Hi I'm having trouble setting a transparent proxy in our network. For testing I've asked our net admin to transparently forward all of my http traffic to squid port but when I try to open a page I get *Access Denied *error and a warring about Forwarding loop. As you can see in tcpdump squid sends request to it's machine and not to outside and I've no idea why this happens. Can you help my about this? I feel like I'm missing something tiny here.
Squid box: 172.16.1.5 My box: 192.168.10.122 Thanks -------------------- tcpdump -ntAi any port ! 22 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [S], seq 1494863721, win 29200, options [mss 1460,sackOK,TS val 5421406 ecr 0,nop,wscale 7], length 0 IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [S.], seq 2174214961, ack 1494863722, win 14480, options [mss 1460,sackOK,TS val 733876 ecr 5421406,nop,wscale 4], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 1, win 229, options [nop,nop,TS val 5421406 ecr 733876], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [P.], seq 1:75, ack 1, win 229, options [nop,nop,TS val 5421406 ecr 733876], length 74 GET / HTTP/1.1 User-Agent: curl/7.38.0 Host: google.com Accept: */* IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [.], ack 75, win 905, options [nop,nop,TS val 733876 ecr 5421406], length 0 IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [S], seq 717864720, win 32792, options [mss 16396,sackOK,TS val 733876 ecr 0,nop,wscale 4], length 0 IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [S.], seq 2077204582, ack 717864721, win 32768, options [mss 16396,sackOK,TS val 733876 ecr 733876,nop,wscale 4], length 0 IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [.], ack 1, win 2050, options [nop,nop,TS val 733876 ecr 733876], length 0 *IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [P.], seq 1:198, ack 1, win 2050, options [nop,nop,TS val 733876 ecr 733876], length 197* E.....@[email protected]*...{..g....[...... ..2...2.GET / HTTP/1.1 User-Agent: curl/7.38.0 Host: google.com Accept: */* Via: 1.1 172.16.1.5 (squid/3.4.8) X-Forwarded-For: 192.168.10.122 Cache-Control: max-age=259200 Connection: keep-alive IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [.], ack 198, win 2048, options [nop,nop,TS val 733876 ecr 733876], length 0 E..4..@[email protected]..{..g*.......ZQ..... ..2...2. IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [P.], seq 1:3633, ack 198, win 2048, options [nop,nop,TS val 733876 ecr 733876], length 3632 E..d..@.@.?..........8..{..g*.......h...... ..2...2.HTTP/1.1 403 Forbidden Server: squid/3.4.8 Mime-Version: 1.0 Date: Wed, 15 Apr 2015 10:02:33 GMT Content-Type: text/html Content-Length: 3268 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from 172.16.1.5 X-Cache-Lookup: MISS from 172.16.1.5:8080 Via: 1.1 172.16.1.5 (squid/3.4.8) Connection: keep-alive <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" " http://www.w3.org/TR/html4/strict.dtd";> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> </head><body id=ERR_ACCESS_DENIED> <div id="titles"> <h1>ERROR</h1> <h2>The requested URL could not be retrieved</h2> </div> <hr> <div id="content"> <p>The following error was encountered while trying to retrieve the URL: <a href="http://google.com/";>http://google.com/</a></p> <blockquote id="error"> <p><b>Access Denied.</b></p> </blockquote> </div> </body></html> IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [.], ack 3633, win 2048, options [nop,nop,TS val 733876 ecr 733876], length 0 IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [P.], seq 1:469, ack 75, win 905, options [nop,nop,TS val 733876 ecr 5421406], length 468 HTTP/1.1 403 Forbidden Server: squid/3.4.8 Mime-Version: 1.0 Date: Wed, 15 Apr 2015 10:02:33 GMT Content-Type: text/html Content-Length: 3268 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from 172.16.1.5 X-Cache-Lookup: MISS from 172.16.1.5:8080 X-Cache: MISS from 172.16.1.5 X-Cache-Lookup: MISS from 172.16.1.5:8080 Via: 1.1 172.16.1.5 (squid/3.4.8), 1.1 172.16.1.5 (squid/3.4.8) Connection: keep-alive IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [.], seq 469:3365, ack 75, win 905, options [nop,nop,TS val 733876 ecr 5421406], length 2896 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" " http://www.w3.org/TR/html4/strict.dtd";> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> ... </head><body id=ERR_ACCESS_DENIED> <div id="titles"> <h1>ERROR</h1> <h2>The requested URL could not be retrieved</h2> </div> <hr> <div id="content"> <p>The following error was encountered while trying to retrieve the URL: <a href="http://google.com/";>http://google.com/</a></p> <blockquote id="error"> <p><b>Access Denied.