Netgate SG-1000 microFirewall

Author Topic: Squid3-dev blocks Windows update and other updates  (Read 11091 times)

0 Members and 1 Guest are viewing this topic.

Offline Merchant

  • Full Member
  • ***
  • Posts: 127
  • Karma: +3/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #15 on: August 18, 2015, 02:04:09 am »
This was a main reason why I switch to a wpad.

So are you telling moving from transparent proxy to non transparent proxy will fix my issue ?
2.3-RC (amd64)
built on Mon Apr 04 17:09:32 CDT 2016
FreeBSD 10.3-RELEASE
Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

darkstat       3.1.2_1   
Lightsquid   3.0.3_1   
mailreport       3.0_1   
pfBlockerNG    2.0.9_1    
RRD_Summary    1.3.1_2   
snort    3.2.9.1_9    
squid 0.4.16_1    
squidGuard    1.14_1   
syslog-ng    1.1.2_2

Offline aGeekHere

  • Sr. Member
  • ****
  • Posts: 523
  • Karma: +41/-1
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #16 on: August 18, 2015, 02:22:44 am »
I could not get windows updates to work through HTTPS/SSL interception, and dealing with the CA were a pain.

Windows updates using wpad with squid proxy works.
Never Fear, A Geek is Here!

Offline Merchant

  • Full Member
  • ***
  • Posts: 127
  • Karma: +3/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #17 on: August 18, 2015, 02:34:05 am »
so u disabled Https interception ?    i have no issue deploying cert since i am using AD gpmc
2.3-RC (amd64)
built on Mon Apr 04 17:09:32 CDT 2016
FreeBSD 10.3-RELEASE
Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

darkstat       3.1.2_1   
Lightsquid   3.0.3_1   
mailreport       3.0_1   
pfBlockerNG    2.0.9_1    
RRD_Summary    1.3.1_2   
snort    3.2.9.1_9    
squid 0.4.16_1    
squidGuard    1.14_1   
syslog-ng    1.1.2_2

Offline aGeekHere

  • Sr. Member
  • ****
  • Posts: 523
  • Karma: +41/-1
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #18 on: August 18, 2015, 02:40:15 am »
You first have to decide if you want to use a transparent proxy or non transparent proxy with wpad

If you want to try using non transparent proxy with wpad here are a few links
https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid
https://forum.pfsense.org/index.php?topic=93060.0

Note: non transparent proxy with wpad you disable HTTPS/SSL interception and Transparent HTTP proxy.

Let me know if you get stuck
Never Fear, A Geek is Here!

Offline Merchant

  • Full Member
  • ***
  • Posts: 127
  • Karma: +3/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #19 on: August 18, 2015, 06:47:52 am »
So i cant use Https inspection with wpad ?  As far as i understood wpad is a method of delivering proxy server info such as IP address and port number so we don't need to manually configure all client PC's proxy serttings manually in Non Transparent proxy case

IF using transparent proxy there is no need of configuring wpad
2.3-RC (amd64)
built on Mon Apr 04 17:09:32 CDT 2016
FreeBSD 10.3-RELEASE
Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

darkstat       3.1.2_1   
Lightsquid   3.0.3_1   
mailreport       3.0_1   
pfBlockerNG    2.0.9_1    
RRD_Summary    1.3.1_2   
snort    3.2.9.1_9    
squid 0.4.16_1    
squidGuard    1.14_1   
syslog-ng    1.1.2_2

Offline aGeekHere

  • Sr. Member
  • ****
  • Posts: 523
  • Karma: +41/-1
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #20 on: August 18, 2015, 06:40:47 pm »
Quote
So i cant use Https inspection with wpad

wpad is only used to auto configure a non transparent proxy.

Quote
transparent proxy there is no need of configuring wpad
You cannot have both.
Never Fear, A Geek is Here!

Offline KOM

  • Hero Member
  • *****
  • Posts: 5402
  • Karma: +671/-19
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #21 on: August 18, 2015, 07:42:33 pm »
Quote
So i cant use Https inspection with wpad ?

