Routing one website from particular ISP

oldhat

Thanks for your reply. It really looks like the best solution but will I be able to block urls of same website using squidguard "Regular Expression" feature. For example: allow google.com and excluded from squidguard but disallow google.com/mail/ using mail keyword in regular expression?

Thanks in advance.

chris4916

One way to achieve it is to maintain, within your proxy.pac file (in case you are using WPAD or have configured proxy.pac URL on each browser) the relevant "no proxy for" statement.

oldhat

Dear doktornotor,

Thanks for showing the way so far. I have been able to route traffic to the websites as required by bypassing from squid but one last part of this is to block certain url based on keyword which I was able to do using squidguard but not working anymore. Please suggest a solution for this. I will be thankful to you.

Thanks in advance.

oldhat

Dear chris4916,

Thanks for your reply. I am a complete beginner. Do you have any article on what you have written to read and to try on my end. I am not able to understand much out of it. However, I am using transparent proxy.

Thanks in advance.

doktornotor

@oldhat:

Thanks for showing the way so far. I have been able to route traffic to the websites as required by bypassing from squid but one last part of this is to block certain url based on keyword which I was able to do using squidguard but not working anymore. Please suggest a solution for this.

Policy routing does not give a damn about keywords or URL. Only destination IPs/ports are relevant. So no, I have no solution for this "problem".

chris4916

@oldhat:

Thanks for your reply. I am a complete beginner. Do you have any article on what you have written to read and to try on my end. I am not able to understand much out of it. However, I am using transparent proxy.

No I don't have any pointer to such implementation based on transparent proxy.
As I definitely not push for such transparent proxy stuff which, in my opinion, brings much more drawbacks than added value, I do not investigate in this direction. Never 8)

Furthermore, I don't understand how you could achieve it easily because, proxy being transparent, you can't write any external "no proxy for" rule (this would be meaningless) and because all requests are transparently intercepted at proxy level, from pfSense viewpoint, all requests are issued from pfSense itself (local service) therefore, bypass, by default policy rules.

oldhat

Dear doktornotor, Thanks for your support so far. Atleast I can start using it. Thanks once again. :)

Dear chris4916,

Thanks for your message. I can stop using transparent proxy if it can serve the purpose. I need to route traffic to certain secure sites through a particular gateway and block few pages of that website based on keywords. I have been able to block url using regular expressions of squidguard but not able to send traffic via particular gateway. If I add that website to squid bypass then I am able to select a particular gateway but I loose the capability of blocking certain pages of the website.

I hope I have been able to clear my situation. Any help will be appreciated.

Thanks in advance.

chris4916

Can't you try to achieve it running explicit proxy elsewhere (meaning no as pfSense located service) ?

oldhat

Dear chris4916,

Thanks for your reply. I dont have more hardware but I can try for a Virtual Machine if it can serve the purpose. Can you please throw more light as how keeping squid and squidguard as separate can help in achieving it?

Thanks in advance.

chris4916

1 - Deny access to internet through your firewall except from proxy
2 - configure your proxy
3 - set up WPAD so that clients easily point to your proxy

With such design, you can configure policy routing that will apply and also benefit from proxy (squidguard) filtering.

BTW, from architecture standpoint, this design is better than services running on pfSense.