Endian 2.5.1 blocking Windows Update, Avast and Mozy

[Guest]

[BD]

Before you start flaming me...  Yes, I've searched this forum, the squid forum and googled for answers and tried a number of edits to the squid.conf.tmpl file.

From the logs, it is definitely squid doing the blocking.  Example of log:

Aug 30 17:33:41 lab squid[9252]: 1346362421.438 0 192.168.4.13 TCP_DENIED/403 384  windowsupdate.microsoft.com - NONE/- text/html

I'm using "transparent proxy" and running dansguardian.  I've whitelisted all of the windows update sites in the content filtering.

I probably tried some others too.  Any help would be appreciated.

BD

[BD]

No one else has this problem?

BD

[dda]

Lots of people have this problem.  I am actually researching windows update alternatives because of this.  It started in 2.51 and i have been researching it for months.

[BD]

Can I just shutdown the proxy and use the firewall with domain names?

Like:

Allow port 80 dst microsoft.com?

Thanks

BD

[dda]

I am not sure.  I actually have a full 30+ user LAN behind my EFW so I can't risk shutting down the proxy as I use authentication and the content filter.  I found a work around for server 2003 and I am now testing for server 2008.  Some client machines running Windows 7 and XP I have found still get the updates but the servers would not work at all.  You would have to decide if you want to remove the proxy on your network.

[BD]

I can run a mostly cut off network with only a few whitelist sites.  I'll just dump EFW and go iptables.  This is more trouble than it is worth.

BD

[dda]

You could use EFW 2.41 instead that did not have the problem.

[mrkroket]

Try whitelistening .microsoft.com
Also check rules order, they are processed in order.

[dda]

Actually just yesterday Windows updates notified me of a new version which I installed and now the updates are working.  Microsoft seems to have tweaked the software.

[endianupdate]

The way I do this is by having an access policy (Proxy > Http Access Policy) as follows;

Source type : zone (Green, Orange, Blue)
Destination type : domain (add domains one per line .microsoft.com & .windowsupdate.com - note must have the leading . for it to work with squid)
Access policy : allow access
Filter profile : none (to make sure that dansguardian is bypassed for this domain)
Position: first position

I use this policy as my *whitelist* as I block downloads of executables for all websites apart for the ones in my whitelist in another policy

Hope this helps.