Hi all, can anyone verify if this is correct, need to make ure that users will be able to access the internet via the squid.
Running FreeBSD with a single interface with Squid-3.5.2 Policy based routing on Cisco with the following:
interface GigabitEthernet0/0/1.1
encapsulation dot1Q 1 native
ip address 10.0.0.9 255.255.255.0
no ip redirects
no ip unreachables
ip nat inside
standby 1 ip 10.0.0.10
standby 1 priority 120
standby 1 preempt
standby 1 name HSRP
ip policy route-map CFLOW
ip access-list extended REDIRECT
deny tcp host 10.0.0.24 any eq www
permit tcp host 10.0.0.23 any eq www
route-map CFLOW permit 10
match ip address REDIRECT
set ip next-hop 10.0.0.24rdr pass inet proto tcp from 10.0.0.0/8 to any port 80 -> 10.0.0.24 port 3129
# block in
pass in log quick on bge0
pass out log quick on bge0
pass out keep state
http_port 3128
http_port 3129 intercept
./squidclient -h 10.0.0.24 -p 3128 http://www.freebsd.org/
If I replace -p 3128 with -p 80, I get a access denied, and if I omit the -p 3128 completely, I can access the websites.
tcpdump with (-p 3128)
13:15:02.681106 IP ISN-PHC-CACHE.44017 > wfe0.ysv.freebsd.org.http: Flags [.], ack 17377, win 1018, options [nop,nop,TS val 985588797 ecr 1054387720], length 0
13:15:02.681421 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags [.], seq 17377:18825, ack 289, win 1040, options [nop,nop,TS val 1054387720 ecr 985588501], length 1448
13:15:02.681575 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags [.], seq 18825:20273, ack 289, win 1040, options [nop,nop,TS val 1054387720 ecr 985588501], length 1448
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
