Proxy server: General settings

. All rights reserved. */ /* ========================================================================== */ /* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code MUST retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* ========================================================================== */ ]]> Describe your package here Describe your package requirements here Currently there are no FAQ items provided. squid 3.4.10_2 pkg 0.2.6 Proxy server: General settings /usr/local/pkg/squid.inc Proxy server Modify the proxy server's settings

Services

/pkg_edit.php?xml=squid.xml&id=0 Reverse Proxy Modify the proxy reverse server's settings

Services

/pkg_edit.php?xml=squid_reverse_general.xml&id=0 squid squid.sh squid Proxy server Service clamd clamav-clamd clamd Clamav Antivirus c-icap c-icap c-icap Icap inteface for squid and clamav integration General /pkg_edit.php?xml=squid.xml&id=0 Remote Cache /pkg.php?xml=squid_upstream.xml Local Cache /pkg_edit.php?xml=squid_cache.xml&id=0 Antivirus /pkg_edit.php?xml=squid_antivirus.xml&id=0 ACLs /pkg_edit.php?xml=squid_nac.xml&id=0 Traffic Mgmt /pkg_edit.php?xml=squid_traffic.xml&id=0 Authentication /pkg_edit.php?xml=squid_auth.xml&id=0 Users /pkg.php?xml=squid_users.xml Real time /squid_monitor.php Sync /pkg_edit.php?xml=squid_sync.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid.inc /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse_general.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse_peer.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse_uri.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse_sync.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_sync.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_cache.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_nac.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_ng.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_ng.inc /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_traffic.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_upstream.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse.inc /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_auth.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_users.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_antivirus.xml /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/sqpmon.sh /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/swapstate_check.php /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_reverse_redir.xml /usr/local/www/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_monitor.php /usr/local/www/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_monitor_data.php /usr/local/www/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_log_parser.php /usr/local/www/ 0755 https://packages.pfsense.org/packages/config/squid3/34/squid_clwarn.php /usr/local/www/shortcuts/ 0755 https://packages.pfsense.org/packages/config/squid3/34/pkg_squid.inc /usr/local/pkg/ 0755 https://packages.pfsense.org/packages/config/squid3/34/check_ip.php Squid General Settings listtopic Proxy interface(s) active_interface The interface(s) the proxy server will bind to. interfaces_selection lan Proxy port proxy_port This is the port the proxy server will listen on. input 5 3128 ICP port icp_port This is the port the Proxy Server will send and receive ICP queries to and from neighbor caches. Leave this blank if you don't want the proxy server to communicate with neighbor caches through ICP. input 5 Allow users on interface allow_interface If this field is checked, the users connected to the interface selected in the 'Proxy interface' field will be allowed to use the proxy, i.e., there will be no need to add the interface's subnet to the list of allowed subnets. This is just a shortcut. checkbox on Patch captive portal patch_cp NOTE: You may need to reapply captive portal config after changing this option.]]> checkbox Resolv dns v4 first dns_v4_first checkbox Disable ICMP disable_pinger checkbox Use alternate DNS-servers for the proxy-server dns_nameservers If you want to use other DNS-servers than the DNS-forwarder, enter the IPs here, separated by semi-colons (;). input 70 Transparent Proxy Settings listtopic Transparent HTTP proxy transparent_proxy NOTE: Transparent mode will filter ssl(port 443) if enable men-in-the-middle options below.
To filter both http and https protocol without intercepting ssl connections, enable WPAD/PAC options on your dns/dhcp.]]> checkbox transparent_active_interface,private_subnet_proxy_off,defined_ip_proxy_off,defined_ip_proxy_off_dest Transparent Proxy interface(s) transparent_active_interface The interface(s) the proxy server will transparent intercept requests. interfaces_selection lan Bypass proxy for Private Address destination private_subnet_proxy_off Do not forward traffic to Private Address Space (RFC 1918) destination through the proxy server but directly through the firewall. checkbox Bypass proxy for these source IPs defined_ip_proxy_off Do not forward traffic from these source IPs, CIDR nets, hostnames, or aliases through the proxy server but directly through the firewall. Separate by semi-colons (;). [Applies only to transparent mode] input 70 Bypass proxy for these destination IPs defined_ip_proxy_off_dest Do not proxy traffic going to these destination IPs, CIDR nets, hostnames, or aliases, but let it pass directly through the firewall. Separate by semi-colons (;). [Applies only to transparent mode] input 70 SSL man in the middle Filtering listtopic HTTPS/SSL interception ssl_proxy checkbox ssl_active_interface,dcert,sslcrtd_children,ssl_proxy_port,interception_checks SSL Intercept interface(s) ssl_active_interface The interface(s) the proxy server will intercept ssl requests. interfaces_selection lan SSL Proxy port ssl_proxy_port This is the port the proxy server will listen on to intercept ssl while using transparent proxy. input 5 3129 CA dca To create a CA on pfsense, go to system -> Cert Manager
Install the CA crt as an trusted ca on each computer you want to filter ssl to avoid ssl error on each connection.]]> select_source descr refid sslcrtd children sslcrtd_children if Squid is used in busy environments this may need to be increased, as well as the number of 'sslcrtd_children']]> input 2 5 Remote Cert checks interception_checks Defaul is to do not select any of these options.]]> select 3 Certificate adapt interception_adapt Hint: Set subject CN
wiki doc with reference]]> select 3 Logging Settings listtopic Enabled logging log_enabled This will enable the access log. Don't switch this on if you don't have much disk space left. checkbox log_query_terms,log_user_agents Log store directory log_dir The directory where the log will be stored (note: do not end with a / mark) input 60 /var/squid/logs Log rotate log_rotate Defines how many days of logfiles will be kept. Rotation is disabled if left empty. input 5 Visible hostname visible_hostname This is the URL to be displayed in proxy server error messages. input 60 localhost Administrator email admin_email This is the email address displayed in error messages to the users. input 60 admin@localhost Language error_language Select the language in which the proxy server will display error messages to users. select en X-Forward Mode xforward_mode on: Squid will append your client's IP address in the HTTP requests it forwards. (Default) By default it looks like: X-Forwarded-For: 192.1.2.3 off: It will appear as: X-Forwarded-For: unknown transparent: Squid will not alter the X-Forwarded-For header in any way. delete: Squid will delete the entire X-Forwarded-For header. truncate: Squid will remove all existing X-Forwarded-For entries, and place the client IP as the sole entry. select on Disable VIA disable_via If not set, Squid will include a Via header in requests and replies as required by RFC2616. checkbox Log denied pages by squidguard log_sqd Note: This option only will work if you include this code on your sgerror.php file to force client browser send a second request to squid with denied string on url.

