squidng Security 2.5.10_4 installedpackages->package->squidng->configuration->settings /pkg_edit.php?xml=squid_ng.xml&id=0 Squid Advanced Proxy Modify settings for Squid Advanced Proxy

Services

package http://www.pfsense.org/packages/All/squid-2.5.STABLE10.tbz package ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/www/squidGuard-1.2.0_1.tbz configfile http://www.pfsense.com/packages/config/squid_ng.inc configfile http://www.pfsense.com/packages/config/squid_upstream.xml configfile http://www.pfsense.com/packages/config/squid_cache.xml configfile http://www.pfsense.com/packages/config/squid_nac.xml configfile http://www.pfsense.com/packages/config/squid_traffic.xml General Settings /pkg_edit.php?xml=squid_ng.xml&id=0 Upstream Proxy /pkg_edit.php?xml=squid_upstream.xml&id=0 Cache Mgmt /pkg_edit.php?xml=squid_cache.xml&id=0 Network Access Control /pkg_edit.php?xml=squid_nac.xml&id=0 Traffic Mgmt /pkg_edit.php?xml=squid_traffic.xml&id=0 Proxy Listening Interface active_interface This defines the active listening interface to which the proxy server will listen for its requests. interfaces_selection Transparent Proxy transparent_proxy If transparent mode is enabled; all requests for destination port 80 will be forwarded to the proxy server without any additional configuration necessary. checkbox Log Enabled log_enabled This enables the Web Proxy logging feature. All clients requests will be written to a log file viewable under Services -> Proxy Log. checkbox URL Filtering Enabled urlfilter_enable This enables the advanced functionality in conjunction with squidGuard to provide an array of URL filtering options. This squidGuard functionality can be additionally configured from Services -> Advanced Proxy Filtering checkbox Log Query Terms log_query_terms This will log the complete URL rather than the part of the URL containing dynamic queries. checkbox Log User Agents log_user_agents This will enable the useragent string to be written to a separate log. The results are not shown in the GUI and should only be used for debugging purposes. checkbox true Proxy Port proxy_port This is the port the Proxy Server will listen for client requests on. The default is 3128. 4 input ICP Port icp_port This is the port the Proxy Server will send and receive ICP queries to and from neighbor caches. The default value is 0, which means this function is disabled. 4 input Visible Hostname visible_hostname This URL is displayed on the Proxy Server error messages. 35 input Cache Administrator E-Mail cache_admin_email This E-Mail address is displayed on the Proxy Server error messages. 35 input Error Messages Language error_language Select the language in which the Proxy Server shall display error messages to users. select BulgarianBulgarian CatalanCatalan CzechCzech DanishDanish DutchDutch EnglishEnglish EstonianEstonian FinnishFinnish FrenchFrench GermanGerman HebrewHebrew HungarianHungarian ItalianItalian JapaneseJapanese KoreanKorean LithuanianLithuanian PolishPolish PortuguesePortuguese RomanianRomanian Russian-1251Russian-1251 Russian-koi8-rRussian-koi8-r SerbianSerbian Simplify ChineseSimplify Chinese SlovakSlovak SpanishSpanish SwedishSwedish Traditional ChineseTraditional Chinese TurkishTurkish function write_static_squid_config() { global $config; $lancfg = $config['interfaces']['lan']; $lanif = $lancfg['if']; $lanip = $lancfg['ipaddr']; $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); $lansn = $lancfg['subnet']; $fout = fopen("/usr/local/etc/squid/squid.conf","w"); fwrite($fout, "#\n"); fwrite($fout, "# This file was automatically generated by the pfSense package manager\n"); fwrite($fout, "# This default policy enables transparent proxy with no local disk logging\n"); fwrite($fout, "#\n"); fwrite($fout, "shutdown_lifetime 5 seconds\n"); fwrite($fout, "icp_port 0\n"); fwrite($fout, "\n"); fwrite($fout, "http_port 3128\n"); fwrite($fout, "\n"); fwrite($fout, "acl QUERY urlpath_regex cgi-bin \?\n"); fwrite($fout, "no_cache deny QUERY\n"); fwrite($fout, "\n"); fwrite($fout, "pid_filename /var/run/squid.pid\n"); fwrite($fout, "\n"); fwrite($fout, "cache_mem 8 MB\n"); fwrite($fout, "cache_dir ufs /var/squid/cache 500 16 256\n"); fwrite($fout, "\n"); fwrite($fout, "error_directory /usr/local/etc/squid/errors/English\n"); fwrite($fout, "\n"); fwrite($fout, "memory_replacement_policy heap LRU\n"); fwrite($fout, "cache_replacement_policy heap GDSF\n"); fwrite($fout, "\n"); fwrite($fout, "cache_access_log /dev/null\n"); fwrite($fout, "cache_log /dev/null\n"); fwrite($fout, "cache_store_log none\n"); fwrite($fout, "\n"); fwrite($fout, "log_mime_hdrs off\n"); fwrite($fout, "emulate_httpd_log on\n"); fwrite($fout, "forwarded_for off\n"); fwrite($fout, "\n"); fwrite($fout, "acl within_timeframe time MTWHFAS 00:00-24:00\n"); fwrite($fout, "\n"); fwrite($fout, "acl all src " . $lansa . "/" . $lansn . "\n"); fwrite($fout, "acl localnet src " . $lansa . "/" . $lansn . "\n"); fwrite($fout, "acl localhost src 127.0.0.1/255.255.255.255\n"); fwrite($fout, "acl Safe_ports port 80 # http\n"); fwrite($fout, "acl Safe_ports port 21 # ftp\n"); fwrite($fout, "acl Safe_ports port 443 563 # https, snews\n"); fwrite($fout, "acl Safe_ports port 70 # gopher\n"); fwrite($fout, "acl Safe_ports port 210 # wais\n"); fwrite($fout, "acl Safe_ports port 1025-65535 # unregistered ports\n"); fwrite($fout, "acl Safe_ports port 280 # http-mgmt\n"); fwrite($fout, "acl Safe_ports port 488 # gss-http\n"); fwrite($fout, "acl Safe_ports port 591 # filemaker\n"); fwrite($fout, "acl Safe_ports port 777 # multiling http\n"); fwrite($fout, "acl Safe_ports port 800 # Squids port (for icons)\n"); fwrite($fout, "\n"); fwrite($fout, "acl CONNECT method CONNECT\n"); fwrite($fout, "\n"); fwrite($fout, "#access to squid; local machine; no restrictions\n"); fwrite($fout, "http_access allow localnet\n"); fwrite($fout, "http_access allow localhost\n"); fwrite($fout, "\n"); fwrite($fout, "#Deny non web services\n"); fwrite($fout, "http_access deny !Safe_ports\n"); fwrite($fout, "http_access deny CONNECT\n"); fwrite($fout, "\n"); fwrite($fout, "#Set custom configured ACLs\n"); fwrite($fout, "http_access deny all\n"); fwrite($fout, "visible_hostname pfSense\n"); fwrite($fout, "httpd_accel_host virtual\n"); fwrite($fout, "httpd_accel_port 80\n"); fwrite($fout, "httpd_accel_with_proxy on\n"); fwrite($fout, "httpd_accel_uses_host_header on\n"); fwrite($fout, "cache_effective_user squid\n"); fwrite($fout, "cache_effective_group squid\n"); fwrite($fout, "\n"); fwrite($fout, "#Strip HTTP Header\n"); fwrite($fout, "header_access X-Forwarded-For deny all\n"); fwrite($fout, "header_access Via deny all\n"); fwrite($fout, "\n"); fwrite($fout, "maximum_object_size 4096 KB\n"); fwrite($fout, "minimum_object_size 0 KB\n"); fwrite($fout, "\n"); fwrite($fout, "request_body_max_size 0 KB\n"); fwrite($fout, "reply_body_max_size 0 allow all\n"); fwrite($fout, "\n"); fclose($fout); } require_once("/usr/local/pkg/squid_ng.inc"); global_write_squid_config(); mwexec("/usr/local/sbin/squid -k reconfigure"); write_static_squid_config(); update_output_window("Creating initialization scripts..."); $fout = fopen("/usr/local/etc/rc.d/squid.sh","w"); fwrite($fout, "#!/bin/sh\n"); fwrite($fout, "$pfSense: /usr/local/sbin/rc.d/squid.sh; created " . date(DATE_RFC822) . " mcapp\n"); fwrite($fout, "\n"); fwrite($fout, "touch /tmp/ro_root_mount\n\n"); fwrite($fout, "/usr/local/sbin/squid -D\n\n"); fwrite($fout, "touch /tmp/filter_dirty\n\n"); fclose($fout); chmod("/usr/local/etc/rc.d/squid.sh", 755); if (!file_exists("/var/squid/cache")) { update_output_window("Initializing Cache... This may take a moment..."); mwexec("/usr/local/sbin/squid -z"); } update_output_window("Starting Squid Advanced Proxy..."); mwexec_bg("/usr/local/etc/rc.d/squid.sh"); filter_configure(); rmdir_recursive("/usr/local/squid"); unlink_if_exists("/var/mail/squid"); unlink_if_exists("/usr/local/etc/rc.d/squid"); unlink_if_exists("/usr/local/etc/squid/squid.conf"); unlink_if_exists("/usr/local/etc/squid"); unlink_if_exists("/usr/local/libexec/squid"); rmdir_recursive("/usr/local/etc/squid"); filter_configure(); /usr/local/etc/rc.d/squid.sh /usr/local/sbin/squid -k shutdown