<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// Modern cipher suites</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$sslproxy_options .= ",NO_TLSv1";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>} else {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div>Should the RC4 be removed or allowed?</div><div><br></div><div><div style="display: inline-block;"><span style="-webkit-user-select: none;"><a class="linkPlaceholder" href="https://github.com/pfsense/FreeBSD-ports/pull/1365">https://github.com/pfsense/FreeBSD-ports/pull/1365</a></span></div><br></div><div><br></div><div><br></div><div><br><blockquote type="cite"><div>On Apr 4, 2024, at 18:17, Amos Jeffries <squid3@treenet.co.nz> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">On 4/04/24 17:48, Jonathan Lee wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Is there any particular order to squid configuration??<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Yes. <</span><a href="https://wiki.squid-cache.org/SquidFaq/OrderIsImportant" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://wiki.squid-cache.org/SquidFaq/OrderIsImportant</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Does this look correct?<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Best way to find out is to run "squid -k parse", which should be done after upgrades as well to identify and fix changes between versions as we improve the output.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">I actually get allot of hits and it functions amazing, so I wanted to share this in case I could improve something. Is there any issues with security?<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Yes, the obvious one is "DONT_VERIFY_PEER" disabling TLS security entirely on outbound connections. That particular option will prevent you even being told about suspicious activity regarding TLS.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">I am concerned that an invasive container could become installed in the cache and data marshal the network card.<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">You have a limit of 4 MB for objects allowed to pass through this proxy, exception being objects from domains listed in the "windowsupdate" ACL (not all Windows related) which are allowed up to 512 MB.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">For the general case, any type of file which can store an image of some system is a risk for that type of vulnerability can be cached.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">The place to fix that vulnerability properly is not the cache or Squid. It is the OS permissions allowing non-Squid software access to the cache files and/or directory.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Here is my config<br># This file is automatically generated by pfSense<br># Do not edit manually !<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Since this file is generated by pfsense there is little that can be done about ordering issues and very hard to tell which of the problems below are due to pfsense and which due toy your settings.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">FWIW, there are no major issues, just some lines not being necessary due to setting things to their default values, or just some blocks already denyign things that are blocked previously.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>icp_port 0<br>digest_generation off<br>dns_v4_first on<br>pid_filename /var/run/squid/squid.pid<br>cache_effective_user squid<br>cache_effective_group proxy<br>error_default_language en<br>icon_directory /usr/local/etc/squid/icons<br>visible_hostname ****<br>cache_mgr ****<br>access_log /var/squid/logs/access.log<br>cache_log /var/squid/logs/cache.log<br>cache_store_log none<br>netdb_filename /var/squid/logs/netdb.state<br>pinger_enable on<br>pinger_program /usr/local/libexec/squid/pinger<br>sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048<br>tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt<br>tls_outgoing_options capath=/usr/local/share/certs/<br>tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS<br>tls_outgoing_options flags=DONT_VERIFY_PEER<br>sslcrtd_children 10<br>logfile_rotate 0<br>debug_options rotate=0<br>shutdown_lifetime 3 seconds<br># Allow local network(s) on interface(s)<br>acl localnet src 192.168.1.0/27<br>forwarded_for transparent<br>httpd_suppress_version_string on<br>uri_whitespace strip<br>acl getmethod method GET<br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://windowsupdate.microsoft.com/">windowsupdate.microsoft.com</a><br>acl windowsupdate dstdomain .<a href="http://update.microsoft.com/">update.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://download.windowsupdate.com/">download.windowsupdate.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://redir.metaservices.microsoft.com/">redir.metaservices.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://images.metaservices.microsoft.com/">images.metaservices.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://c.microsoft.com/">c.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://www.download.windowsupdate.com/">www.download.windowsupdate.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://wustat.windows.com/">wustat.windows.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://crl.microsoft.com/">crl.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://sls.microsoft.com/">sls.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://productactivation.one.microsoft.com/">productactivation.one.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://ntservicepack.microsoft.com/">ntservicepack.microsoft.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://dc1-st.ksn.kaspersky-labs.com/">dc1-st.ksn.kaspersky-labs.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://dc1-file.ksn.kaspersky-labs.com/">dc1-file.ksn.kaspersky-labs.com</a><br>acl windowsupdate dstdomain<span class="Apple-converted-space"> </span><a href="http://dc1.ksn.kaspersky-labs.com/">dc1.ksn.kaspersky-labs.com</a><br>acl rewritedoms dstdomain .<a href="http://facebook.com/">facebook.com</a><span class="Apple-converted-space"> </span>.<a href="http://akamaihd.net/">akamaihd.net</a><span class="Apple-converted-space"> </span>.<a href="http://fbcdn.net/">fbcdn.net</a><span class="Apple-converted-space"> </span>.<a href="http://google.com/">google.com</a><span class="Apple-converted-space"> </span>.<a href="http://static.com/">static.com</a><span class="Apple-converted-space"> </span>.<a href="http://apple.com/">apple.com</a><span class="Apple-converted-space"> </span>.<a href="http://oracle.com/">oracle.com</a><span class="Apple-converted-space"> </span>.<a href="http://sun.com/">sun.com</a><span class="Apple-converted-space"> </span>.<a href="http://java.com/">java.com</a><span class="Apple-converted-space"> </span>.<a href="http://adobe.com/">adobe.com</a><span class="Apple-converted-space"> </span>.<a href="http://steamstatic.com/">steamstatic.com</a>.<a href="http://steampowered.com/">steampowered.com</a><span class="Apple-converted-space"> </span>.<a href="http://steamcontent.com/">steamcontent.com</a><span class="Apple-converted-space"> </span>.<a href="http://google.com/">google.com</a><br>store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt<br>store_id_children 10 startup=5 idle=1 concurrency=0<br>always_direct allow !getmethod<br>store_id_access deny connect<br>store_id_access deny !getmethod<br>store_id_access allow rewritedoms<br>reload_into_ims on<br>max_stale 20 years<br>minimum_expiry_time 0<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">I am not sure how many of these refresh_pattern rules below are written by you, copy-pasted from elsewhere, or added automatically by pfsense. So how you need to fix the problems here is uncertain.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">That said, please consider removing all these override-* and ignore-*.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;"><</span><a href="http://www.squid-cache.org/Doc/config/refresh_pattern/" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">http://www.squid-cache.org/Doc/config/refresh_pattern/</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth<br>#APPLE STUFF<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://apple.com/">apple.com/</a>..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims<br>#apple update<br>refresh_pattern -i (download|adcdownload).<a href="http://apple.com/">apple.com</a>/.*.(pkg|dmg) 4320 100% 43200<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://appldnld.apple.com/">appldnld.apple.com</a><span class="Apple-converted-space"> </span>129600 100% 129600<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://phobos.apple.com/">phobos.apple.com</a><span class="Apple-converted-space"> </span>129600 100% 129600<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://iosapps.itunes.apple.com/">iosapps.itunes.apple.com</a><span class="Apple-converted-space"> </span>129600 100% 129600<br># Updates: Windows<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://microsoft.com/">microsoft.com/</a>..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://windowsupdate.com/">windowsupdate.com/</a>..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://windows.com/">windows.com/</a>..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://microsoft.com/">microsoft.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://windowsupdate.com/">windowsupdate.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://windows.com/">windows.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>refresh_pattern -i .*<a href="http://windowsupdate.com/">windowsupdate.com</a>/.*.(cab|exe) 259200 100% 259200<br>refresh_pattern -i .*<a href="http://update.microsoft.com/">update.microsoft.com</a>/.*.(cab|exe|dll|msi|psf) 259200 100% 259200<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://windowsupdate.com/">windowsupdate.com</a>/.*.(cab|exe|dll|msi|psf) 10080 100% 43200<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://download.microsoft.com/">download.microsoft.com</a>/.*.(cab|exe|dll|msi|psf) 10080 100% 43200<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://www.microsoft.com/">www.microsoft.com</a>/.*.(cab|exe|dll|msi|psf) 10080 100% 43200<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://au.download.windowsupdate.com/">au.download.windowsupdate.com</a>/.*.(cab|exe|dll|msi|psf) 4320 100% 43200<br>refresh_pattern bg.v4.<a href="http://pr.dl.ws.microsoft.com/">pr.dl.ws.microsoft.com</a>/.*.(cab|exe|dll|msi|psf) 4320 100% 43200<br>#windows update NEW UPDATE 0.04<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://update.microsoft.com/">update.microsoft.com</a>/.*.(cab|exe) 43200 100% 129600<br>refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/.*.(cab|exe|msi|msp|psf) 4320 100% 43200<br>refresh_pattern<span class="Apple-converted-space"> </span><a href="http://update.microsoft.com/">update.microsoft.com</a>/.