Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Any chance of getting a working transparent proxy again?

    Scheduled Pinned Locked Moved
    Cache/Proxy
    9
    31
    5.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      peter808
      last edited by

      I - like many others - tried to get squid working in transparent mode on both i386- and 64-versions of recent pfense (tried squid 2 and 3). Both fresh installs.

      Followed the pfsense-Howto but it does not work, e.g. clients do not get through the proxy and are not able to get any data throughout port 80.

      If I disable transparent mode and set the clients manually to the proxy, squid works like a charm.

      As I have read here, there had been many complains about that, but the gurus always ended by: no problem here, has to be a user misconfiguration.

      But - as I stated - I also have tried it on two different machines with different hardware (one with i386, one 64bit), no difference, transparent mode does not run.

      Are the gurus working on it?

      1 Reply Last reply Reply Quote 0
      • N
        notaduck
        last edited by

        Can i ask you how i can see if i am using the cache or not?

        i have transparrent mode running with an growing cache? so it seems to work just fine here

        this is my syslog, as a proof ;)

        CPU Usage: 373.371 seconds = 196.398 user + 176.973 sys
Maximum Resident Size: 1744000 KB
Page faults with physical i/o: 0
2015/04/02 14:25:22 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
2015/04/02 14:27:31 kid1| Starting Squid Cache version 3.4.10 for amd64-portbld-freebsd10.1...
        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          I have the same issue. Not working on transparent mode at all….only forwards HTTPS sites.

          So I had to uninstall and let it be...

          1 Reply Last reply Reply Quote 0
          • P
            peter808
            last edited by

            I think it´s just because https uses port 443, not 80, as squid does.

            1 Reply Last reply Reply Quote 0
            • P
              peter808
              last edited by

              @notaduck:

              i have transparrent mode running with an growing cache? so it seems to work just fine here

              Do u see any traffic in the WUI under "real time" in the squid section?

              1 Reply Last reply Reply Quote 0
              • N
                notaduck
                last edited by

                yes  i do ;)

                You have to enable loggig under logging settings.

                1 Reply Last reply Reply Quote 0
                • P
                  peter808
                  last edited by

                  I also had logging enabled.

                  Strange to me how you have gotten transparent mode running without mods.

                  1 Reply Last reply Reply Quote 0
                  • N
                    notaduck
                    last edited by

                    @peter808:

                    I also had logging enabled.

                    Strange to me how you have gotten transparent mode running without mods.

                    This is theexact way i did my squid configuration http://techknight.eu/2015/03/13/pfsense-setup-and-configure-squid3-transparent-proxy/

                    i just had to disable icap and enable loggin :)

                    I hope it helps

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by

                      When using Squid3 then ClamAV is good to have.

                      Can anyone post a working c-icap.conf file??

                      1 Reply Last reply Reply Quote 0
                      • N
                        notaduck
                        last edited by

                        i don't think so :S
                        i have seen so many topics without a solution :S

                        1 Reply Last reply Reply Quote 0
                        • P
                          peter808
                          last edited by

                          @notaduck:

                          This is theexact way i did my squid configuration http://techknight.eu/2015/03/13/pfsense-setup-and-configure-squid3-transparent-proxy/

                          Thanks, but I already knew about that article.

                          Still no working transparent mode here  :'(

                          1 Reply Last reply Reply Quote 0
                          • N
                            notaduck
                            last edited by

                            @peter808:

                            @notaduck:

                            This is theexact way i did my squid configuration http://techknight.eu/2015/03/13/pfsense-setup-and-configure-squid3-transparent-proxy/

                            Thanks, but I already knew about that article.

                            Still no working transparent mode here  :'(

                            hmmmm…. I just don't understand why it shouldn't work for you.
                            can you try to post your squid slog?

                            btw. it annoys me that it isn't working because i am the one who wrote the article -_- and it works just fine for me

                            1 Reply Last reply Reply Quote 0
                            • P
                              peter808
                              last edited by 

                              http_port 172.23.200.1:3128
http_port 127.0.0.1:3128 intercept
icp_port 0
cache_effective_user proxy
cache_effective_group proxy
error_default_language de
icon_directory /usr/pbi/squid-i386/local/etc/squid/icons
visible_hostname firewall
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable on
pinger_program /usr/pbi/squid-i386/local/libexec/squid/pinger

logfile_rotate 14
debug_options rotate=14
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src  172.23.200.0/24
forwarded_for on
uri_whitespace strip

acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic

cache_mem 1024 MB
maximum_object_size_in_memory 32 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir aufs /var/squid/cache 500 16 256
minimum_object_size 0 KB
maximum_object_size 400 KB
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all

