Not easily, but you can find one approach in the squid-dev archives.
Attempting this is not recommeded for the weak hearted. It is a serious
abuse of TCP/IP. Also, I would recommend changing your network layout to
use the Squid server as a router and not bridge in such case.
Regards
Henrik
Velu
Velu,may be it possible, see http://www.squid-cache.org/Doc/FAQ/FAQ-7.html#ss7.13 to
more help.
>Dear Members & Henrick ,
>
>While accessing the internet from my client machine through a squid server
>to any remote server. i want to display the client machine ip rather than
>squid server ip. Is i
Yes, you can do this with the help of a redirector which when it detects
a "download" link redirects the user to a cgi program returning the
customizable error message and other options, including a link for
downloading.
The download link is based on the original requested URL, but modified
in suc
ansari imtiyaz ahmed khadim husain wrote:
Hi all..
Is it possible that whenever a user makes a request to squid server for
http browsing, a program gets fired checking some conditions applied on
the user and if condition is met then only allow the user to browse.
If it possible then how
If a
On Mon, 4 Apr 2005, ansari imtiyaz ahmed khadim husain wrote:
Is it possible that whenever a user makes a request to squid server for
http browsing, a program gets fired checking some conditions applied on
the user and if condition is met then only allow the user to browse.
Yes. By two means
a) The
Hi!
This kind of things should be done by some software on client side.
Cisco NAC with its CTA/CSA is the answer, but it does not use squid.
What kind of credentials you can check on proxy?!
Michael Kondrashin
ansari imtiyaz ahmed khadim husain пишет:
Hi all..
Is it possible that whenever a u
On Mon, 4 Apr 2005, ansari imtiyaz ahmed khadim husain wrote:
Can you give me some details about external acl interface , bcoz I am a
new user of squid.
See squid.conf.default and http://devel.squid-cache.org/
Regards
Henrik
On Sun, 14 Nov 2004, Ali Abbas wrote:
Is it possible to either create an acl that can stop (deny) client request
with abnormal headers or if somehow it can be specified in "no_cache" tag so
that squid never process such request with "header-too-large" error
Requests resulting in "header-too-large"
-Original Message-
From: Henrik Nordstrom [mailto:[EMAIL PROTECTED]
Sent: Sunday, November 14, 2004 2:26 AM
To: Ali Abbas
Cc: 'squid users'
Subject: Re: [squid-users] Is it possible
On Sun, 14 Nov 2004, Ali Abbas wrote:
> Is it possible to either create an acl that can stop
On Fri, 31 Oct 2003, Alex Carlos Braga Antão wrote:
> I'm triyng to setup SQUID to work with dansguardian here. But I have
> a little problem that my auth scheme must be NTLM, and DansGuardian does
> not support it. So, I am make the following scheme:
>
> cache_peer SQUID2 port
just do an acl to block the word porn
#ACL
acl pornsite url_regex -i porn
#DENY
http_access deny pornsite
rgds,
Frank
- Original Message -
From: "alberto" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, June 04, 2003 9:41 AM
Subject: [squid-users] is it possible to block sea
On Wednesday 04 June 2003 09.41, alberto wrote:
> is there any possibily to block a google search?.
> If i put into google "porn", how can i do with an acl to block the
> search? Thank you...
You can use urlpath_regex to block search queries in most search
engines.
acl search_keywords urlpath_r
To give you an idea:
Pentium III - 1Ghz, 1,5 GB Ram, RedHat 7.3 about 4000 clients accessing
the server.
Normally we have a 3Mbps line for our users and we handle 160Req/sec
but we once gave the users 5Mbps and we handled 220 Reqs/sec. So I'm not
sure what the limit is of this machine.
BTW before
>
> To give you an idea:
> Pentium III - 1Ghz, 1,5 GB Ram, RedHat 7.3 about 4000 clients
> accessing
> the server.
>
> Normally we have a 3Mbps line for our users and we handle 160Req/sec
> but we once gave the users 5Mbps and we handled 220 Reqs/sec.