$sge_prefix=(preg_match("/\?/",$cl['u'])?"&":"?");
$str[] = '< iframe > src="'.$cl['u'].$sge_prefix.'sgr=ACCESSDENIED" width="1" height="1" > < /iframe >';

removing extra space on iframe html code.]]> checkbox What to do with requests that have whitespace characters in the URI uri_whitespace strip: The whitespace characters are stripped out of the URL. This is the behavior recommended by RFC2396. deny: The request is denied. The user receives an "Invalid Request" message. allow: The request is allowed and the URI is not changed. The whitespace characters remain in the URI. encode: The request is allowed and the whitespace characters are encoded according to RFC1738. chop: The request is allowed and the URI is chopped at the first whitespace. select strip Suppress Squid Version disable_squidversion If set, suppress Squid version string info in HTTP headers and HTML error pages. checkbox Custom Settings listtopic Integrations custom_options textarea 78 5 Custom ACLS (Before_Auth) custom_options_squid3 They need to be squid.conf native options, otherwise squid will NOT work.]]> textarea base64 78 10 Custom ACLS (After_Auth) custom_options2_squid3 They need to be squid.conf native options, otherwise squid will NOT work.]]> textarea base64 78 10 squid_before_form_general($pkg); squid_resync(); squid_validate_general($_POST, $input_errors); squid_resync(); unlink_if_exists("/usr/local/etc/rc.d/squid"); update_status("Checking Squid cache... One moment please..."); update_output_window("This operation may take quite some time, please be patient. Do not press stop or attempt to navigate away from this page during this process."); squid_install_command(); squid_resync(); exec("/bin/rm -f /usr/local/etc/rc.d/squid"); squid_deinstall_command(); exec("/bin/rm -f /usr/local/etc/rc.d/squid*"); squid_generate_rules