Squid Proxy Transparent + OpenVPN + tcp_outgoing_address possible?

[crissi]

thx, i red the documentation about the templates several times, but to be honest for me are the steps absolute not clear yet..:)

Could you please explain detailed what you did?


Yes, such an important Feature like this, should be already available in the Gui, and not to screw around in the FW Files .. >:(

[crissi]

Tested now further, and did the following @thefunkygibbonwith with your answer in the other post, dont know, if this is correct:

Code Select Expand


cd /usr/local/opnsense/service/templates/OPNsense/Proxy/


Created new File

Code Select Expand


nano customtcpoutgoing.conf


Added to the File tcp_outgoing_address 10.40.x.x

Then edit File +TARGETS File in the same Directory and added there 

Code Select Expand


customtcpoutgoing.conf:/usr/local/etc/squid/squid.conf


saved and restarted Squid

Then afterwards checking squid.conf

Code Select Expand


# tail /usr/local/etc/squid/squid.conf
tcp_outgoing_address 10.40.x.x


So the tcp_outgoing_address 10.40.x.x is set, but all other settings are overwritten...

Do i need to coppy all settings from squid.conf under /usr/local/opnsense/service/templates/OPNsense/Proxy/ to my created customtcpoutgoing.conf + tcp_outgoing_address 10.40.x.x ???

Thx!

[thefunkygibbon]

honestly mate, I don't know any more.  i think we're both at a place where all we need to happen is to know the proper way of "adding" a line of config to the squid config using templates so that it doesn't overwrite all the other config and that it doesn't get lost in an upgrade.

its going to need someone that knows how to do this.  I don't see anything of the like mentioned in the opnsense documentation and I can't make head nor tail of the documentation for that template system.

[crissi]

yes, correct.. the topic here has 1500 Views already, but no one else way in here , and give us the last piece of the puzzle to move forward, this really sucks...

[thefunkygibbon]

just had some time to play again.  looks like the cron job set up to run the script isn't actually running it. can't see anything in my logs either.  ugh... on the verges of giving up

[crissi]

Hi,
same here, cron job isnt running, and nothing in the logs, executing the script manually works fine

Hope someone give us a hint?

[crissi]

temp working solution for me executing the script every minute

Code Select Expand


nano /etc/crontab -e


Code Select Expand


*/1 * * * * root /root/vpnscript.sh


[Amr]

For future references, there's an alternative approach here: https://forum.opnsense.org/index.php?topic=32642.0

[crissi]

Thanks, dont want to install squid on a other pc, to get this working...

I saw that someone else asked to implement this on Github https://github.com/opnsense/core/issues/5868 but the Issue timed out automatically, as now one seemed to pick the task, unfortunately...

[fadern]

Hi,

I'm struggeling with the tcp_outgoing_address parameter, i cant get it to work. I have a working wireguard (road worrior setup) connection and a working squid proxy but when I add the tcp_outgoing_address parameter all the connections through the proxy time out.
Do I need any new routes or fw-rules to get this working?

[irre_levant]

Hi,

i dont know why those old problems are not solved years later ...
anyway.

My OpenVPN Interface cant be selected at the GUI to be a listening Interface at Squid. (newest Version, everything updated)
But it seems like i need to restart the Squid service everytime i added a acl entry.
So instead of going to the cli each time to add the line

Code Select Expand

http_port 10.8.0.1:3128to /usr/local/etc/squid/squid.conf and then do a

/usr/local/sbin/squid -k reconfigure

manually, i now added just once a file /usr/local/etc/squid/pre-auth/10-openvpn.conf and added just one line:

http_port 10.8.0.1:3128

Seems like whenever the service is restarted now by the gui and its rebuilding its config this file is recognized and my openvpn interface is now listening all the time no matter if the service is restarted from the gui.
Just keep in mind that when you reboot the whole opnsense it seems like squid does not rebuild the config so the interface is missing again and the service need to be restarted from the gui once after reboot to make openvpn interface work again.

But as the opnsense will be restarted not that often while the service is restarted often and i do not need the cli anyway now, its the best workaround for me.

Can anybody push the devs to add opensense interfaces at the gui? ;)