On Wed, 17 Jun 2009 20:50:40 +0200, Tom Penndorf <tpenndorf@xxxxxxxxxxxxxxxxx> wrote: > Hello, > > i'm trying to get squid and wccp on a cisco asa 5510 running. These are > the steps, i've done to set it up. > #aptitude install squid3 > #vi /etc/squid3/squid.conf > acl manager proto cache_object > acl localhost src 127.0.0.1/32 > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl CONNECT method CONNECT > http_access allow manager localhost > http_access deny manager > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow localhost > http_access allow all > http_access deny all > icp_access deny all > htcp_access deny all > http_port 3128 transparent > hierarchy_stoplist cgi-bin ? > cache_dir aufs /var/cache/squid3 30000 32 256 > access_log /var/log/squid3/access.log squid > cache_log /var/log/squid3/cache.log > cache_store_log /var/log/squid3/store.log > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern (cgi-bin|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > wccp2_router 10.1.7.1 > wccp2_forwarding_method 1 > wccp2_return_method 1 > wccp2_service standard 0 > client_persistent_connections off > icp_port 3130 > coredump_dir /var/spool/squid3 > > #iptunnel add gre1 mode gre remote $ASA-EXT-IP local 10.1.7.2 dev eth0 > > #ifconfig gre1 10.1.7.2 netmask 255.255.255.255 up > > #echo 0 >/proc/sys/net/ipv4/conf/gre1/rp_filter > > #iptables -t nat -A PREROUTING -i gre1 -p tcp --dport 80 -j REDIRECT > --to-port 3128 > # echo 1 >/proc/sys/ipv4/ip_forward > > The asa detects the proxy and redirects the packets. On the > squid-machine, i can see the syn-packets from the client, but no > ack-packets. > The counter for the iptables-rule is also increasing. If i remove the > iptables-rule, the clients can browse the web, because the squid-machine > is acting as a router, so the gre-tunnel seems to work correctly. > After some research, i've found out, that the ack-packets are send out > at eth0. I don't think, it's the correct way. > > > Are there any things, i've forgotten? All howto's i've found, don't tell > me any other steps. Ack is probably between squidIP and clientIP. You may need to SNAT it back towards the client. http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect Amos
