cannot access gmail when bypassing proxy server (sometimes not always !!!!????)
-
hi all
i have local network protected by pfSense proxy server, i have some users going through the proxy (i change their browser proxy setting : i checked the box "use a proxy server for your LAN" then i enter the ip address of my pfSense ) in order to restrict the access of some website, in the same time i have other user that bypass the proxy server so that they have open internet (by not checking that box in their browser),
the problem is that : those users who bypass the proxy server cannot open gmail in their browser, but as soon as i check that box i can access gmail, i uncheck the box i cannot access gmail, ant the most strange and weird thing is that : this happen only sometimes not always
really any help will be very appreciated, thank you very much
-
That is very odd.
-
Any reason to not send everyone through the proxy and use the proxy to restrict people rather than the selection of the proxy?
-
@scottalanmiller hi Mr Scott
if i let all users pass through the proxy they will have Access list control applied on them, but me i want some users have full internet access
in reality they all pass through the proxy because he is the internet gateway also, but only those who have their browser set to use the proxy who will get restricted, the other users (unrestricted users) pass through the proxy but since their browser don't use any proxy, they will bypass proxy server -
Doesn't the proxy allow you to choose who has what restrictions?
-
unfortunatly No, there is an option called transparent proxy, in this case you select this option : Bypass proxy for these source IPs : .......
but since i don't select the option of transparent proxy, i don't have to select any IP (this option is available only if you check transparent proxy), but when you don't check transparent proxy, only those users who have proxy setting in their browser who will pass through the access list control -
The point is not to bypass the proxy but instead to configure the proxy appropriately. I haven't worked with pfSense's proxy so I am not aware of a limitation.
-
It should just be Squid. So having proper proxy rules should be available.
-
i don't use squid, i'm only using proxy server, because in pfsense 2 proxy packages are available, proxy server and squid guard, in my situation i install only proxy server, for this reason it is a little bit limited,
i don't want to install squid guard (no need having 2 different packages doing the same thing ) -
Oh, i see. That's what I get for not using it. I'm only familiar with Squid.
-
The proxy is based on Squid. Squidguard gives you some additional filtering options, but is based on the proxy service already running.. Enabling transparent proxy will force all outgoing web traffic through that proxy without having to configure each client.
-
That makes more sense. Squidguard on its own is a Squid add on. Very bizarre that they name the underlying product in one case and rename it in another.
-
i already checked the option transparent proxy and select IPs that have to bypass transparent proxy, but didn't make any difference, in addition to that, only traffic that have destination port equal 80 who will pass through the transparent proxy because https for example bypass the transparent proxy because it is considered as man in the middle,
i think that SSL who make this problem regarding gmail because basically it use https, and when unrestricted users try to access gmail they cannot because their browsers are not configured to use the proxy server, so https consider it to be kind of man in the middle, but what i can't understand at all is why thus issue happen only sometimes not always?????????????? -
this temporarily nature that makes me crazyyyyy
-
Could it be people selecting HTTP vs people selecting HTTPS that make it work or fail?
-
but gmail is automatically https, so the users don't select any protocol, they just want to access gmail, after that automatically they use https, and because they don't have "use a proxy server for your LAN" checked in their browser, they can't access it, (temporarily !!!!!!??? ) and this what drive me crazy, then i checked that box for them to allow them accessing gmail, after that they call me : "we cannot access facebook", then i unchecked that box to allow them accessing restricted website, (lol) working like that till i find a solution for this weird problem, but this shouldn't take a long time, i have to solve this problem as quick as possible
-
Is there no way to opt out of HTTPS for Gmail? Perhaps not.
-
I know that Squid can do everything that you need, bypassing it isn't as good as leveraging it. I've manage Squid before, but never with a web interface. I don't know how the interface is limiting you but Squid should be able to allow you to select which accounts to block and which not to block while putting everyone through the proxy for security and speed.
Worst case, stop using a transparent proxy and go to a side by side proxy where non-proxy traffic literally goes straight out the gateway and only proxied traffic hits the proxy.
-
do you thing that it is better to install squid guard ??
-
@IT-ADMIN said:
do you thing that it is better to install squid guard ??
Possibly. I've not used it. I used an alternative to it last that I used Squid.
