On 08.11.2012 11:08, Nick Bright wrote:
Greetings,
We're working to attempt to get a completely transparent proxy up and
running. By completely transparent I mean:
1) The web server should see the clients' actual IP (not the proxy)
2) The client should see the response coming back from the IP of the
web server.
We're trying to implement this with WCCPv2 Interception on a
7204vxr/NPE-G1 with IOS 12.3.15a.
The configuration guide has been explicitly followed at:
http://wiki.squid-cache.org/Features/Tproxy4
The machine is running CentOS 6. I've tried with the stock kernel,
and with 3.6.5 installed from elrepo.org. selinux is disabled. Using
the non-tproxy port in squid by explicitly configuring the proxy,
successfully proxies & caches traffic (proxy server ip reported by
web
server).
Squid version is 3.1.10-9.el6_3 from CentOS6 repository.
All commands successfully complete, but the proxy isn't working.
I've observed that:
1) The Cisco router sees the web cache as reported by "sh ip wccp"
(see attached sh_ip_wccp.txt).
2) tcpdump -i tun0 reports packets arriving from the Cisco router.
3) tcpdump -i eth2 reports packets leaving the cache server bound for
the destination web server
4) The destination web server shows no hits in the access_log file
5) tcpdump on the web server shows packets arriving from the client
IP address on port 80.
6) tcpdump on the web server shows packets leaving bound for the
client IP
... and yet #4 ?
What *type* of packets? ICMP packet-too-large messages have a way of
disappearing silently on some networks, and in some versions of TPROXY
kernels.
7) The client browser times out, receiving an HTML error from Squid
reporting "Connection to <server ip> failed."
8) When the timeout occurs, the squid access log reports
"TCP_MISS/504 4123 GET http://myip.valnet.net/ - DIRECT/64.254.32.23
text/html"
Just once or many times? the most common issue with TPROXY is
forwarding loops.
The other thing to look for is whether there is packet-level symmetry
in the network. Catching every single server->client packet at the WCCP
router and sending to Squid is critical.
I've attached numerous files containing statuses of various things
that need to be set, such as rp_filter sysctl values, output of "show
ip wccp", the squid.conf file, the cisco configuration, and the
contents of iptables.
Any advice appreciated.
Thanks,
Please update to squid-3.2 series if possible. There are some major
security vulnerabilities in transparent and intercepted traffic for
older versions. The latest releases will also help catch forwarding
loops better on intercepted traffic.
Amos
