The top the tab "BUSY (pfsense)

[GabrielLonghi]

Good afternoon. I'm having the following problem here: when I try to connect more than 450~500 users in the e2guardian it starts growing to the top the tab "BUSY". Doesn't matter how many workers I put on it, it still get to the top!! I noticed that @marcelloc already pass thought something like that in this publication (#362) Thanks very much for your attention!

[marcelloc]

Are you using e2guardian as a parent proxy for squid4? I had this issue using this way.
Squid opens as many connections as it can untill e2guardian hits max connections. Same behavior with or without cache configured on squid4.

The only workaround I found was downgrading squid to 3.5 version.

[GabrielLonghi]

I only use e2guardian! Does it have any connection limits?

[philipianpearce]

What OS platform are you using?
What version of e2guardian?
Do you have transparent HTTPS enabled?

[GabrielLonghi]

I'm using 2.4.4-RELEASE-p3 (amd64)
E2Guardian is in version 0.5.3.3
Yes, transparent HTTPS is enabled! I do not know what is happening!!

[philipianpearce]

So you are using pfsense which is based on FreeBSD. Please make sure any configuration in pfsense for Transparent HTTPS is switched OFF - there is a problem affecting BSD ports of e2g which can cause an infinite loop when certain urls are called pushing up connections to maximum. Use of HTTPS MITM should work fine with e2g set as the proxy on your users devices.

…

----- Original Message -----

From: "GabrielLonghi" ***@***.***> To: "e2guardian/e2guardian" ***@***.***> Cc: "Philip Pearce" ***@***.***>, "Comment" ***@***.***> Sent: Tuesday, 7 January, 2020 7:07:35 PM Subject: Re: [e2guardian/e2guardian] The top the tab "BUSY (#567) I'm using 2.4.4-RELEASE-p3 (amd64) E2Guardian is in version 0.5.3.3 Yes, HTTPS is enabled! I do not know what is happening!! — You are receiving this because you commented. Reply to this email directly, view it on GitHub , or unsubscribe .

[GabrielLonghi]

I need to use transparent proxy! I work at a university, so many mobile devices! Is there no other way out of the problem?

[marcelloc]

On all my tests, loop can occur only if e2guardian port is set to 443 instead of default 8080.

This way, when transparente forward 'fails' to identify https connection and send to 127.0.0.1, it will not back to e2guardian.

[GabrielLonghi]

Default is Listen port 8080 and SSL Proxy Port 8081! Actually, many loopback errors occur, I did the test bypassing 127.0.0.1 but to no avail !! How can I fix this problem?

[philipianpearce]

@marcelloc

To fix this we need to code to get the original destination ip & port before NAT.
What firewall library does pfsense use?

[GabrielLonghi]

Problem persists, help @marcelloc

[AlexJamesBR]

Hi @GabrielLonghi or @marcelloc . I´ve the same issue. Did you get it solved? Can you help?