Upgraded to Squid3-dev, now traffic is being blocked



  • We have been using Squid for some time now, with no issues as a caching server. In an effort to intercept https traffic, we decided to give Squid3-dev a chance. Before even configuring https, we see that http is being blocked. Since we are not intercepting https, we can visit http sites just fine. Please see our configuration below. Does anything seem out of the norm?

    No firewalls rules have changed. Simply an uninstall/install of squid3-dev.

    This file is automatically generated by pfSense

    Do not edit manually !

    http_port 192.168.1.1:3128
    icp_port 0
    dns_v4_first on
    pid_filename /var/run/squid.pid
    cache_effective_user proxy
    cache_effective_group proxy
    error_default_language en
    icon_directory /usr/pbi/squid-i386/etc/squid/icons
    visible_hostname localhost
    cache_mgr admin@localhost
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    netdb_filename /var/squid/logs/netdb.state
    pinger_enable on
    pinger_program /usr/pbi/squid-i386/libexec/squid/pinger

    logfile_rotate 1
    debug_options rotate=1
    shutdown_lifetime 3 seconds

    Allow local network(s) on interface(s)

    acl localnet src  192.168.1.0/24
    httpd_suppress_version_string on
    uri_whitespace strip

    Break HTTP standard for flash videos. Keep them in cache even if asked not to.

    refresh_pattern -i .flv$ 10080 90% 999999 ignore-no-cache override-expire ignore-private

    Let the clients favorite video site through with full caching

    acl youtube dstdomain .youtube.com
    cache allow youtube

    Windows Update refresh_pattern

    range_offset_limit -1
    refresh_pattern -i microsoft.com/..(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
    refresh_pattern -i windowsupdate.com/.
    .(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
    refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims

    Symantec refresh_pattern

    range_offset_limit -1
    refresh_pattern liveupdate.symantecliveupdate.com/..(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
    refresh_pattern symantecliveupdate.com/.
    .(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims

    Avast refresh_pattern

    range_offset_limit -1
    refresh_pattern avast.com/.*.(vpu|cab|stamp|exe) 10080 100% 43200 reload-into-ims

    Avira refresh_pattern

    range_offset_limit -1
    refresh_pattern personal.avira-update.com/.*.(cab|exe|dll|msi|gz) 10080 100% 43200 reload-into-ims

    cache_mem 1000 MB
    maximum_object_size_in_memory 1024 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    cache_dir ufs /var/squid/cache 25000 16 256
    minimum_object_size 0 KB
    maximum_object_size 500000 KB
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    cache allow all

    Add any of your own refresh_pattern entries above these.

    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|?) 0  0%  0
    refresh_pattern .    0  20%  4320

    No redirector configured

    #Remote proxies

    Setup some default acls

    From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.

    acl localhost src 127.0.0.1/32

    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 2083 3128 3127 1025-65535 21-65535
    acl sslports port 443 563 2083 443 563 995

    From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.

    #acl manager proto cache_object

    acl purge method PURGE
    acl connect method CONNECT

    Define protocols used for redirects

    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    acl allowed_subnets src 192.168.1.0/24
    http_access allow manager localhost
     
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports

    Always allow localhost connections

    From 3.2 further configuration cleanups have been done to make things easier and safer.

    The manager, localhost, and to_localhost ACL definitions are now built-in.

    http_access allow localhost

    quick_abort_min -1 KB
    quick_abort_max 0 KB
    request_body_max_size 0 KB
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow allsrc

    Reverse Proxy settings

    Custom options before auth

    Setup allowed acls

    Allow local network(s) on interface(s)

    http_access allow allowed_subnets
    http_access allow localnet

    Default block all to be sure

    http_access deny allsrc



  • What you get on access.log and cache.log?

    Setup looks fine…

    
    ...
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 2083 3128 3127 1025-65535 21-65535
    acl allowed_subnets src 192.168.1.0/24
    http_access allow allowed_subnets
    http_access allow localnet
    
    

Log in to reply