[請問]pfSense Proxy Transparent proxy問題。

我的 squid.conf 在 /usr/pbi/squid-amd64/etc/squid

# This file is automatically generated by pfSense
# Do not edit manually !

http_port 192.168.2.254:3128
http_port 127.0.0.1:3128 intercept
icp_port 0
dns_v4_first on
pid_filename /var/run/squid/squid.pid
cache_effective_user proxy
cache_effective_group proxy
error_default_language zh-cn
icon_directory /usr/pbi/squid-amd64/local/etc/squid/icons
visible_hostname
cache_mgr
access_log /var/squid/logs/access.log
cache_log /var/squid/logs/cache.log
cache_store_log none
netdb_filename /var/squid/logs/netdb.state
pinger_enable off
pinger_program /usr/pbi/squid-amd64/local/libexec/squid/pinger

logfile_rotate 0
debug_options rotate=0
shutdown_lifetime 3 seconds
# Allow local network(s) on interface(s)
acl localnet src 192.168.2.0/24
forwarded_for on
httpd_suppress_version_string on
uri_whitespace strip

acl dynamic urlpath_regex cgi-bin \?
cache deny dynamic

cache_mem 256 MB
maximum_object_size_in_memory 256 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
maximum_object_size 4 MB
cache_dir ufs /var/squid/cache 512 16 256
offline_mode off
cache_swap_low 90
cache_swap_high 95
cache allow all
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320


#Remote proxies


# Setup some default acls
# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are
now built-in.
# acl localhost src 127.0.0.1/32
acl allsrc src all
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 10443 3128 3127 1025-65535 80 443
acl sslports port 443 563 10443 443

# From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are
now built-in.
#acl manager proto cache_object

acl purge method PURGE
acl connect method CONNECT

# Define protocols used for redirects
acl HTTP proto HTTP
acl HTTPS proto HTTPS
acl allowed_subnets src 192.168.2.0/24
http_access allow manager localhost

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports

# Always allow localhost connections
# From 3.2 further configuration cleanups have been done to make things easier and safer.
# The manager, localhost, and to_localhost ACL definitions are now built-in.
# http_access allow localhost

quick_abort_min 0 KB
quick_abort_max 0 KB
request_body_max_size 0 KB
delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_initial_bucket_level 100
delay_access 1 allow allsrc

# Reverse Proxy settings


# Package Integration
url_rewrite_program /usr/pbi/squidguard-amd64/bin/squidGuard -c /usr/pbi/squidguard-amd64/etc/squidGuard/squidGuard.conf
url_rewrite_bypass off
url_rewrite_children 16 startup=8 idle=4 concurrency=0

# Custom options before auth


acl sglog url_regex -i sgr=ACCESSDENIED
http_access deny sglog
# Setup allowed acls
# Allow local network(s) on interface(s)
http_access allow allowed_subnets
http_access allow localnet
# Default block all to be sure
http_access deny allsrc

icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_preview_enable on
icap_preview_size 1024

icap_service service_avi_req reqmod_precache icap://[::1]:1344/squid_clamav bypass=off
adaptation_access service_avi_req allow all
icap_service service_avi_resp respmod_precache icap://[::1]:1344/squid_clamav bypass=on
adaptation_access service_avi_resp allow all
你的 visible_hostname 要不要馬賽克一下比較好~~


EluSiOn wrote:
我的 squid.conf...(恕刪)
EluSiOn wrote:
然後重新開機讓 pfsense reset 它的 state table....(恕刪)


已重開機,但似乎沒用。無法正常連線到http網站


laims wrote:
http_port 你的LAN_IP:3128


我連沒東西耶,正常應該出現什麼?


底下的資料不知有沒有幫助?
剛剛亂試一下有新發現,不知為何lan的部份會被防火牆擋掉?應該全開,還特別對IP開也沒用

firewall

log
半夜班機飛美國... 一個禮拜後見... 我覺得你可以試試看以我的 squid.conf 為主而去修改... 我設置 squid 跟 squid guard的時候是非常順利的。
EluSiOn wrote:
半夜班機飛美國.....(恕刪)


我設定應該幾乎與大大一致,讓我不解的是為何lan內會去擋?
這應該是我一直不成功的地方...
dophone wrote:
我設定應該幾乎與大大...(恕刪)


你的 lan 是全開的,怎麼還會 block 80?
EluSiOn wrote:
你的 lan 是全...(恕刪)


是的,這就是我不懂的地方,lan那部份還有分in與out

pc端(66.12)到lan端(66.3)沒問題
但是lan端(66.3)到pc端(66.12)則是會被阻擋
麻煩是在這都是default deny,根本無法修改,所以我的transparent proxy很奇怪

節錄filter rule內容供參
----------------
FILTER RULES:
scrub on msk0 all fragment reassemble
scrub on msk1 all fragment reassemble
anchor "relayd/*" all
anchor "openvpn/*" all
anchor "ipsec/*" all
pass in log quick on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
pass out log quick on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
block drop in log quick inet6 all label "Block all IPv6"
block drop out log quick inet6 all label "Block all IPv6"
block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"
block drop in log inet all label "Default deny rule IPv4"
block drop out log inet all label "Default deny rule IPv4"
block drop in log inet6 all label "Default deny rule IPv6"
block drop out log inet6 all label "Default deny rule IPv6"

dophone wrote:
是的,這就是我不懂的...(恕刪)


現在只能用手機看真痛苦

參考這個看看 https://www.youtube.com/watch?v=Lhs6oWZO4s4

EluSiOn wrote:
現在只能用手機看真...(恕刪)


謝謝E大,辛苦惹。

我昨天把硬碟format後重新安裝,也是照youtu影片內容設定
但是不通就是不通沒辦法~怎麼看人家設定的那麼輕鬆?我就困難重重
限制級
您即將進入之討論頁 需滿18歲 方可瀏覽。
提醒:內容可能因過於寫實、驚悚而令人感到不舒服,是否繼續觀看?

根據「電腦網路內容分級處理辦法」修正條文第六條第三款規定,已於該限制級網頁,依台灣網站分級推廣基金會規定作標示。
評分
複製連結