</b></p> </blockquote> </div> </body></html> IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 469, win 237, options [nop,nop,TS val 5421408 ecr 733876], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 1917, win 260, options [nop,nop,TS val 5421408 ecr 733876], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3365, win 282, options [nop,nop,TS val 5421408 ecr 733876], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3737, win 305, options [nop,nop,TS val 5421408 ecr 733876], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [F.], seq 75, ack 3737, win 305, options [nop,nop,TS val 5421408 ecr 733876], length 0 IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [F.], seq 3737, ack 76, win 905, options [nop,nop,TS val 733878 ecr 5421408], length 0 IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3738, win 305, options [nop,nop,TS val 5421411 ecr 733878], length 0 -------------------------- Squid config acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localhet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 53 # http acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT #external_acl_type AclHelper %SRC %DST /usr/bin/python /etc/squid3/external_acl.py #acl Acl external AclHelper http_access deny !Safe_ports # Deny requests to certain unsafe ports http_access deny CONNECT !SSL_ports # Deny CONNECT to other than secure SSL ports http_access allow localhost manager # Only allow cachemgr access from localhost http_access deny manager # Only allow cachemgr access from localhost http_access deny to_localhost http_access allow localnet http_access allow localhost http_access deny all #ssl_bump server-first all #always_direct allow all http_port 3128 intercept http_port 8080 # avoid ERROR: No forward-proxy ports configured. #https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/custom_csr.pem coredump_dir /var/spool/squid3 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 sslcrtd_program /usr/lib/squid3/ssl_crtd -ds /var/spool/squid3_ssldb -M 4MB sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER sslproxy_cert_adapt setCommonName shutdown_lifetime 3 seconds visible_hostname squid debug_options ALL,1 33,2 ------------------- iptables root@proxy:~# iptables -L -t filter Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@proxy:~# iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination root@proxy:~# iptables -L -t mangle Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination -------------------- Squid info root@proxy:~/squid# squid3 -v Squid Cache: Version 3.4.8 Debian linux configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid3' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--datadir=/usr/share/squid3' '--sysconfdir=/etc/squid3' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-follow-x-forwarded-for' '--enable-icap-client' '--enable-auth-basic=DB,fake,getpwnam,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,smb_lm' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid3' '--with-logdir=/var/log/squid3' '--with-pidfile=/var/run/squid3.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-ssl' '--enable-ssl-crtd' '--with-openssl' '--enable-build-info=Debian linux' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall' 'LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security' -------------------------- Router config Flags: X - disabled, I - invalid, D - dynamic 0 ;;; This rule is being used for testing url-redirector service chain=prerouting action=mark-routing new-routing-mark=url-redirector-test-443 passthrough=yes protocol=tcp src-address=192.168.10.122 dst-address=!172.30.30.1 dst-port=443 1 ;;; This rule is being used for testing url-redirector service chain=prerouting action=mark-routing new-routing-mark=url-redirector-test-80 passthrough=yes protocol=tcp src-address=192.168.10.122 dst-address=!172.30.30.1 dst-port=80 Flags: X - disabled, I - invalid, D - dynamic 2 ;;; url-test chain=dstnat action=dst-nat to-addresses=172.16.1.5 to-ports=3128 protocol=tcp routing-mark=url-redirector-test-80 3 ;;; Url-test chain=dstnat action=dst-nat to-addresses=172.16.1.5 to-ports=3129 protocol=tcp routing-mark=url-redirector-test-443 -- Live long and prosper, K1.H <http://k1h.ir/>
_______________________________________________ squid-users mailing list [email protected] http://lists.squid-cache.org/listinfo/squid-users
