|
I have one central Proxy Server running Squid 3.1.10 under CentOS 6.3 running locally here and also for our 2 remote sites for all http traffic. We are using Cisco’s WCCP and between the remote sites and the Squid is a ASA box. where the Proxy is running Site A and one of the remote Site B.
From either of the remote sites, when I try to access a printer or other web enabled device thru a browser that is not defined in squid.conf, I get access denied. This is strange to me as this request should be considered part of the internal network. When I put statements in squid.conf for this print, I then get connection timed out. From the Squid server, I cannot ping this remote printer due to the static route has 0.0.0.0 as its gateway address. See the below config for one of the remote sites: In /etc/rc.local file: iptunnel add tun-cc mode gre remote 192.168.253.16 local 10.80.166.227 dev eth0 ip link set dev tun-cc up ip route add 10.80.202.0/23 dev tun-cc metric 101 In squid.conf, this network should be considered internal: acl nga_net src 10.80.0.0/16 # Internal network (I have tried splitting out the ACL statements but same result) http_access allow nga_net If I look at the static routes on the server (netstat –rn or route –v) Destination Gateway Genmask Flags MSS Window irtt Iface 1.2.3.0 0.0.0.0 255.255.255.0 U 0 0 0 gre0 10.80.166.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 10.80.202.0 0.0.0.0 255.255.254.0 U 0 0 0 tun-cc (remote site) 0.0.0.0 10.80.166.254 0.0.0.0 UG 0 0 0 eth0 As you can see, the gateway for this remote site is the Internet (0.0.0.0) and thinking it should be 10.80.166.254. When I try to change the gateway for this static route, I get message – RTNETLINK answers: File exists If I remove the static route, I cannot get to any internal or Internet site from a remote site workstation. Due to the ASA in the traffic path of the remote sites, there is a gre tunnel setup for outbound traffic from the Squid server, without the tunnel the packet would be dropped by the ASA box. I know the best practices is to have a proxy server at each remote location, but this solution does work for most requests. Has anyone else run into this and found a solution, thanks…. ______________________________________________________ NIPRO GLASS ______________________________________________________ CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify NIPRO GLASS immediately. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of NIPRO GLASS. |
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
