cannot access gmail when bypassing proxy server (sometimes not always !!!!????)



  • hi all

    i have local network protected by pfSense proxy server, i have some users going through the proxy (i change their browser proxy setting : i checked the box "use a proxy server for your LAN" then i enter the ip address of my pfSense ) in order to restrict the access of some website, in the same time i have other user that bypass the proxy server so that they have open internet (by not checking that box in their browser),

    the problem is that : those users who bypass the proxy server cannot open gmail in their browser, but as soon as i check that box i can access gmail, i uncheck the box i cannot access gmail, ant the most strange and weird thing is that : this happen only sometimes not always

    really any help will be very appreciated, thank you very much



  • That is very odd.



  • Any reason to not send everyone through the proxy and use the proxy to restrict people rather than the selection of the proxy?



  • @scottalanmiller hi Mr Scott
    if i let all users pass through the proxy they will have Access list control applied on them, but me i want some users have full internet access
    in reality they all pass through the proxy because he is the internet gateway also, but only those who have their browser set to use the proxy who will get restricted, the other users (unrestricted users) pass through the proxy but since their browser don't use any proxy, they will bypass proxy server



  • Doesn't the proxy allow you to choose who has what restrictions?



  • @scottalanmiller

    unfortunatly No, there is an option called transparent proxy, in this case you select this option : Bypass proxy for these source IPs : .......
    but since i don't select the option of transparent proxy, i don't have to select any IP (this option is available only if you check transparent proxy), but when you don't check transparent proxy, only those users who have proxy setting in their browser who will pass through the access list control



  • The point is not to bypass the proxy but instead to configure the proxy appropriately. I haven't worked with pfSense's proxy so I am not aware of a limitation.



  • It should just be Squid. So having proper proxy rules should be available.



  • i don't use squid, i'm only using proxy server, because in pfsense 2 proxy packages are available, proxy server and squid guard, in my situation i install only proxy server, for this reason it is a little bit limited,
    i don't want to install squid guard (no need having 2 different packages doing the same thing )



  • Oh, i see. That's what I get for not using it. I'm only familiar with Squid.



  • The proxy is based on Squid. Squidguard gives you some additional filtering options, but is based on the proxy service already running.. Enabling transparent proxy will force all outgoing web traffic through that proxy without having to configure each client.



  • That makes more sense. Squidguard on its own is a Squid add on. Very bizarre that they name the underlying product in one case and rename it in another.



  • i already checked the option transparent proxy and select IPs that have to bypass transparent proxy, but didn't make any difference, in addition to that, only traffic that have destination port equal 80 who will pass through the transparent proxy because https for example bypass the transparent proxy because it is considered as man in the middle,
    i think that SSL who make this problem regarding gmail because basically it use https, and when unrestricted users try to access gmail they cannot because their browsers are not configured to use the proxy server, so https consider it to be kind of man in the middle, but what i can't understand at all is why thus issue happen only sometimes not always??????????????



  • this temporarily nature that makes me crazyyyyy



  • Could it be people selecting HTTP vs people selecting HTTPS that make it work or fail?



  • but gmail is automatically https, so the users don't select any protocol, they just want to access gmail, after that automatically they use https, and because they don't have "use a proxy server for your LAN" checked in their browser, they can't access it, (temporarily !!!!!!??? ) and this what drive me crazy, then i checked that box for them to allow them accessing gmail, after that they call me : "we cannot access facebook", then i unchecked that box to allow them accessing restricted website, (lol) working like that till i find a solution for this weird problem, but this shouldn't take a long time, i have to solve this problem as quick as possible



  • Is there no way to opt out of HTTPS for Gmail? Perhaps not.



  • I know that Squid can do everything that you need, bypassing it isn't as good as leveraging it. I've manage Squid before, but never with a web interface. I don't know how the interface is limiting you but Squid should be able to allow you to select which accounts to block and which not to block while putting everyone through the proxy for security and speed.

    Worst case, stop using a transparent proxy and go to a side by side proxy where non-proxy traffic literally goes straight out the gateway and only proxied traffic hits the proxy.



  • do you thing that it is better to install squid guard ??



  • @IT-ADMIN said:

    do you thing that it is better to install squid guard ??

    Possibly. I've not used it. I used an alternative to it last that I used Squid.



  • do you agree with me that : this problem happen because https traffic cannot be established if any proxy server in the middle unless you inform the browser that he should use a proxy otherwise he think that the proxy behave as man in the middle ??

    but what i can't never understand is that happen sometimes, i cannot guess any cause for this madness,



  • No. Normally HTTPS is just ignored.



  • sorry, what do you mean by the last post : "No. Normally HTTPS is just ignored" , can you explain please



  • Typically proxies are configured for HTTPS traffic to just bypass the proxy. It's not normal to use the proxy for that, only for HTTP.



  • For pure proxy (using local cache to offload WAN bandwidth constraints), HTTPS isn't usually proxied. In theory, it's session-specific, so caching it would be a waste of resources, and only serve to slow the user's experience down.

    For filtering, I typically use a device or service that provides transparent HTTPS inspection. Personally, I've had good luck with Sopohos UTM and the late Forefront TMG. Squid by design isn't a filter, and they say as such. They then go on to mention that if you want to use it as a filter anyway, use SquidGuard. I guess the question is: What are you looking to achieve by using the proxy?



  • @Nara right, i'm looking only for blocking some website like facebook and youtube for some users and allow them to some other users too, i'm not interested in caching, i want just to block or allow some website, but i didn't find any package to hundle this except the package called proxy server



  • A proxy is th right tool for that job but if you are not proxying HTTPS connections people won't even realize that they are blocked. They can just switch protocols and bypass the proxy. As all those sites offer HTTPS. If you block HTTPS then you have other issues.

    But to use a proxy well, everyone should go through it, not just some people. The proxy should decide who gets what access.



  • yes, but the proxy server can block also https if and only if the browser is aware of the proxy server, and if the browser not using any proxy server the https traffic will pass through the proxy but the proxy will be unable to do anything with it,



  • @IT-ADMIN said:

    yes, but the proxy server can block also https if and only if the browser is aware of the proxy server, and if the browser not using any proxy server the https traffic will pass through the proxy but the proxy will be unable to do anything with it,

    In the way that you have set it up, yes. That need not be the case. There are many ways to architect the proxy server.



  • I've not done this in a very long time. But HTTPS setup is the correct answer to push everything through the proxy. Otherwise you need to move the proxy out of the packet path so that the bypassing clients can fully bypass it.

    http://www.howtoforge.com/filtering-https-traffic-with-squid


Log in to reply