> So I'm not
> sure what the limit is of
> To give you an idea:
> Pentium III - 1Ghz, 1,5 GB Ram, RedHat 7.3 about 4000 clients
> accessing
> the server.
>
> Normally we have a 3Mbps line for our users and we handle 160Req/sec
> but we once gave the users 5Mbps and we handled 220 Reqs/sec.
> So I'm not
> sure what the limit is of this mac
On Thu, 12 Feb 2004, Chris Wilcox wrote:
> I'm interested in the same question! How did you optimise Squid to get such
> an improvement?
things one need to look into
* Disk subsystem. Use more than one drive and one of the async cache_dir
types. One cache_dir per physical drive, maybe more if
On ons, 2007-09-26 at 10:46 -0700, Pranav Desai wrote:
> I tried to look through the mib but couldnt find any OID for
> tcp_mem_hits. Is is possible to get TCP_MEM_HIT values using snmp ?
Seems not. In fact not accessible at all, not even via cachemgr. But
there is an internal counter so it's not
On 9/26/07, Henrik Nordstrom <[EMAIL PROTECTED]> wrote:
> On ons, 2007-09-26 at 10:46 -0700, Pranav Desai wrote:
>
> > I tried to look through the mib but couldnt find any OID for
> > tcp_mem_hits. Is is possible to get TCP_MEM_HIT values using snmp ?
>
> Seems not. In fact not accessible at all, n
On ons, 2007-09-26 at 21:52 -0700, Pranav Desai wrote:
> On 9/26/07, Henrik Nordstrom <[EMAIL PROTECTED]> wrote:
> > On ons, 2007-09-26 at 10:46 -0700, Pranav Desai wrote:
> >
> > > I tried to look through the mib but couldnt find any OID for
> > > tcp_mem_hits. Is is possible to get TCP_MEM_HIT va
Hello,
On Fri, 20 Jun 2008 20:01:03 +0630
"Mr Crack" <[EMAIL PROTECTED]> wrote:
> I would like to know whether it is possible to log chatting of office
> users by squid.
Do you mean logging when users login / logoff a particular instant
messaging service, or do you mean logging conversations ?
May be making a graph with source the cachemgr, I know that there is a
that use rrdtool:
http://www.squid-cache.org/~wessels/squid-rrd/
On Sun, Oct 5, 2008 at 4:04 AM, Sommariva Graziano
<[EMAIL PROTECTED]> wrote:
> Hello,
>
> Is it possible to monitor Delay Pools with MRTG?
>
> Regards,
>
> Graz
On sön, 2008-10-05 at 09:04 +0200, Sommariva Graziano wrote:
> Is it possible to monitor Delay Pools with MRTG?
There is no SNMP MIB definition for the delay pools counters.
BUt in theory it's possible to collect the data using cachemgr and feed
it into mrtg or rrdtool.. but it's probably about
MontyRee wrote:
> Hello, all.
>
> I saw much useful function named tproxy.
> So pleaase check below is possible or not.
>
>
> Client(192.168.3.2) ==> http-accelerator mode squid(10.10.1.2) ==> apache web
> server(10.10.1.1)
>
> When I see the log file at apache, only cache(10.10.1.2) ip wi
Thanks for your answer.
But in case of Commercial Web Application Firewall(WAF),
I found that tproxy was installed and some daemon like squid to filter the
web traffic transparently.
and the real client ip is seen at the origin server.
Is it a different case?
Thanks for your comments.
lör 2009-09-12 klockan 16:50 +1200 skrev Amos Jeffries:
> No its not.
>
> accel mode == reverse proxy == squid pretending to be a web server.
>
> tproxy == squid pretending not to be there.
But why is that? There is not really any technical reason why not TPROXY
can be used in reverse proxy mod
On Tue, 15 Sep 2009 01:31:08 +0200, Henrik Nordstrom
wrote:
> lör 2009-09-12 klockan 16:50 +1200 skrev Amos Jeffries:
>
>> No its not.
>>
>> accel mode == reverse proxy == squid pretending to be a web server.
>>
>> tproxy == squid pretending not to be there.
