Search squid archive

Re: Access Denied with transparent mode on FreeBSD

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





2013-01-24 09:41, iain skrev:
FreeBSD 9.1 installation with Squid installed from ports and using
transparent mode results in "Access Denied" messages when trying to
browse regular HTTP.

Log files fill up with:

*** LOGFILE ***
1359013451.945      0 XXX.XXX.XXX.25 TCP_MISS/403 4272 GET
http://www.facebook.com/ - HIER_NONE/- text/html
1359013451.946    139 XXX.XXX.XXX.137 TCP_MISS/403 4369 GET
http://www.facebook.com/ - HIER_DIRECT/XXX.XXX.XXX.25 text/html
1359013451.966      0 XXX.XXX.XXX.25 TCP_MISS/403 4071 GET
http://www.squid-cache.org/Artwork/SN.png - HIER_NONE/- text/html
1359013451.967      1 XXX.XXX.XXX.137 TCP_MISS/403 4168 GET
http://www.squid-cache.org/Artwork/SN.png - HIER_DIRECT/XXX.XXX.XXX.25
text/html
1359013451.992      0 XXX.XXX.XXX.25 TCP_MISS/403 4179 GET
http://www.facebook.com/favicon.ico - HIER_NONE/- text/html
1359013451.992      1 XXX.XXX.XXX.137 TCP_MISS/403 4276 GET
http://www.facebook.com/favicon.ico - HIER_DIRECT/XXX.XXX.XXX.25 text/html
*** END ***

Squid.conf file is:

*** SQUID.CONF ***
visible_hostname XXXXXXXXXXXXXXXXXXXXX
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged)
machines
acl localnet src XXXX:XXXX:ffff::/48 # More IPv6 ...
acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT
acl cacti src XXX.XXX.0.154/32
acl snmpstats snmp_community tainROcacti
acl sliema_net_fine src XXX.XXX.0.0/25
acl sliema_net_core src XXX.XXX.0.128/25
acl sliema_net_gnet src XXX.XXX.1.0/25
acl sliema_net_norm src XXX.XXX.1.128/25
acl topsites dstdomain "/usr/local/etc/squid/squid-topsites.text"
acl youtube dstdomain .youtube.com
acl youtube dstdomain .youtu.be
acl youtube dstdomain .googlevideo.com
acl cdners dstdomain .akamai.com
acl cdners dstdomain .llnwd.net
acl facebook dstdomain .facebook.com
tcp_outgoing_address XXX.XXX.XXX.25 sliema_net_norm
tcp_outgoing_address XXX.XXX.XXX.25 sliema_net_fine
tcp_outgoing_address XXX.XXX.XXX.25 sliema_net_core
snmp_port 3401
snmp_access allow snmpstats cacti
snmp_access deny all
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 intercept
http_port 80
cache_dir ufs /var/squid/cache/squid 100 16 256
cache_mem 256 MB
coredump_dir /var/squid/cache/squid
refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200
refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90%
432000
refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$
43200 90% 432000
refresh_pattern -i \.index.(html|htm)$ 0 40% 10080
refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320
refresh_pattern -i youtube.com/.* 43200 90% 432000
refresh_pattern -i youtu.be/.* 43200 90% 432000
refresh_pattern -i ytimg.com/.* 43200 90% 432000
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320
*** END ***

And squid compile options are:

*** SQUID VERSION ***
Squid Cache: Version 3.2.6
configure options:
	'--with-default-user=squid'
	'--bindir=/usr/local/sbin'
	'--sbindir=/usr/local/sbin'
	'--datadir=/usr/local/etc/squid'
	'--libexecdir=/usr/local/libexec/squid'
	'--localstatedir=/var/squid'
	'--sysconfdir=/usr/local/etc/squid'
	'--with-logdir=/var/log/squid'
	'--with-pidfile=/var/run/squid/squid.pid'
	'--enable-auth'
	'--enable-build-info'
	'--enable-loadable-modules'
	'--enable-removal-policies=lru heap'
	'--disable-epoll'
	'--disable-linux-netfilter'
	'--disable-linux-tproxy'
	'--disable-translation'
	'--enable-auth-basic=DB MSNT MSNT-multi-domain NCSA PAM POP3 RADIUS
fake getpwnam'
	'--enable-auth-digest=file'
	'--enable-external-acl-helpers=file_userip unix_group'
	'--enable-auth-negotiate=none'
	'--enable-auth-ntlm=fake smb_lm'
	'--enable-storeio=diskd rock ufs aufs'
	'--enable-disk-io=AIO Blocking DiskDaemon IpcIo Mmapped DiskThreads'
	'--enable-log-daemon-helpers=file'
	'--enable-url-rewrite-helpers=fake'
	'--enable-icmp'
	'--enable-htcp'
	'--disable-forw-via-db'
	'--disable-cache-digests'
	'--enable-wccp'
	'--enable-wccpv2'
	'--disable-eui'
	'--enable-ipfw-transparent'
	'--enable-pf-transparent'
	'--enable-ipf-transparent'
	'--disable-follow-x-forwarded-for'
	'--enable-ecap'
	'--disable-icap-client'
	'--disable-esi'
	'--enable-kqueue'
	'--prefix=/usr/local'
	'--mandir=/usr/local/man'
	'--infodir=/usr/local/info/'
	'--build=amd64-portbld-freebsd9.1'
'build_alias=amd64-portbld-freebsd9.1' 'CC=cc' 'CFLAGS=-O2 -pipe
-I/usr/local/include -fno-strict-aliasing' 'LDFLAGS= -pthread
-L/usr/local/lib' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe
-I/usr/local/include -fno-strict-aliasing' 'CPP=cpp'
'PKG_CONFIG=pkgconf' --enable-ltdl-convenience
*** END ***

This is basically a working 2.7 installation config that has been moved
onto a 3.2 box with some minor tweaks in the new config.

Any help appreciated.

Iain.



I saw the same behaviour when I upgraded. See my posts "Upgrade of SQUID from 3.1 to 3.2 on Freebsd 8.3" earlier this month.

The only solution I found was to revert to 3.1.

I suspect that there's a parameter we need to use while compiling but I don't know which one.

/Leslie


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux