Unter Pfsense gibt es die Möglichkeit unter "Before Auth" (siehe auch squid.conf) ACLS zu definieren um das Windows Update Problem bei Clients zu umgehen.Unter Pfsense gibt man das in das Feld "Before Auth" und die Windows Updates werden ohne Problem über die Windows interne Update-Funktion gefunden und installiert.acl DiscoverSNIHost at_step SslBump1acl NoSSLIntercept ssl::server_name_regex microsoft.com acl NoSSLIntercept ssl::server_name_regex .microsoft.com acl NoSSLIntercept ssl::server_name_regex windowsupdate.comacl NoSSLIntercept ssl::server_name_regex .windowsupdate.comacl NoSSLIntercept ssl::server_name_regex update.microsoft.com.akadns.netssl_bump splice NoSSLInterceptssl_bump peek DiscoverSNIHostssl_bump bump allacl BrokenButTrustedServers dstdomain download.microsoft.comacl BrokenButTrustedServers dstdomain update.microsoft.comacl BrokenButTrustedServers dstdomain update.microsoft.com.akadns.netacl BrokenButTrustedServers dstdomain update.microsoft.com.nsatc.netacl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCHsslproxy_cert_error allow BrokenButTrustedServers DomainMismatchsslproxy_cert_error deny allOriginal Squid Wiki zum Thema:https://wiki.squid-cache.org/SquidFaq/WindowsUpdateund hier der Link zu pfsense Lösung:https://forum.pfsense.org/index.php?topic=135351.0Kennt hier jemand eine Lösung und könnte seinen Lösungsansatz hier möglichst genau beschreiben.Das wäre wirklich von Vorteil für viele die OPNsense verwenden.Vielen Dank!
To pass WU check through Squid splice, you only need to splice next MS servers:update.microsoft.comupdate.microsoft.com.akadns.net For use in real setups, write file url.nobump:# WU (Squid 3.5.x and above with SSL Bump)# Only this sites must be spliced.update\.microsoft\.comupdate\.microsoft\.com\.akadns\.net Just add this file as Squid ACL as follows:acl DiscoverSNIHost at_step SslBump1acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/squid/etc/url.nobump"ssl_bump splice NoSSLInterceptssl_bump peek DiscoverSNIHostssl_bump bump alland you do not need to know all the IP authorization server for updates.
{i} NOTE: In some countries WU can product SQUID_X509_V_ERR_DOMAIN_MISMATCH error via Akamai. To do WU, you can require to add this into your Squid's config:acl BrokenButTrustedServers dstdomain "/usr/local/squid/etc/dstdom.broken"acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCHsslproxy_cert_error allow BrokenButTrustedServers DomainMismatchsslproxy_cert_error deny alland add this to dstdom.broken:download.microsoft.comupdate.microsoft.comupdate.microsoft.com.akadns.netupdate.microsoft.com.nsatc.net
{i} NOTE: Depending your Squid's configuration, you may need to change your Squid's cipher configuration to this one:sslproxy_cipher HIGH:MEDIUM:RC4:3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!PSK:!SRP:!DSSand add this one to your bumped port's configuration:cipher=HIGH:MEDIUM:RC4:3DES:!aNULL:!eNULL:!LOW:!MD5:!EXP:!PSK:!SRP:!DSS3DES and RC4 required to connect to WU and - attention! - Skype assets site./!\ WARNING: Some updates cannot be cached due to splice above. Beware!/!\ WARNING: Adding 3DES and, especially, RC4, produces potentially weak ciphers via client and WU/Skype and some other sites. Be careful!
