Messages

1

Web Proxy Filtering and Caching / Re: "SSL no bump sites" doesn't work for Win Updates

« on: October 14, 2019, 11:42:29 pm »

thank you for the screenshots!
according to https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus I would need to put some wildcard entries  for you it worked without that?

2

Web Proxy Filtering and Caching / Re: "SSL no bump sites" doesn't work for Win Updates

« on: September 27, 2019, 04:59:23 pm »

Ok that would at least be a work around. Could you provide a screenshot of how you did it?

BR,
NR

3

Web Proxy Filtering and Caching / "SSL no bump sites" doesn't work for Win Updates

« on: September 21, 2019, 03:25:02 pm »

Hi,

Goal
Get Windows Updates working over transparent HTTPS Squid Proxy.

Problem
Some entries in the "SSL no bump sites" list seem to be inactive.

Version
19.7.4_1

Description
For example, one of the sites used for windows updates seems to be settings-win.data.microsoft.com. No matter what I tried, I could not get this site to not be intercepted. The reason I know it is not intercepted is because I can see the full path in the logs. I tried the following no-bump configurations:

.microsoft.com -> Log shows https://settings-win.data.microsoft.com/settings/v2.0/WSD/WaaSAssessment? is being accessed.

settings-win.data.microsoft.com -> Log shows https://settings-win.data.microsoft.com/settings/v2.0/FlightSettings/FSService? is being accessed.

.data.microsoft.com -> Log shows https://settings-win.data.microsoft.com/settings/v2.0/wsd/muse? is being accessed.


So does it work at all? Yes it does. For example with a bank site:

.db.com -> Log shows 160.83.8.143:443 is being accessed. No path visible which means no-bump entry works.
Removed the .db.com entry again -> Log shows https://www.db.com/company/img/favicon.ico is being accessed.

In between I checked the content of the config file, looked good to me:

Code: [Select]

# less /usr/local/etc/squid/nobumpsites.acl
.data.microsoft.com
.db.com
Any hints will be greatly appreciated.

BR,
NR

4

Web Proxy Filtering and Caching / Re: New setup (newbie) issue with Web filter & internet access

« on: September 21, 2019, 02:34:15 pm »

Hi,

yes, transparent means the client doesn't see any configuration for this. In order to do this you would need:
1. a NAT rule which redirects your web traffic to your proxy (for example redirect port 80 to 3128)
2. a firewall rule which allows your client to connect to your transparent port (for example 3128)

Please post your rule setup.

Edit: also check this https://docs.opnsense.org/manual/how-tos/proxytransparent.html

BR,
NR

5

19.7 Legacy Series / Re: Gateway monitor missing after update

« on: September 21, 2019, 02:17:29 pm »

Thank you for the info and the awesome work! Upgrade went well

Cheers,
NR

6

19.7 Legacy Series / Re: Gateway monitor missing after update

« on: September 13, 2019, 06:28:27 pm »

Hi there,

has the upgrade path already been changed or is there another way to directly go to the latest release?

Cheers,
NR

7

19.1 Legacy Series / Re: Proxy not sending data to Syslog

« on: April 30, 2019, 06:15:39 pm »

If you raise a ticket I can take a closer look.

https://github.com/opnsense/core/issues/new/choose

Ticket created! https://github.com/opnsense/core/issues/3454

I'll be happy to provide more configs or log files if you need them. Thanks a lot for looking into this.

Cheers,
NR

8

19.1 Legacy Series / Re: Proxy not sending data to Syslog

« on: April 28, 2019, 06:29:35 pm »

Works for me: logs are redirected to Services: Captive Portal: Log File. I'm not sure why but that's what it is.

And you can forward "Portal Auth events" remotely then (System: Settings: Logging).


Cheers,
Franco

Hi guys,
sorry I'm probably misunderstanding something obvious here. But does this mean in order to get the squid logs into my syslog server I need to activate the Captive Portal (which I'm not using)?
I can see the squid logs in the captive portal page and "Portal Auth events" forwarding is activated, but I don't get those logs at my syslog server.

Thank you and good start into the week,
NR

9

Web Proxy Filtering and Caching / Re: Squid access log over syslog

« on: December 16, 2018, 03:20:05 pm »

Did you find out how?
I am in the exact same situation. External logging works, but no Webproxy logs.

10

18.1 Legacy Series / Re: 18.1.4: Remote Access lists not downloading

« on: March 21, 2018, 12:03:22 am »

Hi

Maybe also try to click on Download ACLs, then wait until the traffic vanishes and only then click apply. If downloaded correctly, you should be able to see the list in:
/usr/local/etc/squid/acl

Regards

11

Web Proxy Filtering and Caching / Re: Squid blocking self-signed webinterface certificate ?

« on: March 20, 2018, 10:43:14 pm »

Code: [Select]

openssl s_client -connect routerIP:443
output:

Code: [Select]

....
Verify return code: 18 (self signed certificate)
....
According to this source I tried the following: https://www.madboa.com/geek/openssl/#verify-system

Code: [Select]

mkdir /etc/ssl/certs
cd /usr/local/share/certs/
openssl s_client -showcerts -connect routerIP:443 < /dev/null | openssl x509 -outform PEM > router.pem
openssl x509 -noout -hash -in router.pem
output:
12345678 (8-digit hash of the cert)

Code: [Select]

ln -s /usr/local/share/certs/router.pem /etc/ssl/certs/12345678.0
openssl s_client -connect routerIP:443
output:

Code: [Select]

...
Verify return code: 0 (ok)
...
So my understanding is that now openssl trusts my router-certificate but when I try via proxy, I still cannot connect and get the same original error in the browser. Any hints?

12

Web Proxy Filtering and Caching / Re: Squid caching deleted webinterface certificate ?

« on: March 18, 2018, 05:58:46 pm »

you mean "local" to the client? yes that's already the case, public HTTPS sites are intercepted just fine.

I only have this problem with admin-webpages in the LAN (also for the router interface as I just found out).

13

18.1 Legacy Series / Re: 18.1.4: Remote Access lists not downloading

« on: March 18, 2018, 04:49:03 pm »

I just checked shallalist and it updated correctly for me a few days ago.

If I remember correctly one had to apply the list first once, in order for the categories to become available. Have you tried to apply the list once without any categories?

Cheers

14

Web Proxy Filtering and Caching / Re: Squid caching deleted webinterface certificate ?

« on: March 18, 2018, 12:41:34 pm »

Okay so this means I can either place a valid server certificate for all admin-webinterfaces in my LAN (which I don't really want as there are quite a few) or I can make squid trust these certificates. How can I do the latter?

15

Web Proxy Filtering and Caching / Re: Squid caching deleted webinterface certificate ?

« on: March 18, 2018, 01:10:54 am »

Could you please move my thread to the "Web Proxy Filtering" chapter if it is placed wrong here.

Shouldn't an entry in the "SSL no bump site" be enough in order to not get any warnings about self-signed certificates?