# No redirector configured

#Remote proxies

# Setup some default acls
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localh
ost ACL definitions are now built-in.
# acl localhost src 127.0.0.1/32
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3127 1025-65535
acl sslports port 443 563

# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localh
ost ACL definitions are now built-in.
#acl manager proto cache_object

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS
acl allowed_subnets src 172.23.200.0/24
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
# From 3.2 further configuration cleanups have been done to make things easier and safer.
# The manager, localhost, and to_localhost ACL definitions are now built-in.
# http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings

# Custom options before auth

# Setup allowed acls
# Allow local network(s) on interface(s)
http_access allow allowed_subnets
http_access allow localnet
# Default block all to be sure
http_access deny allsrc
                              1 Reply Last reply Reply Quote 0
                              • P
                                peter808
                                last edited by

                                cache.log.0

                                2015/04/06 23:55:45| pinger: Unable to start ICMP pinger.
2015/04/06 23:55:45|  icmp_sock: (1) Operation not permitted
2015/04/06 23:55:45| pinger: Unable to start ICMPv6 pinger.
2015/04/06 23:55:45| FATAL: pinger: Unable to open any ICMP sockets.

                                No entries in access.log in transparent mode.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  messerchmidt
                                  last edited by

                                  working for non https transparent mode

                                  do a fresh install of 2.2.1 @ x64

                                  install squid3 and squidguard dev

                                  create the necessary wdap files as per https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

                                  use urlresolver instead of dhcp forwarder in 2.2.1! - same idea and setup

                                  using the file manager and editor

                                  create a /cache directiory and set it to 30gb or so in squid 3

                                  configure squidguard

                                  start squid 3 and put on transparent mode

                                  do not sue the antivirus atm as it gives icamp errors

                                  you may want to use the service watch to retreat squid3 if it stops,etc

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tester_02
                                    last edited by

                                    I played around quite a bit and held off upgrading from 2.1.5 until just this week.  I've tried many times and always had to roll back to 2.1.5
                                    vmware workstation environment, 64bit pfsense.
                                    Uninstalled squid/squidguard.  Then ran the update.
                                    install squid 3
                                    install squidguard development (could never get the main version running).
                                    download blacklist.
                                    enable clamav in squid.  Then disable it.
                                    re-download blacklist.

                                    Seems to work now.  The main issue now is that after a reboot, everything crashes and fails to restart.
                                    Fix is to enable then disable clamav in squid.  Then re-download blacklist and it stays up and running.

                                    Definitely not good, but at least it's working.  Nowhere near as stable as when we were on 2.1.5 (or any previous version for that matter back to 1.2)

                                    Not pushing my luck on https proxy until this part is better.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      peter808
                                      last edited by

                                      @messerchmidt:

                                      working for non https transparent mode

                                      do a fresh install of 2.2.1 @ x64

                                      install squid3 and squidguard dev

                                      With squidguard dev installed and starting, squid now always crashes:

                                      Apr 7 07:53:07	squid[60452]: Squid Parent: (squid-1) process 69996 will not be restarted due to repeated, frequent failures
Apr 7 07:53:07	squid[60452]: Squid Parent: (squid-1) process 69996 exited with status 1
Apr 7 07:53:07	(squid-1): The redirector helpers are crashing too rapidly, need help!
Apr 7 07:53:06	squid[60452]: Squid Parent: (squid-1) process 69996 started

                                      @messerchmidt:

                                      create the necessary wdap files as per https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

                                      The howto you mentioned says: "To use squid authentication, squid cannot be used in transparent mode. "

                                      The rest you suggested does not seem to be related to the transparent proxy-problem, I guess, but thanks though.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        peter808
                                        last edited by

                                        @tester_02:

                                        I played around quite a bit and held off upgrading from 2.1.5 until just this week.  I've tried many times and always had to roll back to 2.1.5
                                        vmware workstation environment, 64bit pfsense.
                                        Uninstalled squid/squidguard.  Then ran the update.

                                        Did I get you right that squid transparent mode only seems to be running on pfsense 2.15?

                                        So what did you mean with "ran the upgrade"? You upgraded to the recent 2.2 after all, anyway?

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          notaduck
                                          last edited by

                                          Well i have it running on 2.2.1
                                          have you disabled icmp?

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            peter808
                                            last edited by

                                            yep.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post