>
> But why is that? There is not r
tis 2009-09-15 klockan 12:28 +1200 skrev Amos Jeffries:
> The big reason is that TPROXY passes the IPs to Squid inverted via
> accept(). There is no probe like the NAT ORIGINAL_DST to separate the
> TPROXY and non-TPROXY received connections. The only way to identify this
> IP inversion is the fla
On Tue, 15 Sep 2009 04:13:20 +0200, Henrik Nordstrom
wrote:
> tis 2009-09-15 klockan 12:28 +1200 skrev Amos Jeffries:
>
>> The big reason is that TPROXY passes the IPs to Squid inverted via
>> accept(). There is no probe like the NAT ORIGINAL_DST to separate the
>> TPROXY and non-TPROXY received
tis 2009-09-15 klockan 14:43 +1200 skrev Amos Jeffries:
> > Yes, but here we are talking about the other side, when Squid makes the
> > outgoing connection. That part do not need to depend in any way on how
>
> We are talking about setting http_port (incoming) options. Or so I thought.
I am not
Joel Rosental R. wrote:
Hi,
I would want to know if is possible to authenticate squid against a
Novell eDirectory 8.8.4?
By what i've read in docs found, there is kind of an incompatibility
with versions >= 8 because of some issue with how new versions store IP
Addresses from the clients.
ed
> Dear friends,
>
> I am implementing acls, thankfully with the help from squid mailing
> lists, I have successfully made it works in restricting certain users to
> certain urls only. However, I just need one more step to make it
> complete. My boss wants all blocked urls to be redirected to an
Yong Bong Fong ha scritto:
Dear friends,
I am implementing acls, thankfully with the help from squid mailing
lists, I have successfully made it works in restricting certain users
to certain urls only. However, I just need one more step to make it
complete. My boss wants all blocked urls to
Thanks a lot Matteo!
> Yong Bong Fong ha scritto:
>
>> Dear friends,
>>
>> I am implementing acls, thankfully with the help from squid mailing
>> lists, I have successfully made it works in restricting certain users
>> to certain urls only. However, I just need one more step to make it
>> comp
Thanks a lot Mark!
> > Dear friends,
>>
>> I am implementing acls, thankfully with the help from squid mailing
>> lists, I have successfully made it works in restricting certain users to
>> certain urls only. However, I just need one more step to make it
>> complete. My boss wants all blocked
On Tue, 31 May 2011 22:45:01 +0200, Rafal Zawierta wrote:
Hello,
I have (almost) running environment with squid3 and havp as parent to
it. It works fine as long as user will use only http and https
protocol. But sometimes there is url on website
ftp://ftp.debian.org/file.iso (whatever) - with ft
On 14/10/10 22:02, Dieter Bloms wrote:
Hello,
when a user canceled a download, I can't see it in the access.log and
cache.log.
Is it possible to log the reason, why the download is cancled.
The ONLY way to cancel a download in TCP is to close the connection.
There is no reason for closure.
On 21.09 14:32, Hannes Schmidt wrote:
> I would like my Squid proxy to add a cookie header to all requests going to
> one particular site. Can I do that easily?
>
> Background: My website uses a logfile statistics package. However, the
> people in my department access this website frequently, e.g.
On Tue, 21 Sep 2004, Hannes Schmidt wrote:
I would like my Squid proxy to add a cookie header to all requests going to
one particular site. Can I do that easily?
This is possible using the redirector header patch published on the list
some time ago.
Background: My website uses a logfile statistic
>
> Hi
> i have this situation
> a browser which connects to an antivirus (hbedv) proxy
> which connects to squid
> then squid connect to internet
>
>
> but i like browsers to connect to squid
> then squid will connect to proxy AV
> then proxy AV will go to the internet
>
> how to tell squi
thx the fact is, the antivirus proxy scan http on a TCP port, FTP on
another and don t analyse ssl
so i have to find the config which says:
cachepeer http to 127.0.0.1:8090
cachepeer ftp to 127.0.0.1:8091
cachepeer ssl direct_to_internet
thx
>
>
>>
>> Hi
>> i have this situation
>> a browser
thx the fact is, the antivirus proxy scan http on a TCP port, FTP on
another and don t analyse ssl
so i have to find the config which says:
cachepeer http to 127.0.0.1:8090
cachepeer ftp to 127.0.0.1:8091
cachepeer ssl direct_to_internet
thx
>
>
>>
>> Hi
>> i have this situation
>> a browser
On Thu, 30 Sep 2004 [EMAIL PROTECTED] wrote:
but i like browsers to connect to squid
then squid will connect to proxy AV
then proxy AV will go to the internet
how to tell squid to redirect TCP 80 to proxy AV?
