Search squid archive

squid and wccp doesn't work

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

i'm trying to get squid and wccp on a cisco asa 5510 running. These are the steps, i've done to set it up.
#aptitude install squid3
#vi /etc/squid3/squid.conf
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow all
http_access deny all
icp_access deny all
htcp_access deny all
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
cache_dir aufs /var/cache/squid3 30000 32 256
access_log /var/log/squid3/access.log squid
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern (cgi-bin|\?)    0    0%    0
refresh_pattern .        0    20%    4320
wccp2_router 10.1.7.1
wccp2_forwarding_method 1
wccp2_return_method 1
wccp2_service standard 0
client_persistent_connections off
icp_port 3130
coredump_dir /var/spool/squid3

#iptunnel add gre1 mode gre remote $ASA-EXT-IP local 10.1.7.2 dev eth0

#ifconfig gre1 10.1.7.2 netmask 255.255.255.255 up

#echo 0 >/proc/sys/net/ipv4/conf/gre1/rp_filter

#iptables -t nat -A PREROUTING -i gre1 -p tcp --dport 80 -j REDIRECT --to-port 3128
# echo 1 >/proc/sys/ipv4/ip_forward

The asa detects the proxy and redirects the packets. On the squid-machine, i can see the syn-packets from the client, but no ack-packets. The counter for the iptables-rule is also increasing. If i remove the iptables-rule, the clients can browse the web, because the squid-machine is acting as a router, so the gre-tunnel seems to work correctly. After some research, i've found out, that the ack-packets are send out at eth0. I don't think, it's the correct way.


Are there any things, i've forgotten? All howto's i've found, don't tell me any other steps.

System is Debian lenny  with squid 3.0.STABLE8-3.

Is there anyone, who can give me a hint?

Thanks,

Tom


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux