Is this normal? 18.05 GB In on WAN / 8.38 GB Out on LAN

HooKed

Just wondering why my Wan downloaded size is 2x bigger than my Lan output. ???

AMD Athlon 64 X2 Dual Core Processor 4000+
2 CPUs: 1 package(s) x 2 core(s)

Memory Usage 10% of 4043 MB

2.2.4-RELEASE (amd64)
built on Sat Jul 25 19:57:37 CDT 2015

Uptime: 03 Hours 27 Minutes 57 Seconds

KOM

Are you running squid and hitting Windows Update?

HooKed

Yes i am running squid. We have about 50 pc's at my location.

I have followed a few suggestions on disabling squid cache.

As far as i can tell cache is disabled.

NOYB

Any VLAN's involved?

HooKed

No vlans. No Traffic Shapers. Single lan/Subnet. Dual Wan.

Installed Packages:

bandwidthd
Cron
File Manager
freeradius2
Lightsquid
mailreport
ntop
RRD Summary
squid3
squidGuard

Derelict

Isn't there an outstanding FreeBSD bug that doubles interface statistics in certain circumstances?

jahonix

@Derelict:

Isn't there an outstanding FreeBSD bug that doubles interface statistics in certain circumstances?

That's solved since 2.2.3
https://redmine.pfsense.org/issues/3314

Derelict

Cool. Thanks.

NOYB

No VPN's either?

@HooKed:

No vlans. No Traffic Shapers. Single lan/Subnet. Dual Wan.

Installed Packages:

bandwidthd
Cron
File Manager
freeradius2
Lightsquid
mailreport
ntop
RRD Summary
squid3
squidGuard

HooKed

Nope.

A little more info.
A while ago i was downloading a game in origin client. On the WAN side i was downloading @ 140Mbps but nothing was coming from the lan side to my pc. i added a (Do not cache) entry from the FQDN address lvlt.cdn.ea.com that i got from the Traffic Graph and the the game downloaded with no problem.

But yesterday all i saw was that some one here was downloading something from 2 different ips. 68.106.xx.xxx 68.106.xx.xxx only the last set of digits was different. i added a Do not cache entry for the 2 ips and now it seems to be working as it should.

I have searched for ways to disable the squid cache and did what i figured would keep it from using any cache. Is there any was to completely get rid of the cache ability in squid?

Thanks for any info.

HooKed

Ok i think i may have stumbled on to something. I think it was 2 days ago i was having problems getting on a website. I was getting a Server error :

You don't have permission to access / on this server.

Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.

So i connected to a remote pc via rdp and was able to contact them to see if i was banned or something.
They responded with this email:

This is probably due to very strict security settings which are in place to prevent access to the massive amount of spambots who target this website. 
Are you using a proxy by any chance? Those are blocked. If yes, please visit the website from an IP not behind a proxy. 

If you are not using a proxy, let me know and I'll figure out a way to put you on a whitelist so you are able to access the website.

So i started going through the sqid settings and i came across this setting.

Disable VIA If not set, Squid will include a Via header in requests and replies as required by RFC2616\.

So put a check next to it and i was able to get on there site and a few other sites i was having login problems on.

Also i haven't had any problems after changing this setting with inaccurate bandwidth readings.

I'm not saying this fixed it but what a coincidence :)

KOM

I always disable all that stuff without thinking about it. Usually nothing good comes from them knowing you're behind a proxy.