Squid FAQ 4.9 How do I configure Squid forward all requests to another
proxy? http://www.
>
>
> thx the fact is, the antivirus proxy scan http on a TCP port, FTP on
> another and don t analyse ssl
>
> so i have to find the config which says:
>
> cachepeer http to 127.0.0.1:8090
> cachepeer ftp to 127.0.0.1:8091
> cachepeer ssl direct_to_internet
>
(btw these syntaxes are invali
Hi,
You need to specify a parent cache
See: http://squid.visolve.com/squid/squid24s1/neighbour.htm#cache_peer
Bart
[EMAIL PROTECTED] wrote:
Hi
i have this situation
a browser which connects to an antivirus (hbedv) proxy
which connects to squid
then squid connect to internet
but i like browsers to
On 29/01/11 02:02, Jason Doran wrote:
RHEL6
squid-3.1.4-1.el6.x86_64
kernel 2.6.32-71.14.1.el6.x86_64
Hi,
I suspect this is not possible, but I thought I would ask anyway. I have:
acl SSL_ports port 443
acl CONNECT method CONNECT
http_access deny CONNECT !SSL_ports
When a user tries a CONNEC
Go with DansGuardian. Squid can't do it.
TB
Hung Ng wrote:
Hello. There's this site http://celebritygalleries.org
that some students which is not adult because we
checked, but we also checked the words and some of the
words in the image tags are suggestive. We'd like to
allow them to surf, but
Odhiambo Washington wrote:
Hello gurus,
I have been trying the whole day to get Squid to work as a reverse
proxy/accelerator for OWA and RPC-over-https with no sucess. I believe
I've come to my /etc on this!
I have read the Wiki entries and this thread:
http://www.nabble.com/Forwarding-Denied-wh
On Sun, Jun 1, 2008 at 1:38 PM, Amos Jeffries <[EMAIL PROTECTED]> wrote:
> Odhiambo Washington wrote:
>>
>> Hello gurus,
>>
>> I have been trying the whole day to get Squid to work as a reverse
>> proxy/accelerator for OWA and RPC-over-https with no sucess. I believe
>> I've come to my /etc on this
Odhiambo Washington wrote:
On Sun, Jun 1, 2008 at 1:38 PM, Amos Jeffries <[EMAIL PROTECTED]> wrote:
Odhiambo Washington wrote:
Hello gurus,
I have been trying the whole day to get Squid to work as a reverse
proxy/accelerator for OWA and RPC-over-https with no sucess. I believe
I've come to my
On Mon, Jun 2, 2008 at 2:37 AM, Amos Jeffries <[EMAIL PROTECTED]> wrote:
> Odhiambo Washington wrote:
>>
>> On Sun, Jun 1, 2008 at 1:38 PM, Amos Jeffries <[EMAIL PROTECTED]>
>> wrote:
>>>
>>> Odhiambo Washington wrote:
Hello gurus,
I have been trying the whole day to get Squid t
On mån, 2008-06-02 at 11:09 +0300, Odhiambo Washington wrote:
> it, especially because Outlook needs the https:// URI. However, as we
> are going to do the SSL offloading on the accelerator, I believe
> http:// would suffice.
It will, but you need to configure Squid cache_peer with the
front-end-h
On Mon, Jun 2, 2008 at 12:39 PM, Henrik Nordstrom
<[EMAIL PROTECTED]> wrote:
> On mån, 2008-06-02 at 11:09 +0300, Odhiambo Washington wrote:
>> it, especially because Outlook needs the https:// URI. However, as we
>> are going to do the SSL offloading on the accelerator, I believe
>> http:// would
On mån, 2008-06-02 at 13:41 +0300, Odhiambo Washington wrote:
> (actually, this is supposed to be the only entry for cache_peer I am
> goingto have?)
