On May 9, 2005 12:34 pm, jonathan wrote: > Le jeudi 05 mai 2005 à 06:32 -0400, Alistair Tonner a écrit : > > On May 4, 2005 11:09 am, jonathan wrote: > > > Hi, > > > I have a problem with squid and iptables. > > > I have to use "TCPMSS --clamp-mss-to-pmtu" to adapt the mtu with the > > ISP << BULK SNIPPAGE FOR BREVITY>>> > > > > You are doing the clamp in both FORWARD and OUTPUT. This is a > > good idea on > > > systems that require this function. However since we don't know the > > flow on < more snippage > > scheme of the network : > clients (win2000 and linux) > iptables+squid+advanced routing (same machine) > 2 differents ISPs > > > 2) where are the systems initiating the failed connections > located on that > > network > sorry, i don't understand your question ... I presume the 'clients' above > > 3) where is squid on that network? > > squid is on the same server than the iptables firewall (between clients > and the Internet) > > > 4) what are you doing to get connections to go through squid? > > Squid is configurated as transparent proxy, only the gateway IP address > is configurated on the clients. (nothing on the browsers) > > > 5) what other rules are there? > > classical rules are configurated, NAT for the local network... and > filtering rules for accessing typical ports (DROP INPUT AND FORWARD > setting by default). > > routing configuration makes some marked packets going through ISP1 and > other marked packet through ISP2. > Okay -- now we're getting somewhere ... 'classical rules' is nice and generic, but I will assume you mean that ESTABLISHED,RELATED are allowed on the top of INPUT, OUTPUT, FORWARD chains, and that selective packets are allowed through ... i.e port 53 udp for DNS, and that port 80 and 443 from the internal network to the world is redirected through squid. This function could be an issue -- specially if the redirect is in the wrong chain .. (IIRC should be in mangle PREROUTING and catch *all* traffic on those ports) Where are you marking packets and under what rules? You mention that some go out isp1 and others out isp2. Are you marking based on dns/mail/web/ftp/ or are you marking based on destination ip? I still think you want to a) dump all rules with iptables -L -n -v -x --line-numbers iptables -L -n -v -x --line-numbers -t nat iptables -L -n -v -x --line-numbers -t mangle, b) sanitize them by masking out real IP's c) send them here. Since you're likely using iproute2 your route tables wouldn't hurt either .. .equally sanitized. > > 6) what are the tcp_ecn settings on the firewall (I'd suspect > ecn before > > anything else since there are so many b0rken firewalls out there that > don't understand it) > the tcp_ecn is switch to "0". > > 7) what is meant by inaccessible? what functions of squid might > affect this? > it means that mozilla browser write the state "waiting for..." until the > timeout. Sometimes, it take a lot of time to display the website writing > the state " transferring data from ...", and the website appears several > minutes later or never appears ! And what is squid saying about these connections? > > I've noticed that squid's log display "TCP_NEGATIVE_HIT/404" many times > ( i suppose it's normal on some websites), but it seems like squid block > on this "error" message, trying to get a 2xx HTTP return code or > something like this. Is it possible ? googled: TCP_NEGATIVE_HIT: The request was for a negatively-cached object. Negative-caching refers to caching certain types of errors, such as "404 Not Found." The amount of time these errors are cached is controlled with the negative_ttl configuration parameter. 9.21 In the IP cache section, what's the difference between a hit, a negative hit and a miss? A HIT means that the document was found in the cache. A MISS, that it wasn't found in the cache. A negative hit means that it was found in the cache, but it doesn't exist. There are still quite a number of layers at which you might have issues. What happens when you drop squid out of the equation completely? What happens if you drop the TCPMSS clamps out of iptables? What happens if you drop the mark/route combo and use one/both ISPs? > > > > Is there a way to make it work? Certainly it can be made to work, ... I have here a large hammer, we'll make it work! *grin* > > > > > > thanks Good luck! Alistair Tonner
