OPNsense Forum

English Forums => Web Proxy Filtering and Caching => Topic started by: errored out on January 14, 2021, 11:22:17 PM

Title: Proxy-Subnets- Can someone verify if they have an allowed subnets error?
Post by: errored out on January 14, 2021, 11:22:17 PM
Under Services>Web Proxy> Administration>Forward Proxy
When I.P.s are entered in "unrestricted IP addresses" everything works fine.

The problem is with "Allowed subnets".  When entering a subnet and not listing I.P. addresses, any IP within that segment is blocked.

Examples:
1)Allowed subnet = 192.168.7.0/24
Unrestrcited IP addresses = None
I.P. 192.168.7.55 is being blocked.

2)Allowed subnet = 192.168.7.0/24
Unrestrcited IP addresses = 192.168.7.12 
I.P. 192.168.7.12 connects.
IP 192.168.7.55 is blocked.

Can someone test this please?  Looking for confirmation this is not an individual issue.
Title: Re: Proxy-Subnets- Can someone verify if they have an allowed subnets error?
Post by: Amr on January 18, 2021, 08:08:25 AM
Dear errored out,
QuoteWhen entering a subnet and not listing I.P. addresses, any IP within that segment is blocked.
what kind of error do you get?, do you get squid access denied page?
from your description, I believe what you lack is to configure proxy Access controls list.
Allowed subnet: is the subnet that's allowed to talk to the proxy.
Unrestricted IP addresses: the ip address that is allowed to surf anything.
whitelist: sites that are allowed for everyone in the subnet
blacklist: sites that are denied for everyone in the subnet
Title: Re: Proxy-Subnets- Can someone verify if they have an allowed subnets error?
Post by: errored out on February 02, 2021, 11:21:33 AM
I am not receiving any error message.  The connection times out as if blocked / no Internet access. 

I also understand what you are saying, however the notations on the config page for Allowed subnet (full help ticked) states:
Type subnets you want to allow access to the proxy server.
and for Unrestricted IP addresses:
Type IP addresses you want to allow access to the proxy server.

So using this, I wanted to shift from using specific I.P.s to subnets.  Also, I am not using any white/black lists, any other ACL types. 
Title: Re: Proxy-Subnets- Can someone verify if they have an allowed subnets error?
Post by: errored out on February 17, 2021, 05:21:32 AM
Anyone else run into this?