If you only have one server, and that server is only talking http then
yes there is only a single cache_peer..
> That has worked. It also requied
On Mon, Jun 2, 2008 at 7:27 PM, Henrik Nordstrom
<[EMAIL PROTECTED]> wrote:
> On mån, 2008-06-02 at 13:41 +0300, Odhiambo Washington wrote:
>> (actually, this is supposed to be the only entry for cache_peer I am
>> goingto have?)
>
> If you only have one server, and that server is only talking http
iambo Washington [mailto:[EMAIL PROTECTED]
> Sent: Monday, June 02, 2008 11:41 AM
> To: Squid users
> Subject: Re: [squid-users] Is it possible to have squid as do Proxy and
> OWA/RPCoHTTPS accelerator?
>
> On Mon, Jun 2, 2008 at 7:27 PM, Henrik Nordstrom
> <[EMAIL PROTECTED]
lan Lehman
-Original Message-
From: Odhiambo Washington [mailto:[EMAIL PROTECTED]
Sent: Monday, June 02, 2008 11:41 AM
To: Squid users
Subject: Re: [squid-users] Is it possible to have squid as do Proxy and
OWA/RPCoHTTPS accelerator?
On Mon, Jun 2, 2008 at 7:27 PM, Henrik Nordstrom
<[EMA
Alan Lehman wrote:
>> My current config (which works for OWA, but not RPCoHTTP):
>>
>> extension_methods RPC_IN_DATA RPC_OUT_DATA
>>
>> https_port public_ip_for_owa:443
cert=/usr/share/ssl/owa/combined.crt key=/usr/share/ssl/owa/owa.key
defaultsite=owa.tld.com
>>
>> https_port public_
So I have OWA and RPCoHTTPS accelerator working on 3.0, with forward
proxy on a separate instance of 2.6. Now I'm building a new Redhat box
and I would like to handle both my normal LAN proxy and reverse proxy
for OWA, RPCoHTTPS and Activesync on one instance of Squid. It sounded
like 2.6 should be
> root@backend4a:~# ifstat -b
>eth0eth1eth2eth3
> eth4eth5eth6
> Kbps in Kbps out Kbps in Kbps out Kbps in Kbps out Kbps in Kbps
> out Kbps in Kbps out Kbps in Kbps out Kbps i
can't you just block */RealMedia/ads/* via squidguard or something? they're
only annoying adverts anyway :)
> Hi,
>
> I would like to cache requests for Shockwave Flash files. The problem
> is, these files have a bunch of cgi/query parameters that is
> changed for
> every request, making Squid f
On Mon, 13 Sep 2004, Anders Nordby wrote:
1095077099.840 25 195.159.125.115 TCP_MISS/200 15910 GET
http://ap.oasfile.aftenposten.no/ap/rosaindex/768x50_aftenposten.swf?clickTAG1=http%3A//primetime.ad.primetime.net/RealMedia/ads/click_lx.ads/www.aftenposten.no/forside/5278/Top1/primetime/ap_rosa
Anders Nordby wrote:
Hi,
I would like to cache requests for Shockwave Flash files. The problem
is, these files have a bunch of cgi/query parameters that is changed for
every request, making Squid fetch them from the web server each time.
The output from the webserver is the same each time, so there
Hi,
A bit old this mail, but since it is still a big issue for me I try to
continue the thread.