*.(cab|exe|dll|msi|psf) 10080 100% 43200<br>refresh_pattern -i .<a href="http://update.microsoft.com/">update.microsoft.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>refresh_pattern -i .<a href="http://windowsupdate.com/">windowsupdate.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>refresh_pattern -i .<a href="http://download.microsoft.com/">download.microsoft.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>refresh_pattern -i .<a href="http://ws.microsoft.com/">ws.microsoft.com</a>/.*.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern ([^.]+.)?.<a href="http://akamai.steamstatic.com/">akamai.steamstatic.com</a>/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i ([^.]+.)?.<a href="http://adobe.com/">adobe.com</a>/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i ([^.]+.)?.<a href="http://java.com/">java.com</a>/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i ([^.]+.)?.<a href="http://sun.com/">sun.com</a>/.*.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i ([^.]+.)?.<a href="http://oracle.com/">oracle.com</a>/.*.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://appldnld.apple.com/">appldnld.apple.com</a><span class="Apple-converted-space"> </span>43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod<br>refresh_pattern -i ([^.]+.)?<a href="http://apple.com/">apple.com</a>/.*.(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod<br> refresh_pattern -i ([^.]+.)?.<a href="http://google.com/">google.com</a>/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern -i ([^.]+.)?<a href="http://g.static.com/">g.static.com</a>/.*.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>#FACEBOOK<br>refresh_pattern ^http?://*.<a href="http://facebook.com/*">facebook.com/*</a><span class="Apple-converted-space"> </span> 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>#FACEBOOK IMAGES<br>refresh_pattern -i<span class="Apple-converted-space"> </span><a href="http://pixel.facebook.com/">pixel.facebook.com</a>..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern -i .<a href="http://akamaihd.net/">akamaihd.net</a>..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern -i (<a href="http://facebook.com/">facebook.com</a>).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern static.(xx|ak).<a href="http://fbcdn.net/">fbcdn.net</a>.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern ^https?://<a href="http://profile.ak.fbcdn.net/">profile.ak.fbcdn.net</a>*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>#FACEBOOK VIDEO<br>refresh_pattern -i .<a href="http://video.ak.fbcdn.net/">video.ak.fbcdn.net</a>.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>range_offset_limit 512 MB windowsupdate<br>maximum_object_size 512 MB windowsupdate<br>range_offset_limit 0<br>quick_abort_min -1 KB<br>cache_mem 64 MB<br>maximum_object_size_in_memory 256 KB<br>memory_replacement_policy heap LFUDA<br>cache_replacement_policy heap LFUDA<br>minimum_object_size 0 KB<br>maximum_object_size 4 MB<br>cache_dir diskd /var/squid/cache 64000 256 256<br>offline_mode off<br>cache_swap_low 90<br>cache_swap_high 95<br>acl donotcache dstdomain '/var/squid/acl/donotcache.acl'<br>cache deny donotcache<br>cache allow all<br># Add any of your own refresh_pattern entries above these.<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br>#Remote proxies<br># Setup some default acls<br># ACLs all, manager, localhost, and to_localhost are predefined.<br>acl allsrc src all<br>acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535<br>acl sslports port 443 563 8080 5223 2197<br>acl purge method PURGE<br>acl connect method CONNECT<br># Define protocols used for redirects<br>acl HTTP proto HTTP<br>acl HTTPS proto HTTPS<br># SslBump Peek and Splice<br>#<span class="Apple-converted-space"> </span><a href="http://wiki.squid-cache.org/Features/SslPeekAndSplice">http://wiki.squid-cache.org/Features/SslPeekAndSplice</a><br>#<span class="Apple-converted-space"> </span><a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit">http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit</a><br># Match against the current step during ssl_bump evaluation [fast]<br># Never matches and should not be used outside the ssl_bump context.<br>#<br># At each SslBump step, Squid evaluates ssl_bump directives to find<br># the next bumping action (e.g., peek or splice). Valid SslBump step<br># values and the corresponding ssl_bump evaluation moments are:<br># SslBump1: After getting TCP-level and HTTP CONNECT info.<br># SslBump2: After getting TLS Client Hello info.<br># SslBump3: After getting TLS Server Hello info.<br># These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that<br># they can be used there for custom configuration.<br>acl step1 at_step SslBump1<br>acl step2 at_step SslBump2<br>acl step3 at_step SslBump3<br>acl banned_hosts src '/var/squid/acl/banned_hosts.acl'<br>acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'<br>acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl'<br>http_access allow manager localhost<br># Allow external cache managers<br>acl ext_manager src 192.168.1.1<br>acl ext_manager src 127.0.0.1<br>http_access allow manager ext_manager<br>http_access deny manager<br>http_access allow purge localhost<br>http_access deny purge<br>http_access deny !safeports<br>http_access deny CONNECT !sslports<br># Always allow localhost connections<br>http_access allow localhost<br>quick_abort_min 0 KB<br>quick_abort_max 0 KB<br>quick_abort_pct 95<br>request_body_max_size 0 KB<br>delay_pools 1<br>delay_class 1 2<br>delay_parameters 1 -1/-1 -1/-1<br>delay_initial_bucket_level 100<br>delay_access 1 allow allsrc<br># Reverse Proxy settings<br>deny_info TCP_RESET allsrc<br># Package Integration<br>url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf<br>url_rewrite_bypass off<br>url_rewrite_children 32 startup=8 idle=4 concurrency=0<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Squidguard is very outdated. You should upgrade to its successor ufdbguard if possible.