Hi All, As an addition to my yesterday's issue,
Tail -f cache.log, I am getting the following: 015/03/06 13:54:02| WARNING: Forwarding loop detected for: GET /Artwork/SN.png HTTP/1.1 Host: www.squid-cache.org Accept: image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36 Referer: http://www.openbsd.org/ Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8,ar;q=0.6 Via: 1.1 ISN-PHC-CACHE (squid/3.5.2) X-Forwarded-For: 10.0.0.23 Cache-Control: max-age=0 Connection: keep-alive 2015/03/06 13:54:02| WARNING: Forwarding loop detected for: GET /favicon.ico HTTP/1.1 Host: www.openbsd.org Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36 Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8,ar;q=0.6 Via: 1.1 ISN-PHC-CACHE (squid/3.5.2) X-Forwarded-For: 10.0.0.23 Cache-Control: max-age=259200 Connection: keep-alive Any ideas? ---------- Forwarded message ---------- From: Monah Baki <monahb...@gmail.com> Date: Thu, Mar 5, 2015 at 7:19 AM Subject: squid intercept config To: Squid Users <squid-us...@squid-cache.org> Hi all, can anyone verify if this is correct, need to make ure that users will be able to access the internet via the squid. Running FreeBSD with a single interface with Squid-3.5.2 Policy based routing on Cisco with the following: interface GigabitEthernet0/0/1.1 encapsulation dot1Q 1 native ip address 10.0.0.9 255.255.255.0 no ip redirects no ip unreachables ip nat inside standby 1 ip 10.0.0.10 standby 1 priority 120 standby 1 preempt standby 1 name HSRP ip policy route-map CFLOW ip access-list extended REDIRECT deny tcp host 10.0.0.24 any eq www permit tcp host 10.0.0.23 any eq www route-map CFLOW permit 10 match ip address REDIRECT set ip next-hop 10.0.0.24 In my /etc/pf.conf rdr pass inet proto tcp from 10.0.0.0/8 to any port 80 -> 10.0.0.24 port 3129 # block in pass in log quick on bge0 pass out log quick on bge0 pass out keep state and finally in my squid.conf: http_port 3128 http_port 3129 intercept And for testing purposes from the squid server: ./squidclient -h 10.0.0.24 -p 3128 http://www.freebsd.org/ If I replace -p 3128 with -p 80, I get a access denied, and if I omit the -p 3128 completely, I can access the websites. tcpdump with (-p 3128) 13:15:02.681106 IP ISN-PHC-CACHE.44017 > wfe0.ysv.freebsd.org.http: Flags [.], ack 17377, win 1018, options [nop,nop,TS val 985588797 ecr 1054387720], length 0 13:15:02.681421 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags [.], seq 17377:18825, ack 289, win 1040, options [nop,nop,TS val 1054387720 ecr 985588501], length 1448 13:15:02.681575 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags [.], seq 18825:20273, ack 289, win 1040, options [nop,nop,TS val 1054387720 ecr 985588501], length 1448 Did I miss anything? Thanks Monah
_______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users