pfSense » pfSense Packages

Kindly tick "Allow local network(s) on interface(s)" if you want such ACL.

Additional information: The pfSense box is running OpenVPN so this may be a problem with this version of squid not being able to define localnet on a multi-interface pfSense platform

Kill Bill wrote:

Kindly tick "Allow local network(s) on interface(s)" if you want such ACL.

This is already ticked / enabled. More detail: I need localnet defined because I use "never_direct allow localnet" in "General / Advanced Options" to force clients through the pfSense squid proxy which itself uses an upstream parent. Since the upgrade to the squid package it is now not seeing localnet in /usr/local/etc/squid/squid.conf

Look, you need either non-empty local interface, or fill in Allowed Subnets on the ACLs tab. Please, use forums for discussion, this is a bug tracker.

Kill Bill wrote:

Look, you need either non-empty local interface, or fill in Allowed Subnets on the ACLs tab. Please, use forums for discussion, this is a bug tracker.

It is a bug, introduced since version 0.4.36_1. Perhaps I haven't explained it enough but I have a workaround. Hopefully someone else will submit the same bug and provide whatever information is required for proper investigation.

No, it's not, noone touched the relevant code for years.

https://github.com/pfsense/FreeBSD-ports/blame/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1340
https://github.com/pfsense/FreeBSD-ports/blame/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1866
https://github.com/pfsense/FreeBSD-ports/blame/devel/www/pfSense-pkg-squid/files/usr/local/pkg/squid.inc#L1931

And here are the changes between 0.4.36 and 0.4.36_1:
https://github.com/pfsense/FreeBSD-ports/pull/313/files

Kindly use the forums for discussion.

And FYI regarding the OpenVPN: https://redmine.pfsense.org/issues/4331 (IOW, it will never be auto-added to localnet since it would only add invalid junk. Any OpenVPN subnets need to be added manually to Allowed Subnets on the ACLs tab, as already noted above.)

Kill Bill wrote:

And FYI regarding the OpenVPN: https://redmine.pfsense.org/issues/4331 (IOW, it will never be auto-added to localnet since it would only add invalid junk. Any OpenVPN subnets need to be added manually to Allowed Subnets on the ACLs tab, as already noted above.)

FYI it worked fine before I upgraded to 0.4.36_1

As noted in https://redmine.pfsense.org/issues/7391#note-7 the OpenVPN interfaces are not added by design since it adds invalid information that does not and cannot work (see Bug #4331).

Close please, there's no bug here.