Hi,
today, some users complained about poor respons time of the webproxy.
Searching for a possible reason, I found, that the proxy makes a DNS
request (mostly AAAA but also A) for every http request. We are behind a
firewall and resolving internet names is impossible, we have to use
parent proxies to reach the internet and I thought, I configured squid
that way (config at the end of the mail). When I saw the DNS queries, my
first guess was a dst-ACL, but there are no dst-ACLs.
I recorded some traffic at the proxy and looked inside with wireshark,
for every http request the proxy queries both it's nameservers for the
IP(v6) of the destination host and after these queries failed the http
request ist forwarded to the parend proxy, the content ist fetched from
web and delivered to the client.
Last week, I made some changes to the logformat, but switching back to
the original format did not stop the DNS queries.
Where is the error in my config, what causes the DNS queries?
Thanks in advance
Thomas
------------------------
squid.conf:
^^^^^^^^^^^
include /mnt/squid3-shared-settings/*.conf
visible_hostname proxy.my.domain.org
hierarchy_stoplist cgi-bin ?
cache_peer parent-ip1 parent 80 7 no-query no-digest
cache_peer parent-ip2 parent 80 7 no-query no-digest
cache_peer proxy.domain.org parent 9999 7 no-query no-digest
cache_peer_access proxy.domain.org allow MYDOMAINS
cache_peer_access parent-ip-1 deny MYDOMAINS
cache_peer_access parent-ip-2 deny MYDOMAINS
### MEMORY CACHE OPTIONS ...
### Disk-Cache Optionen ...
------------------------------------------------
access.conf:
^^^^^^^^^^^^
acl localhost src 127.0.0.1/32
acl Safe_ports port "...SafePorts.txt"
acl SSL_ports port 443 563 8443 9443
acl CONNECT method CONNECT
acl MYNET src ip-range1
acl MYNET src ip-range2
acl MYNET ...
acl MY-LOCAL-DOMAIN dstdomain .my.domain.org
acl badURLs dstdomain "...badURLs.txt"
acl goodTLDs dstdomain "...goodTLDs.txt"
acl adminPCs src "...adminPCs.txt"
acl labPcs src "...labor-pcs.txt"
acl MYDOMAINS dstdomain .domain.org
acl MYDOMAINS dstdomain .domain.net
acl MYDOMAINS dstdomain .domain.eu
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny labPcs
http_access allow adminPCs
http_access deny badURLs
http_access deny !goodTLDs
http_access allow MYNET
http_access deny all
htcp_access deny all
htcp_clr_access deny all
----------------------------------------------
common-server.conf:
^^^^^^^^^^^^^^^^^^^
http_port 8080
error_directory /usr/share/squid/errors/de
log_icp_queries on
cache_effective_user squid
cache_effective_group nogroup
cache_mgr me@xxxxxxxxxxxxx
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
-----------------------------------------------------------
logging.conf:
^^^^^^^^^^^^^
logformat myformat %tl %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<A
%mt
cache_access_log /var/log/squid/access.log myformat
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
pid_filename /var/log/squid/squid.pid
debug_options ALL,1
------------------------------------------------------------
request-forward.conf:
^^^^^^^^^^^^^^^^^^^^^
always_direct allow MY-LOCAL-DOMAIN
never_direct deny MY-LOCAL-DOMAIN
never_direct allow all