On Mon, Sep 13, 2004 at 02:31:38PM +0200, Henrik Nordstrom wrote:
>>1095077099.840 25 195.159.125.115 TCP_MISS/200 15910 GET
>>http://ap.oasfile.aftenposten.no/ap/rosaindex/768x50_aftenposten.swf?c
Hi,
On Mon, Sep 13, 2004 at 02:32:44PM +0200, ecasbas wrote:
>>1095077099.840 25 195.159.125.115 TCP_MISS/200 15910 GET
>>http://ap.oasfile.aftenposten.no/ap/rosaindex/768x50_aftenposten.swf?clickTAG1=http%3A//primetime.ad.primetime.net/RealMedia/ads/click_lx.ads/www.aftenposten.no/forside/527
On Wed, 12 Jan 2005, Anders Nordby wrote:
I did manage to make Squid cache the files using the Squirm redirector
plugin (http://squirm.foote.com.au/) - yay. One small step for Squid,
one giant leap for Anders. ;-) However, I'm facing a volume of at least
250 hits per second per server, where most (
On Wed, 12 Jan 2005, Anders Nordby wrote:
Because of this I'm considering to not use Squid for caching these files
at all. The application vendor says they do not recommend using
non-random URLs for the files, which effectively prevents Squid from
caching them easily.
Which is probably why they do
> -Original Message-
> From: Pavel M. Ivanchev [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, August 10, 2005 9:47 AM
> To: squid-users@squid-cache.org
> Subject: [squid-users] is it possible squid to use
> simultaneously two real IP's on eth0 for http request?
>
>
> Hi all!
> The quiestio
On 8/10/05, Pavel M. Ivanchev <[EMAIL PROTECTED]> wrote:
> Hi all!
> The quiestion is maybe little bit confusing,but in simply words i just
> want to explain the followind situation :
> i have squid with two ethernet cards - eth0 and eth1,eth0 is connected
> to Internet with 4 real IP addresses-eth
Squid is a web content cache engine, not a filesystem cache
technology. The filesystem cache / acelleration systems are a
completely different class of technology.
If the Alfresco system is doing database-like things on the back end,
filesystem cacheing in front of it is unlikely to be entirely s
On 15/03/2014 6:46 p.m., Amm wrote:
> Hello,
>
> I would like to mark outgoing packet (on server side) with SAME MARK as on
> incoming (NATed or CONNECTed) packet.
>
> There is option tcp_outgoing_mark with which I can mark packets.
>
> But there is no ACL option to check incoming mark.
>
>
>
On 03/15/2014 05:11 PM, Amos Jeffries wrote:
On 15/03/2014 6:46 p.m., Amm wrote:
I would like to mark outgoing packet (on server side) with SAME MARK as on
incoming (NATed or CONNECTed) packet.
http://www.squid-cache.org/Doc/config/qos_flows/
Squid default action is to pass the netfilter
On 03/15/2014 08:03 PM, Amm wrote:
On 03/15/2014 05:11 PM, Amos Jeffries wrote:
On 15/03/2014 6:46 p.m., Amm wrote:
I would like to mark outgoing packet (on server side) with SAME MARK
as on incoming (NATed or CONNECTed) packet.
http://www.squid-cache.org/Doc/config/qos_flows/
Squid de
On Sat, 2014-03-15 at 21:13 +0530, Amm wrote:
> Ok I read further on that link itself, somewhere it says:
>
> disable-preserve-miss
> This option disables the preservation of the TOS or netfilter
> mark. By default, the existing TOS or netfilter mark value of
> the response comin
On 03/16/2014 03:02 AM, Andrew Beverley wrote:
I used (and created) the patch to get the value from the remote server.
However, I can't remember whether it does it the other way as well (at
the time I thought I'd written the documentation so clearly, but coming
back to it now it's not clear...)
Hi
So documentation is right but placement of the statement is possibly
wrong. Its not highlighted right infront. i.e qos_flows applies only
for packets from server to client(squid) NOT from client to server.
Is it possible to do reverse too? Or atleast have an acl where I can
check incoming
On Thu, 2014-03-27 at 10:26 +, Ed W wrote:
> Yes, I'm still really interested to implement this. I got as far as
> doing some investigation a few weeks back.
Thanks for looking into it. I'd like to sort it myself, but don't have
the time at the moment. In the meantime, I'll aim to submit a p
> Hi,
>
> Is it possible to allow access to a single site, eg. a forum site, and
> allow all the images to display as well even if they are not hosted on
> the forum site itself?
Squid by itself doesn;t scan eth data portion of HTTP objects. It has no
way of knowing where the images are going to c
77 matches
Mail list logo
