Netgate SG-1000 microFirewall

Author Topic: Squid3-dev blocks Windows update and other updates  (Read 11174 times)

0 Members and 1 Guest are viewing this topic.

Offline MIT

  • Newbie
  • *
  • Posts: 7
  • Karma: +4/-0
    • View Profile
Squid3-dev blocks Windows update and other updates
« on: May 23, 2014, 01:06:19 pm »
Pfsense 2.1.3 32-bit
Ram 4 GB
HDD 128 GB SSD
CPU AMD Athlon 3400+ 64-bit
1 Wan
1 Lan

Packages:
pfBlocker 1.0.2
Squid3-dev 3.3.10 pkg 2.2.2

SSL and Squidclam are enabled on a Transparent proxy. I can browse to SSL sites without a problem.

I am having trouble getting Squid to allow Windows Update (Win 7) and others like JAVA to connect to the MS/Oracle/etc. update server and pull the update.  The error I get in the Windows Update window is 80072F8F.

If I bypass the proxy for the computer I want to update, then the update works without complaining.

I have tried changing the Remote Cert Checks and Certificate Adapt options, but no combination fixes this.
I also have the Dynamic Content Caching enabled for Windows Update.

Can someone provide some ideas to get Squid3 to allow Windows Update (etc.) to work?  Thanks!

Offline wcrowder

  • Full Member
  • ***
  • Posts: 118
  • Karma: +12/-5
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #1 on: July 26, 2014, 08:27:12 am »
The following needs to be in your squid.conf file, not sure how to add it via the GUI. You may need to add other sites to bypass SSLbump also.


acl broken_sites dstdomain .update.microsoft.com

ssl_bump none broken_sites


Offline 91X

  • Full Member
  • ***
  • Posts: 159
  • Karma: +5/-2
  • Keep respect to all people!
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #2 on: December 09, 2014, 07:15:27 pm »
excuse me sir, solved this prob? :)

Offline marian78

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #3 on: January 30, 2015, 01:52:14 pm »
try that, not working for me. Maybe missing some more domains....
pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

Offline Cino

  • Hero Member
  • *****
  • Posts: 1516
  • Karma: +61/-2
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #4 on: January 30, 2015, 03:19:33 pm »
maybe this will help for the domain list?

https://technet.microsoft.com/en-us/library/bb693717.aspx

Offline marian78

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #5 on: January 31, 2015, 04:43:13 pm »
thx sir, but i dont know how set this type of domain: *.update.microsoft.com

In squid i needed strictly setup all domain or it can use * ?
pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

Offline cwagz

  • Full Member
  • ***
  • Posts: 118
  • Karma: +5/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #6 on: February 01, 2015, 12:01:37 am »
I have not been able to get this to work either for Windows update.  I did get minecraft working with this method.  Is it possible to use Windows update with HTTPS transparent proxy?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 13398
  • Karma: +589/-7
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #7 on: February 01, 2015, 12:44:49 am »
Squid wildcard is a . instead of *

If you try it on acls, just try to remove * and keep .update.microsoft.com

Offline marian78

  • Jr. Member
  • **
  • Posts: 77
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #8 on: February 01, 2015, 03:21:18 am »
thx sir, i try that, hope that will work.  ;)
pfsense runing in virtual, on HP N54L microserver, 2G RAM, 60G disk, WAN, LAN, DMZ, Wifi, OpenVPN server + client, suricata, pfblocker

Offline ayman

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #9 on: February 02, 2015, 06:05:53 am »
Hello,

Windows update is not working with me too, below what i have for windows update

acl windowsupdate dstdomain windowsupdate.microsoft.com
acl windowsupdate dstdomain update.microsoft.com
acl windowsupdate dstdomain download.windowsupdate.com
acl windowsupdate dstdomain redir.metaservices.microsoft.com
acl windowsupdate dstdomain images.metaservices.microsoft.com
acl windowsupdate dstdomain c.microsoft.com
acl windowsupdate dstdomain www.download.windowsupdate.com
acl windowsupdate dstdomain wustat.windows.com
acl windowsupdate dstdomain crl.microsoft.com
acl windowsupdate dstdomain sls.microsoft.com
acl windowsupdate dstdomain productactivation.one.microsoft.com
acl windowsupdate dstdomain ntservicepack.microsoft.com
acl windowsupdate dstdomain watson.microsoft.com

acl CONNECT method CONNECT
acl wuCONNECT dstdomain update.microsoft.com

http_access allow CONNECT wuCONNECT localnet
http_access allow CONNECT wuCONNECT localhost
http_access allow windowsupdate localnet
http_access allow windowsupdate localhost

but i still get error 80072f8f while trying to update.

access.log:

1422878282.386     76 192.168.1.58 TCP_MISS/200 391 HEAD http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
1422878282.521     76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
1422878283.051     76 192.168.1.124 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream
1422878286.460     76 192.168.1.58 TCP_MISS/200 390 HEAD http://ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab? - HIER_DIRECT/79.140.94.25 application/octet-stream

I have squid3-dev with squidGuard 3 installed


I have more than 70 pcs and i have to fix this urgently, any clue ?

Thanks

Ayman

Offline vinbot

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #10 on: February 19, 2015, 01:25:36 pm »
I generated a tcpdump when this was happening and poked around the contents.  I found the URL fe2.update.microsoft.com

I added that URL AND windowsupdate.microsoft.com to my squid.conf (with ssl_bump none as well for each) it seems to be updating now

Hope it helps.

~Vinbot

Offline KOM

  • Hero Member
  • *****
  • Posts: 5412
  • Karma: +674/-19
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #11 on: February 19, 2015, 01:47:06 pm »
Quote
acl windowsupdate dstdomain windowsupdate.microsoft.com
acl windowsupdate dstdomain update.microsoft.com
acl windowsupdate dstdomain download.windowsupdate.com
...

Could you not just use .microsoft.com, .windowsupdate.com and .windows.com to replace all of that?

I've played with Squid3 dynamic caching with Windows Update and I always ended up in a situation where it would download the entire file for every segment it's trying to download.  100 MB of patches required downloading many gigabytes of data, as each segment request would cause the entire file to be downloaded again and again.  My traffic graph would show my WAN being fully saturated for an hour or more and hardly anything coming in to LAN from Squid.

Quote
I have more than 70 pcs and i have to fix this urgently, any clue ?

For that many users, why not run WSUS?

Offline Firzze

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #12 on: March 03, 2015, 03:32:08 am »
Hi, :)
So with ssl filtering, windows update does not want to do this. There in there a manipulation to do to solve this problem.
Sorry for my bad english  ;D

Offline Merchant

  • Full Member
  • ***
  • Posts: 127
  • Karma: +3/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #13 on: August 17, 2015, 11:29:29 pm »
I am also facing same issue as reported by poster , if any one have solution to this kindly update this thread ,if i bypass source Ip from proxy server settings i am able to update
2.3-RC (amd64)
built on Mon Apr 04 17:09:32 CDT 2016
FreeBSD 10.3-RELEASE
Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

darkstat       3.1.2_1   
Lightsquid   3.0.3_1   
mailreport       3.0_1   
pfBlockerNG    2.0.9_1    
RRD_Summary    1.3.1_2   
snort    3.2.9.1_9    
squid 0.4.16_1    
squidGuard    1.14_1   
syslog-ng    1.1.2_2

Offline aGeekHere

  • Sr. Member
  • ****
  • Posts: 523
  • Karma: +41/-1
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #14 on: August 18, 2015, 12:05:44 am »
This was a main reason why I switch to a wpad.
Never Fear, A Geek is Here!