Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid+SquidGuard Startado e não Bloqueia Nada.

    Portuguese
    3
    13
    2.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wesleycorrea
      last edited by

      Bom dia Pessoal,

      Não sei  oque ocorreu mas preciso de ajuda, Meu SQUID +SQUIDGUARD startado e não bloqueia nada. ja stopei e startei e nada.

      segue Prints e configurações.

      This file is automatically generated by pfSense

      Do not edit manually !

      http_port 192.168.0.2:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/usr/pbi/squid-

      amd64/etc/squid/serverkey.pem capath=/usr/pbi/squid-amd64/share/certs/

      http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB

      cert=/usr/pbi/squid-amd64/etc/squid/serverkey.pem capath=/usr/pbi/squid-amd64/share/certs/

      https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB

      cert=/usr/pbi/squid-amd64/etc/squid/serverkey.pem capath=/usr/pbi/squid-amd64/share/certs/

      icp_port 0
      dns_v4_first on
      pid_filename /var/run/squid.pid
      cache_effective_user proxy
      cache_effective_group proxy
      error_default_language pt-br
      icon_directory /usr/pbi/squid-amd64/etc/squid/icons
      visible_hostname localhost
      cache_mgr admin@localhost
      access_log /var/squid/logs/access.log
      cache_log /var/squid/logs/cache.log
      cache_store_log none
      netdb_filename /var/squid/logs/netdb.state
      pinger_enable on
      pinger_program /usr/pbi/squid-amd64/libexec/squid/pinger
      sslcrtd_program /usr/pbi/squid-amd64/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
      sslcrtd_children 5
      sslproxy_capath /usr/pbi/squid-amd64/share/certs/
      sslproxy_cert_error allow all
      sslproxy_cert_adapt setValidBefore all

      logfile_rotate 90
      debug_options rotate=90
      shutdown_lifetime 3 seconds

      Allow local network(s) on interface(s)

      acl localnet src  192.168.0.0/24
      forwarded_for off
      httpd_suppress_version_string on
      uri_whitespace strip

      acl dynamic urlpath_regex cgi-bin ?
      cache deny dynamic

      cache_mem 1024 MB
      maximum_object_size_in_memory 64 KB
      memory_replacement_policy heap GDSF
      cache_replacement_policy heap LFUDA
      cache_dir ufs /var/squid/cache 4096 16 256
      minimum_object_size 0 KB
      maximum_object_size 90000 KB
      offline_mode off
      cache_swap_low 90
      cache_swap_high 95
      acl donotcache dstdomain '/var/squid/acl/donotcache.acl'
      cache deny donotcache
      cache allow all

      No redirector configured

      #Remote proxies

      Setup some default acls

      From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and

      to_localhost ACL definitions are now built-in.

      acl localhost src 127.0.0.1/32

      acl allsrc src all
      acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3127 1025-65535 53 443 8088 8080
      acl sslports port 443 563  443 563

      From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and

      to_localhost ACL definitions are now built-in.
      #acl manager proto cache_object

      acl purge method PURGE
      acl connect method CONNECT

      Define protocols used for redirects

      acl HTTP proto HTTP
      acl HTTPS proto HTTPS
      acl allowed_subnets src 192.168.0.0/24
      acl banned_hosts src '/var/squid/acl/banned_hosts.acl'
      acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'
      acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl'
      acl block_reply_mime_type rep_mime_type -i '/var/squid/acl/block_reply_mime_type.acl'
      http_access allow manager localhost

      http_access deny manager
      http_access allow purge localhost
      http_access deny purge
      http_access deny !safeports
      http_access deny CONNECT !sslports

      Always allow localhost connections

      From 3.2 further configuration cleanups have been done to make things easier and safer.

      The manager, localhost, and to_localhost ACL definitions are now built-in.

      http_access allow localhost

      request_body_max_size 0 KB
      delay_pools 1
      delay_class 1 2
      delay_parameters 1 -1/-1 -1/-1
      delay_initial_bucket_level 100
      delay_access 1 allow allsrc

      Reverse Proxy settings

      always_direct allow whitelist
      ssl_bump none whitelist

      Package Integration

      url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-

      amd64/etc/squidGuard/squidGuard.conf
      url_rewrite_bypass off
      url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-

      amd64/etc/squidGuard/squidGuard.conf
      url_rewrite_bypass off
      url_rewrite_children 16 startup=8 idle=4 concurrency=0

      Custom options before auth

      always_direct allow all
      ssl_bump server-first all

      These hosts are banned

      http_access deny banned_hosts

      Always allow access to whitelist domains

      http_access allow whitelist

      Block access to blacklist domains

      http_access deny blacklist

      Block access with mime type in the reply

      http_reply_access deny block_reply_mime_type
      acl sglog url_regex -i sgr=ACCESSDENIED
      http_access deny sglog

