Squid transparente + Squidguard + windows update

[Aleximper]

Buenos días

Tengo la siguiente configuración de proxy

"# This file is automatically generated by pfSense

Do not edit manually !

This file is automatically generated by pfSense

Do not edit manually !

http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=60MB cert=/usr/pbi/squid-amd64/local/c/squid/serverkey.pem capath=/usr/pbi/squid-amd64/local/share/certs/

http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=60MB cert=/usr/pbi/squid-amd6local/etc/squid/serverkey.pem capath=/usr/pbi/squid-amd64/local/share/certs/

https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=60MB cert=/usr/pbi/squid-amd/local/etc/squid/serverkey.pem capath=/usr/pbi/squid-amd64/local/share/certs/

icp_port 0
dns_v4_first on
pid_filename /var/run/squid/squid.pid
cache_effective_user proxy
cache_effective_group proxy
error_default_language es-co
icon_directory /usr/pbi/squid-amd64/local/etc/squid/icons
visible_hostname
cache_mgr
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable on
pinger_program /usr/pbi/squid-amd64/local/libexec/squid/pinger
sslcrtd_program /usr/pbi/squid-amd64/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
sslcrtd_children 30
sslproxy_capath /usr/pbi/squid-amd64/local/share/certs/
sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_adapt setValidAfter all

logfile_rotate 30
debug_options rotate=30
shutdown_lifetime 3 seconds

Allow local network(s) on interface(s)

acl localnet src  192.168.1.0/24
forwarded_for on
httpd_suppress_version_string on
uri_whitespace strip

Windows Update refresh_pattern

range_offset_limit -1
refresh_pattern -i microsoft.com/..(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
refresh_pattern -i windowsupdate.com/..(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims
refresh_pattern -i windows.com/.*.(cab|exe|ms[i|u|f]|asf|wm[v|a]|dat|zip) 4320 80% 43200 reload-into-ims

cache_mem 3000 MB
maximum_object_size_in_memory 512000 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir aufs /var/squid/cache 10000 16 256
minimum_object_size 0 KB
maximum_object_size 512000 KB
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all

Add any of your own refresh_pattern entries above these.

refresh_pattern ^ftp:    1440  20%  10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|?) 0  0%  0
refresh_pattern .    0  20%  4320

No redirector configured

#Remote proxies

Setup some default acls

From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost L definitions are now built-in.

acl localhost src 127.0.0.1/32

acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8443 3128 3127 1025-65535
acl sslports port 443 563 8443 10443

From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost L definitions are now built-in.

#acl manager proto cache_object

acl purge method PURGE
acl connect method CONNECT

Define protocols used for redirects

acl HTTP proto HTTP
acl HTTPS proto HTTPS
acl allowed_subnets src 192.168.1.0/24 192.168.2.0/24 192.168.4.0/24
acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

Always allow localhost connections

From 3.2 further configuration cleanups have been done to make things easier and safer.

The manager, localhost, and to_localhost ACL definitions are now built-in.

http_access allow localhost

request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

Reverse Proxy settings

deny_info TCP_RESET allsrc

always_direct allow whitelist
ssl_bump none whitelist

Package Integration

url_rewrite_program /usr/pbi/squidguard-amd64/bin/squidGuard -c /usr/pbi/squidguard-amd64/etc/squidGuard/squidGuard.conf
url_rewrite_bypass off
url_rewrite_children 16 startup=8 idle=4 concurrency=0

Custom options before auth

always_direct allow all
ssl_bump server-first all

Always allow access to whitelist domains

http_access allow whitelist
acl sglog url_regex -i sgr=ACCESSDENIED
http_access deny sglog
always_direct allow all
ssl_bump server-first all

Setup allowed acls

Allow local network(s) on interface(s)

http_access allow allowed_subnets
http_access allow localnet

Default block all to be sure

http_access deny allsrc

"

Sin embargo windows update no me funciona en ningun equipo, error: 80072F8F

Agregue en ACL white list, todas las direcciones de microsoft y windows update.  No tengo WSUS y no puedo montarlo por ahora

Ayuda urgente.

[Aleximper]

Buen día

Sigue sin funcionar, aun asi desactive dynamic cache, con las acl whitelist, windows update no funciona, ya no se que hacer, necesito ayuda urgenteeeee

[chavarriaa]

Te aconsejo que dejes en lugar de transparentar proxy utilices WPAD. Así te olvidas los problemas que dan el proxy transparente.
Yo tengo configurado mi pfsense con WPAD y no tengo nada de problemas con ninguna actualización

[Aleximper]

Buenos días colegas

buscando bastante, encontré la manera de lograr que funcione windows update, lo que hice fue un script, el cual se debe ejecutar en cada equipo  de la red, dicho script hecho en bloc de notas y convertido a .bat es netsh winhttp set proxy proxy-server="ip-servidor-proxy" bypass-list="*.dominio.com", despues de eso ya funciona :)

Ojo esto solo aplica para proxy transparente.

[Aleximper]

Buenos días

El script solo funciono una vez y en 1 solo equipo, de resto ni mas, y el problema es que no puedo usar proxy explicito por los clientes vpn que esa empresa maneja.

[ramalave]

Crea Aliases llamado WindowsUpdate y agregas la siguiente lista de grupo de redes
157.54.0.0/15
157.56.0.0/14
157.60.0.0/16
65.52.0.0/14
70.37.0.0/17
70.37.128.0/18
207.46.0.0/16
131.107.0.0/16
66.119.144.0/20
23.96.0.0/13
204.79.195.0/24
204.79.196.0/23
208.76.44.0/22
208.68.136.0/21
216.220.208.0/20
209.240.192.0/19
204.14.180.0/22
206.191.224.0/19
192.92.90.0/24
208.84.0.0/21
104.40.0.0/13
192.197.157.0/24
204.231.192.0/24
104.208.0.0/13
129.75.0.0/16
204.79.179.0/24
64.4.0.0/18
167.220.0.0/17
167.220.128.0/18
167.220.192.0/19
192.92.214.0/24
207.68.128.0/18
13.64.0.0/11
13.96.0.0/13
13.104.0.0/14
146.147.0.0/16
52.145.0.0/16
52.146.0.0/15
52.148.0.0/14
52.152.0.0/13
52.160.0.0/11
52.224.0.0/11
52.96.0.0/12
52.112.0.0/14
52.120.0.0/14
52.125.0.0/16
52.126.0.0/15
52.130.0.0/15
52.132.0.0/14
52.136.0.0/13
138.196.0.0/16
150.171.0.0/16
40.74.0.0/15
40.76.0.0/14
40.80.0.0/12
40.96.0.0/12
40.112.0.0/13
40.120.0.0/14
40.124.0.0/16
40.125.0.0/17
40.64.0.0/13
40.126.128.0/17
40.127.0.0/16
40.126.0.0/18
204.13.120.0/21
204.152.18.0/23
Luego te diriges a Services –-> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
Escribes el alliase creado llamado WindowsUpdate
Y de esta manera puedes actualizar todas las distribuciones de Windows con Proxy Transparente