Hi all,
Can anyone tell me which IPFire log would show when a file download, for example a .rar file, is being blocked from being downloaded from a specific site? As far as I know, I do not have any rules in place to block these specific file extensions.
Hi @pscar13 thank you, yes I know url filter can do that, however, I do not have those options selected. My question is actually, I am looking for is the actual LOG that shows the blocked download, NOT how to block downloads.
I understood that. For URL Filter, the information would be in the “URL Filter Logs” log (if logging is enabled).
But apparently, that is not the issue.
As for the rest, I don’t have a precise answer.
Perhaps it is simply a URL being blocked by DNS Firewall. In that case, you will find the domain name in System Logs → “Domain Name System”, but not the full URL.
@pscar13 ah, OK, my bad. I do have the URL Filter logs enabled, however, there is nothing in there that shows the file download being blocked, nor in the Domain Name System log. It throws up an error of “ERR_TUNNEL_CONNECTION_FAILED” which seems to indicate a DNS issue, so I will look into that as a possible cause. Thank you for your replies.
I think that “ERR_TUNNEL_CONNECTION_FAILED” is more likely to be an error caused by URL Filter rather than DNS Firewall.
The page containing the link may be on an allowed domain, but the file to be downloaded (the .tar file) might be hosted on a different URL or domain that is being blocked.
However, these are only assumptions, so I’m sorry that I cannot give you a more precise answer.
If you can provide more details, we may be able to investigate further. Otherwise, I’ll leave you to continue looking into it.
@pscar13 Thank you, yes, the actual file is hosted on a different website, same domain but with fdn in front, so fdn.domain.com. Apologies that I do not provide more precise details, however, due to the sensitivity of the website I am accessing, I cannot provide details.
Have you enabled logging for blocked sites in the url filter page. It is disabled by default.
https://www.ipfire.org/docs/configuration/network/proxy/url-filter#enable-log
@bonnietwin Yes, sir, I have.
Then I would say it is not being logged by url filter.
Check in the main firewall log page for the IP of the site you are interested in and see if it is showing up there via an iptables rule.
@bonnietwin nothing in the main firewall logs, regrettably. Ah, well, I will continue to investigate and see if I can find out why this is suddenly being blocked. It is not a critical issue, however, it used to work, now it is not, but I have a workaround for now. Thank you to all for your assistance.
Only thing i can then suggest is to use something like tcpdump to get a clue as to where it is being blocked.
A question. Is Squid now capable of https transparently?
HTTPS cannot work in transparent mode on IPFire.
This is explicitly stated in the IPFire documentation:
https://www.ipfire.org/docs/configuration/network/proxy/extend/wpad
However, there are two trade offs to transparent proxy that should be evaluated when choosing whether using the manual configuration or not. First, with transparent proxy, you cannot configure exceptions. Unfortunately, there are sites that don’t work properly if accessed through a proxy. This is exactly why you sometimes need exceptions. Second, the HTTPS protocol cannot work in transparent mode in IPfire.
Yes, I already knew that, and what I meant was that perhaps you have Squid configured in transparent mode, and that’s why it’s not blocking what you want. In other words, download requests for .rar files (for example) from HTTPS pages.
I say this because @markadewet doesn’t mention how he has Squid configured.
Ah yes, I hadn’t understood the irony. 
But I don’t block downloads with Squid; my screenshot was only an example for @markadewet.
And yes, I enabled transparent mode for Wi-Fi guests connecting to my network — I don’t really have a choice.
However, for my own PCs, I still use WPAD and URLFilter, and it works well with HTTPS.
Do you use the IPS?
Did you check the IPS logs?
@hvacguy I assume your question is directed to myself. Yes, I do use IPS, however, the discussion seems to have taken a wrong turn somewhere. What is happening is that I cannot download said file from a particular site. As far as the IPS logs go, I checked them and did not find anything that would indicate that the download is being blocked by IPS. I did try to use both Wireshark and Fiddler in order to see where the block might be occurring, however, while can see the request going out fine, I cannot seem to find a filter to show what is happening (or NOT happening, as the case may be) when the website is supposed to send its response/file. So I am still investigating at the moment, as I need to read up more about how to properly use Wireshark and/or Fiddler to get to the bottom of this issue.
