Pf blocks Squid listening port

[Wallachia]

Hello,

I have recently installed OPNSense on PC with 1 NIC (configured as LAN) with the goal to set it up as web proxy. I have configured Squid as non-transparent proxy with default port (3128) bound to LAN interface, but I can not connect to it from LAN - nothing is listening on port 3128 (nMap  and telnet). Weird thing is, when I go to CLI and enter netstat -a -n | egrep 'Proto|LISTEN', there is Squid process listening:

Code: [Select]

tcp4       0      0 10.116.44.195.3128     *.*                    LISTENIf I stop pf from CLI and restart Squid, I now can connect to port 3128 and everything works just fine (browser connects to proxy and goes to Internet). Firewall settings are all default ("allow all to all"), I have tried to explicitly permit access to and from Squid port, but to no avail.
I suspect I'm doing some rookie mistake, but I can't understand where. Can the community help me?

[echo_123]

Hi Wallachia,

apparently you have to create a firewall to allow the LAN clients to access the SQUID Proxy on default port 3128.

Action: Pass
Interface: LAN
Direction: in
TCP/IP Version: IPv4
Source: LAN net
Destination: This Firewall
Dest Port Range: 3128 - 3128
Category/Description: HTTP Proxy Access

That's how I made it work. Cheers

[PaddyMac]

I'm having this same problem on a fresh install of 20.7. I'm trying to implement echo_123's solution, but the destination port setting is greyed out so that I can't change it. I tried setting up a firewall rule with every other setting as suggested, and that didn't help. It works fine without any additional setup on pfSense, so this seems to be a bug in OPNsense.

[lfirewall1243]

I'm having this same problem on a fresh install of 20.7. I'm trying to implement echo_123's solution, but the destination port setting is greyed out so that I can't change it. I tried setting up a firewall rule with every other setting as suggested, and that didn't help. It works fine without any additional setup on pfSense, so this seems to be a bug in OPNsense.

I think you need to choose a Protocol at the top of the Rule Options. When you choose "Protocol:ANY" you cant change the Destination Port