You can't use the HTTPS Interception feature of pfSense because it goes along with Transparent mode.  If you use an explicit proxy (not transparent) and WPAD auto-detection, then you don't need to worry about certs or group policy.  You will still be able to filter HTTPS streams and your users won't get a browser warning.  The only glitch is that some mobiles, specifically Android, don't do WPAD so those users must manually configure the proxy.

Offline S. Kirschner

  • Jr. Member
  • **
  • Posts: 35
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #22 on: August 19, 2015, 02:37:00 am »
The issue with the actual version of squid for pfsense is , that the acl "ssl::server_name" isnt available.

The available acl dstdomain shouldnt be used for that, because the information that dstdomain tries to compare are encrypted at these moment.

You could read the description http://lists.squid-cache.org/pipermail/squid-users/2015-July/004429.html


Another issue with Windows Update is , that Microsoft use self signed certificate that are not signed by VeriSign.
There would be 2 solutions for the 2nd issue , ignoring cert errors or import the certificate.

Offline ramalave

  • Newbie
  • *
  • Posts: 9
  • Karma: +1/-0
  • SysAdmin Linux
    • View Profile
    • Rafael Malave / Resumen Curricular / ramalave.com.ve
Re: Squid3-dev blocks Windows update and other updates
« Reply #23 on: March 22, 2017, 10:23:19 am »
Create Aliases Called add WindowsUpdate and the following list for the networking group
157.54.0.0/15
157.56.0.0/14
157.60.0.0/16
65.52.0.0/14
70.37.0.0/17
70.37.128.0/18
207.46.0.0/16
131.107.0.0/16
66.119.144.0/20
23.96.0.0/13
204.79.195.0/24
204.79.196.0/23
208.76.44.0/22
208.68.136.0/21
216.220.208.0/20
209.240.192.0/19
204.14.180.0/22
206.191.224.0/19
192.92.90.0/24
208.84.0.0/21
104.40.0.0/13
192.197.157.0/24
204.231.192.0/24
104.208.0.0/13
129.75.0.0/16
204.79.179.0/24
64.4.0.0/18
167.220.0.0/17
167.220.128.0/18
167.220.192.0/19
192.92.214.0/24
207.68.128.0/18
13.64.0.0/11
13.96.0.0/13
13.104.0.0/14
146.147.0.0/16
52.145.0.0/16
52.146.0.0/15
52.148.0.0/14
52.152.0.0/13
52.160.0.0/11
52.224.0.0/11
52.96.0.0/12
52.112.0.0/14
52.120.0.0/14
52.125.0.0/16
52.126.0.0/15
52.130.0.0/15
52.132.0.0/14
52.136.0.0/13
138.196.0.0/16
150.171.0.0/16
40.74.0.0/15
40.76.0.0/14
40.80.0.0/12
40.96.0.0/12
40.112.0.0/13
40.120.0.0/14
40.124.0.0/16
40.125.0.0/17
40.64.0.0/13
40.126.128.0/17
40.127.0.0/16
40.126.0.0/18
204.13.120.0/21
204.152.18.0/23
Then you go to Services ---> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
Enter the created alliase called WindowsUpdate
And this way it fixes all the updates for Windows with Transparent Proxy
 

