Endian Firewall Comunity 3.2.2 - Proxy not-transparent does not work

[Guest]

[littlefishknife]

I was using Endian Firewall Community 2.5.2 and have migrated onto Endian Firewall 3.2.2. As a matter of fact I have installed a start from scratch Endian Firewall 3.2.2 and then restored on it the parameters of my 2.5.2 revision: the restoration succeeded perfectly and I found everything OK when browsing my configuration.

However though all the rules in Firewall Outgoing Traffic continue to work fine, all the rules in Proxy no-transparent mode no longer wotk at all: ALL URL which should be accepted are no longer accepted: the browser (Firefox) signals: << The connexion has been rejected by the proxy server >>. The browser is properly configured to communicate through proxy.

Endian Firewall 3.2.2 is perfectly up to date, I just ugraded it, successfully, through PUTTY command efw-upgrade.

Thinking that there was, perhaps, an invisible incompatibility with the rules coming from an 2.5.2 EFW revision I have re-written ALL the rules undes EFW 3.2.2 but it did not solve the problem.

What to do ? Is is a known bug ?

Thank you by advance for any help

[dda]

Restoration of backups rarely works.  You usually have to apply rules manually.

[Dark-Vex]

As I now the only compatible and supported backup for the 3.2.2 it's a backup from a 3.0.5

[littlefishknife]

I confirm that Endian Firewall Community 3.2.2 Proxy not-transparent does not work.

After having completely re-entered all the HTTP Proxy rules starting from a completely new EFW 3.2.2 installation I discovered that with 25 rules Proxy not-transparent rejects all attempts to connect to any URL. But when removing half of the rules, more specifically those with a large number of domain names specified, it works again !!!

Which is boring is that in revision EFW 2.5.2 those 25 Proxy rules are working perfectly, including those having a large number of domain names.

So what is the interest of this 3.2.2 revision

[Dark-Vex]

@littlefishknife mmm I think you have duplicates domain in the ACL or domain with the dot that include some subtomain, in order to verify this try (with all the ACL/rules enabled) the following command from SSH:

squid -k check

[ccruz]

I have a similar problem, but for the the service (i think is squid) wont start.