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"># Custom options before auth<br>#host_verify_strict on<br># These hosts are banned<br>http_access deny banned_hosts<br># Always allow access to whitelist domains<br>http_access allow whitelist<br># Block access to blacklist domains<br>http_access deny blacklist<br># List of domains allowed to logging in to Google services<br>request_header_access X-GoogApps-Allowed-Domains deny all<br>request_header_add X-GoogApps-Allowed-Domains consumer_accounts<br># Set YouTube safesearch restriction<br>acl youtubedst dstdomain -n<span class="Apple-converted-space"> </span><a href="http://www.youtube.com/">www.youtube.com</a><span class="Apple-converted-space"> </span><a href="http://m.youtube.com/">m.youtube.com</a><span class="Apple-converted-space"> </span><a href="http://youtubei.googleapis.com/">youtubei.googleapis.com</a><span class="Apple-converted-space"> </span><a href="http://youtube.googleapis.com/">youtube.googleapis.com</a><span class="Apple-converted-space"> </span><a href="http://www.youtube-nocookie.com/">www.youtube-nocookie.com</a><br>request_header_access YouTube-Restrict deny all<br>request_header_add YouTube-Restrict none youtubedst<br>acl sglog url_regex -i sgr=ACCESSDENIED<br>http_access deny sglog<br># Custom SSL/MITM options before auth<br>acl manager proto cache_object<br>acl localhost src 192.168.1.1/32<br>#cachemgr_passwd disable offline_toggle reconfigure shutdown<br>#cachemgr_passwd secret all<br>acl https_login url_regex -i ^https.*(login|Login).*<br>acl no_miss url_regex -i ^.*<a href="http://gateway.facebook.com/ws/realtime?">gateway.facebook.com/ws/realtime?</a><br>acl no_miss url_regex -i ^.*<a href="http://web-chat-e2ee.facebook.com/ws/chat">web-chat-e2ee.facebook.com/ws/chat</a><span class="Apple-tab-span" style="white-space: pre;"> </span><br>acl CONNECT method CONNECT<br>acl wuCONNECT dstdomain<span class="Apple-converted-space"> </span><a href="http://www.update.microsoft.com/">www.update.microsoft.com</a><br>acl wuCONNECT dstdomain<span class="Apple-converted-space"> </span><a href="http://sls.microsoft.com/">sls.microsoft.com</a><br>http_access allow CONNECT wuCONNECT localnet<br>http_access allow CONNECT wuCONNECT localhost<br>http_access allow windowsupdate localnet<br>http_access allow windowsupdate localhost<br>http_access deny manager<br>acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken'<br>acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH<br>sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch<br>sslproxy_cert_error deny all<br>acl splice_only src 192.168.1.8 #Tasha iPhone<br>acl splice_only src 192.168.1.10 #Jon iPhone<br>acl splice_only src 192.168.1.11 #Amazon Fire<br>acl splice_only src 192.168.1.15 #Tasha HP<br>acl splice_only src 192.168.1.16 #iPad<br>acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.nobump'<br>acl markBumped annotate_client bumped=true<br>acl bump_only src 192.168.1.3 #webtv<br>acl bump_only src 192.168.1.4 #toshiba<br>acl bump_only src 192.168.1.5 #imac<br>acl bump_only src 192.168.1.9 #macbook<br>acl bump_only src 192.168.1.13 #dell<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">You have a previous "cache allow all". This below rule does nothing.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">cache deny https_login<br>ssl_bump peek step1<br>miss_access deny no_miss<br>ssl_bump splice https_login<br>ssl_bump splice splice_only<br>ssl_bump splice NoSSLIntercept<br>ssl_bump bump bump_only markBumped<br>ssl_bump stare all<br>acl markedBumped note bumped true<br>url_rewrite_access deny markedBumped<br>http_access deny all<br>read_ahead_gap 32 KB<br>negative_ttl 1 second<br>connect_timeout 30 seconds<br>request_timeout 60 seconds<br>half_closed_clients off<br>shutdown_lifetime 10 seconds<br>negative_dns_ttl 1 seconds<br>ignore_unknown_nameservers on<br>pipeline_prefetch 100<br>#acl SSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.bump'<br>#ssl_bump bump SSLIntercept<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">You already have an earlier "http_access deny all". The below lines do nothing.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"># Setup allowed ACLs<br># Allow local network(s) on interface(s)<br>http_access allow localnet<br># Default block all to be sure<br>http_access deny allsrc<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">HTH</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Amos</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">squid-users mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:squid-users@lists.squid-cache.org" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">squid-users@lists.squid-cache.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.squid-cache.org/listinfo/squid-users" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.squid-cache.org/listinfo/squid-users</a></div></blockquote></div><br></body></html>