      Setup allowed acls

      Allow local network(s) on interface(s)

      http_access allow allowed_subnets
      http_access allow localnet

      Default block all to be sure

      http_access deny allsrc

      ![Proxy Monitor.PNG](/public/imported_attachments/1/Proxy Monitor.PNG)
      ![Proxy Monitor.PNG_thumb](/public/imported_attachments/1/Proxy Monitor.PNG_thumb)
      ![Service Status.PNG](/public/imported_attachments/1/Service Status.PNG)
      ![Service Status.PNG_thumb](/public/imported_attachments/1/Service Status.PNG_thumb)

      1 Reply Last reply Reply Quote 0
      • M
        mateus0032
        last edited by

        Amigo como esta as confis do squidguard… e de suas regras de lan...

        1 Reply Last reply Reply Quote 0
        • W
          wesleycorrea
          last edited by

          Pessoal na segunda eu fiz um squidguard-fix

          –- squidguard_configurator.inc.orig
          +++ squidguard_configurator.inc
          @@ -94,3 +94,3 @@
          -define('REDIRECTOR_OPTIONS_REM',  '# squidGuard options');
          -define('REDIRECTOR_PROGRAM_OPT',  'redirect_program');
          -define('REDIRECT_BYPASS_OPT',      'redirector_bypass');
          +define('REDIRECTOR_OPTIONS_REM',  '# squidGuard options');
          +define('REDIRECTOR_PROGRAM_OPT',  'url_rewrite_program');
          +define('REDIRECT_BYPASS_OPT',      'url_rewrite_bypass');
          @@ -98,1 +98,1 @@
          -define('REDIRECTOR_PROCESS_COUNT', '5'); # redirector processes count will started
          +define('REDIRECTOR_PROCESS_COUNT', '16 startup=8 idle=4 concurrency=0'); # redirector processes count will started

          Mas veio funcionando normal, apliquei e rebootei testei e tudo mais será que foi isso!

          veja arquivo de configuração esta repetido.

          always_direct allow whitelist
          ssl_bump none whitelist

          Package Integration

          url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-

          amd64/etc/squidGuard/squidGuard.conf
          url_rewrite_bypass off
          url_rewrite_program /usr/pbi/squidguard-squid3-amd64/bin/squidGuard -c /usr/pbi/squidguard-squid3-

          amd64/etc/squidGuard/squidGuard.conf
          url_rewrite_bypass off
          url_rewrite_children 16 startup=8 idle=4 concurrency=0

          1 Reply Last reply Reply Quote 0
          • W
            wesleycorrea
            last edited by

            Matheus0032

            Até fiz conforme sua explicação e um outro POST.

            1 Reply Last reply Reply Quote 0
            • W
              wesleycorrea
              last edited by

              Pessoal, vou voltar meu BACKUP agora as 13:00

              :( >:( >:( >:( >:(

              1 Reply Last reply Reply Quote 0
              • A
                alexandre.augusto.sousa
                last edited by

                Foi baixado uma blacklist e bloqueado as categorias?

                1 Reply Last reply Reply Quote 0
                • W
                  wesleycorrea
                  last edited by

                  Foi sim, tudo funcionando a 4 meses.

                  1 Reply Last reply Reply Quote 0
                  • A
                    alexandre.augusto.sousa
                    last edited by

                    Nas maquinas, colocou o proxy certo?

                    Porque na configuração básica, você instala, instala uma blacklist, bloqueia as categorias, e em seguida coloca o proxy no browser das maquinas.

                    1 Reply Last reply Reply Quote 0
                    • W
                      wesleycorrea
                      last edited by

                      Meu é TRANSPARENT+SSL

                      1 Reply Last reply Reply Quote 0
                      • A
                        alexandre.augusto.sousa
                        last edited by

                        Quando o proxy é transparente, ele só não pede usuário e senha para navegar, porem para ele navegar com as regras, você precisa apontar no navegador o IP do firewall, pois ele é a blacklist e filtra os sites.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wesleycorrea
                          last edited by

                          Nunca precisei colocar nada para navegar e sempre pegou todas minhas regras, seja SQUID e SQUIDGUARD

                          1 Reply Last reply Reply Quote 0
                          • A
                            alexandre.augusto.sousa
                            last edited by

                            Vou ver se acho alguma coisa para ajudar, mas quando eu fiz aqui no meu pfsense, precisei colocar o proxy no browser.

                            1 Reply Last reply Reply Quote 0
                            • W
                              wesleycorrea
                              last edited by

                              Proxy Transparente Preciso informar as configurações de IP e porta nos Navegadores?

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post