certs or group policy.  You will still be able to filter HTTPS streams and your users won't get a browser warning.  The only glitch is that some mobiles, specifically Android, don't do WPAD so those users must manually configure the proxy.

        1 Reply Last reply Reply Quote 0
        • S Offline
          S. Kirschner
          last edited by

          The issue with the actual version of squid for pfsense is , that the acl "ssl::server_name" isnt available.

          The available acl dstdomain shouldnt be used for that, because the information that dstdomain tries to compare are encrypted at these moment.

          You could read the description http://lists.squid-cache.org/pipermail/squid-users/2015-July/004429.html

          Another issue with Windows Update is , that Microsoft use self signed certificate that are not signed by VeriSign.
          There would be 2 solutions for the 2nd issue , ignoring cert errors or import the certificate.

          1 Reply Last reply Reply Quote 0
          • R Offline
            ramalave
            last edited by

            Create Aliases Called add WindowsUpdate and the following list for the networking group
            157.54.0.0/15
            157.56.0.0/14
            157.60.0.0/16
            65.52.0.0/14
            70.37.0.0/17
            70.37.128.0/18
            207.46.0.0/16
            131.107.0.0/16
            66.119.144.0/20
            23.96.0.0/13
            204.79.195.0/24
            204.79.196.0/23
            208.76.44.0/22
            208.68.136.0/21
            216.220.208.0/20
            209.240.192.0/19
            204.14.180.0/22
            206.191.224.0/19
            192.92.90.0/24
            208.84.0.0/21
            104.40.0.0/13
            192.197.157.0/24
            204.231.192.0/24
            104.208.0.0/13
            129.75.0.0/16
            204.79.179.0/24
            64.4.0.0/18
            167.220.0.0/17
            167.220.128.0/18
            167.220.192.0/19
            192.92.214.0/24
            207.68.128.0/18
            13.64.0.0/11
            13.96.0.0/13
            13.104.0.0/14
            146.147.0.0/16
            52.145.0.0/16
            52.146.0.0/15
            52.148.0.0/14
            52.152.0.0/13
            52.160.0.0/11
            52.224.0.0/11
            52.96.0.0/12
            52.112.0.0/14
            52.120.0.0/14
            52.125.0.0/16
            52.126.0.0/15
            52.130.0.0/15
            52.132.0.0/14
            52.136.0.0/13
            138.196.0.0/16
            150.171.0.0/16
            40.74.0.0/15
            40.76.0.0/14
            40.80.0.0/12
            40.96.0.0/12
            40.112.0.0/13
            40.120.0.0/14
            40.124.0.0/16
            40.125.0.0/17
            40.64.0.0/13
            40.126.128.0/17
            40.127.0.0/16
            40.126.0.0/18
            204.13.120.0/21
            204.152.18.0/23
            Then you go to Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
            Enter the created alliase called WindowsUpdate
            And this way it fixes all the updates for Windows with Transparent Proxy

            A 1 Reply Last reply Reply Quote 0
            • R Offline
              ramalave
              last edited by

              Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
              157.54.0.0/15
              157.56.0.0/14
              157.60.0.0/16
              65.52.0.0/14
              70.37.0.0/17
              70.37.128.0/18
              207.46.0.0/16
              131.107.0.0/16
              66.119.144.0/20
              23.96.0.0/13
              204.79.195.0/24
              204.79.196.0/23
              208.76.44.0/22
              208.68.136.0/21
              216.220.208.0/20
              209.240.192.0/19
              204.14.180.0/22
              206.191.224.0/19
              192.92.90.0/24
              208.84.0.0/21
              104.40.0.0/13
              192.197.157.0/24
              204.231.192.0/24
              104.208.0.0/13
              129.75.0.0/16
              204.79.179.0/24
              64.4.0.0/18
              167.220.0.0/17
              167.220.128.0/18
              167.220.192.0/19
              192.92.214.0/24
              207.68.128.0/18
              13.64.0.0/11
              13.96.0.0/13
              13.104.0.0/14
              146.147.0.0/16
              52.145.0.0/16
              52.146.0.0/15
              52.148.0.0/14
              52.152.0.0/13
              52.160.0.0/11
              52.224.0.0/11
              52.96.0.0/12
              52.112.0.0/14
              52.120.0.0/14
              52.125.0.0/16
              52.126.0.0/15
              52.130.0.0/15
              52.132.0.0/14
              52.136.0.0/13
              138.196.0.0/16
              150.171.0.0/16
              40.74.0.0/15
              40.76.0.0/14
              40.80.0.0/12
              40.96.0.0/12
              40.112.0.0/13
              40.120.0.0/14
              40.124.0.0/16
              40.125.0.0/17
              40.64.0.0/13
              40.126.128.0/17
              40.127.0.0/16
              40.126.0.0/18
              204.13.120.0/21
              204.152.18.0/23
              Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
              Escrevem os aliases criado chamado WindowsUpdate
              e desta forma você pode atualizar todas as versões do Windows com proxy transparente

              1 Reply Last reply Reply Quote 0
              • R Offline
                ramalave
                last edited by

                Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
                157.54.0.0/15
                157.56.0.0/14
                157.60.0.0/16
                65.52.0.0/14
                70.37.0.0/17
                70.37.128.0/18
                207.46.0.0/16
                131.107.0.0/16
                66.119.144.0/20
                23.96.0.0/13
                204.79.195.0/24
                204.79.196.0/23
                208.76.44.0/22
                208.68.136.0/21
                216.220.208.0/20
                209.240.192.0/19
                204.14.180.0/22
                206.191.224.0/19
                192.92.90.0/24
                208.84.0.0/21
                104.40.0.0/13
                192.197.157.0/24
                204.231.192.0/24
                104.208.0.0/13
                129.75.0.0/16
                204.79.179.0/24
                64.4.0.0/18
                167.220.0.0/17
                167.220.128.0/18
                167.220.192.0/19
                192.92.214.0/24
                207.68.128.0/18
                13.64.0.0/11
                13.96.0.0/13
                13.104.0.0/14
                146.147.0.0/16
                52.145.0.0/16
                52.146.0.0/15
                52.148.0.0/14
                52.152.0.0/13
                52.160.0.0/11
                52.224.0.0/11
                52.96.0.0/12
                52.112.0.0/14
                52.120.0.0/14
                52.125.0.0/16
                52.126.0.0/15
                52.130.0.0/15
                52.132.0.0/14
                52.136.0.0/13
                138.196.0.0/16
                150.171.0.0/16
                40.74.0.0/15
                40.76.0.0/14
                40.80.0.0/12
                40.96.0.0/12
                40.112.0.0/13
                40.120.0.0/14
                40.124.0.0/16
                40.125.0.0/17
                40.64.0.0/13
                40.126.128.0/17
                40.127.0.0/16
                40.126.0.0/18
                204.13.120.0/21
                204.152.18.0/23
                Então você vai Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
                Escrevem os aliases criado chamado WindowsUpdate
                e desta forma você pode atualizar todas as versões do Windows com proxy transparente

                1 Reply Last reply Reply Quote 0
                • B Offline
                  blueadept
                  last edited by

                  ramalave's solution worked fine for me.

                  1 Reply Last reply Reply Quote 0
                  • A Offline
                    AndrewGR @ramalave
                    last edited by

                    @ramalave , thanks for the list of networks. It helped in my case as well with squid in transparent mode.
                    Are there any other solutions available to fix Windows Updates issues when squid works in transparent mode?
                    Thanks!

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.