Offline ramalave

  • Newbie
  • *
  • Posts: 9
  • Karma: +1/-0
  • SysAdmin Linux
    • View Profile
    • Rafael Malave / Resumen Curricular / ramalave.com.ve
Re: Squid3-dev blocks Windows update and other updates
« Reply #24 on: March 22, 2017, 12:44:46 pm »
Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
157.54.0.0/15
157.56.0.0/14
157.60.0.0/16
65.52.0.0/14
70.37.0.0/17
70.37.128.0/18
207.46.0.0/16
131.107.0.0/16
66.119.144.0/20
23.96.0.0/13
204.79.195.0/24
204.79.196.0/23
208.76.44.0/22
208.68.136.0/21
216.220.208.0/20
209.240.192.0/19
204.14.180.0/22
206.191.224.0/19
192.92.90.0/24
208.84.0.0/21
104.40.0.0/13
192.197.157.0/24
204.231.192.0/24
104.208.0.0/13
129.75.0.0/16
204.79.179.0/24
64.4.0.0/18
167.220.0.0/17
167.220.128.0/18
167.220.192.0/19
192.92.214.0/24
207.68.128.0/18
13.64.0.0/11
13.96.0.0/13
13.104.0.0/14
146.147.0.0/16
52.145.0.0/16
52.146.0.0/15
52.148.0.0/14
52.152.0.0/13
52.160.0.0/11
52.224.0.0/11
52.96.0.0/12
52.112.0.0/14
52.120.0.0/14
52.125.0.0/16
52.126.0.0/15
52.130.0.0/15
52.132.0.0/14
52.136.0.0/13
138.196.0.0/16
150.171.0.0/16
40.74.0.0/15
40.76.0.0/14
40.80.0.0/12
40.96.0.0/12
40.112.0.0/13
40.120.0.0/14
40.124.0.0/16
40.125.0.0/17
40.64.0.0/13
40.126.128.0/17
40.127.0.0/16
40.126.0.0/18
204.13.120.0/21
204.152.18.0/23
Então você vai Services ---> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
Escrevem os aliases criado chamado WindowsUpdate
e desta forma você pode atualizar todas as versões do Windows com proxy transparente

Offline ramalave

  • Newbie
  • *
  • Posts: 9
  • Karma: +1/-0
  • SysAdmin Linux
    • View Profile
    • Rafael Malave / Resumen Curricular / ramalave.com.ve
Re: Squid3-dev blocks Windows update and other updates
« Reply #25 on: March 22, 2017, 12:45:38 pm »
Cria um Aliases chamado WindowsUpdate e você adicionar a lista de grupo de rede
157.54.0.0/15
157.56.0.0/14
157.60.0.0/16
65.52.0.0/14
70.37.0.0/17
70.37.128.0/18
207.46.0.0/16
131.107.0.0/16
66.119.144.0/20
23.96.0.0/13
204.79.195.0/24
204.79.196.0/23
208.76.44.0/22
208.68.136.0/21
216.220.208.0/20
209.240.192.0/19
204.14.180.0/22
206.191.224.0/19
192.92.90.0/24
208.84.0.0/21
104.40.0.0/13
192.197.157.0/24
204.231.192.0/24
104.208.0.0/13
129.75.0.0/16
204.79.179.0/24
64.4.0.0/18
167.220.0.0/17
167.220.128.0/18
167.220.192.0/19
192.92.214.0/24
207.68.128.0/18
13.64.0.0/11
13.96.0.0/13
13.104.0.0/14
146.147.0.0/16
52.145.0.0/16
52.146.0.0/15
52.148.0.0/14
52.152.0.0/13
52.160.0.0/11
52.224.0.0/11
52.96.0.0/12
52.112.0.0/14
52.120.0.0/14
52.125.0.0/16
52.126.0.0/15
52.130.0.0/15
52.132.0.0/14
52.136.0.0/13
138.196.0.0/16
150.171.0.0/16
40.74.0.0/15
40.76.0.0/14
40.80.0.0/12
40.96.0.0/12
40.112.0.0/13
40.120.0.0/14
40.124.0.0/16
40.125.0.0/17
40.64.0.0/13
40.126.128.0/17
40.127.0.0/16
40.126.0.0/18
204.13.120.0/21
204.152.18.0/23
Então você vai Services ---> Squid Proxy Server ----> Bypass Proxy for These Destination IPs
Escrevem os aliases criado chamado WindowsUpdate
e desta forma você pode atualizar todas as versões do Windows com proxy transparente

Offline blueadept

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Squid3-dev blocks Windows update and other updates
« Reply #26 on: December 06, 2017, 12:16:40 pm »
ramalave's solution worked fine for me.