Re: squid intercept config

[Monah Baki <monahbaki@xxxxxxxxx>]

rdr pass inet proto tcp from 10.0.0.0/8 to any port 80 -> 10.0.0.24 port 3129

# block in
pass in log quick on bge0
pass out log quick on bge0
pass out keep state

Thanks

On Thu, Mar 5, 2015 at 8:50 AM, Yuri Voinov <yvoinov@xxxxxxxxx> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Show complete pf.conf, please.

05.03.15 19:45, Monah Baki пишет:
> In my squid.conf
>
> http_port 3128 http_port 3129 intercept
>
> Thanks
>
> On Thu, Mar 5, 2015 at 8:44 AM, Yuri Voinov <yvoinov@xxxxxxxxx>
> wrote:
>

> Squid access denied?
>
> Look at this:
>
> In my /etc/pf.conf rdr pass inet proto tcp from 10.0.0.0/8 to any
>>>>> port 80 -> 10.0.0.24 port 3129
>
> Which port configured in Squid as intercept?
>
> 3129?
>
> and 3128 is forwarding?
>
> 05.03.15 19:36, monahbaki@xxxxxxxxx пишет:
>>>> Yes that's what I followed and user is getting a "access
>>>> denied" from the squid when he tries www.cnn.com
>>>>
>>>> Sent from my BlackBerry 10 smartphone on the Verizon Wireless
>>>> 4G LTE network. Original Message From: Yuri Voinov Sent:
>>>> Thursday, March 5, 2015 8:22 AM To:
>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx Subject: Re:
>>>> squid intercept config
>>>>
>>>>
> http://wiki.squid-cache.org/ConfigExamples/Intercept/Cisco2501PolicyRoute
>>>>
>>>>
>
>
http://wiki.squid-cache.org/ConfigExamples/Intercept/FreeBsdPf
>>>>
>>>> 05.03.15 18:19, Monah Baki пишет:
>>>>> Hi all, can anyone verify if this is correct, need to make
>>>>> ure that users will be able to access the internet via the
>>>>> squid.
>>>>
>>>>> Running FreeBSD with a single interface with Squid-3.5.2
>>>>
>>>>> Policy based routing on Cisco with the following:
>>>>
>>>>
>>>>> interface GigabitEthernet0/0/1.1
>>>>
>>>>> encapsulation dot1Q 1 native
>>>>
>>>>> ip address 10.0.0.9 255.255.255.0
>>>>
>>>>> no ip redirects
>>>>
>>>>> no ip unreachables
>>>>
>>>>> ip nat inside
>>>>
>>>>> standby 1 ip 10.0.0.10
>>>>
>>>>> standby 1 priority 120
>>>>
>>>>> standby 1 preempt
>>>>
>>>>> standby 1 name HSRP
>>>>
>>>>> ip policy route-map CFLOW
>>>>
>>>>
>>>>
>>>>> ip access-list extended REDIRECT
>>>>
>>>>> deny tcp host 10.0.0.24 any eq www
>>>>
>>>>> permit tcp host 10.0.0.23 any eq www
>>>>
>>>>
>>>>
>>>>> route-map CFLOW permit 10
>>>>
>>>>> match ip address REDIRECT set ip next-hop 10.0.0.24
>>>>
>>>>> In my /etc/pf.conf rdr pass inet proto tcp from 10.0.0.0/8
>>>>> to any port 80 -> 10.0.0.24 port 3129
>>>>
>>>>> # block in pass in log quick on bge0 pass out log quick on
>>>>> bge0 pass out keep state
>>>>
>>>>> and finally in my squid.conf: http_port 3128 http_port
>>>>> 3129 intercept
>>>>
>>>>
>>>>
>>>>> And for testing purposes from the squid server:
>>>>> ./squidclient -h 10.0.0.24 -p 3128 http://www.freebsd.org/
>>>>
>>>>> If I replace -p 3128 with -p 80, I get a access denied, and
>>>>> if I omit the -p 3128 completely, I can access the
>>>>> websites.
>>>>
>>>>> tcpdump with (-p 3128)
>>>>
>>>>> 13:15:02.681106 IP ISN-PHC-CACHE.44017 >
>>>>> wfe0.ysv.freebsd.org.http: Flags [.], ack 17377, win 1018,
>>>>> options [nop,nop,TS val 985588797 ecr 1054387720], length
>>>>> 0 13:15:02.681421 IP wfe0.ysv.freebsd.org.http >
>>>>> ISN-PHC-CACHE.44017: Flags [.], seq 17377:18825, ack 289,
>>>>> win 1040, options [nop,nop,TS val 1054387720 ecr
>>>>> 985588501], length 1448 13:15:02.681575 IP
>>>>> wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags [.],
>>>>> seq 18825:20273, ack 289, win 1040, options [nop,nop,TS val
>>>>> 1054387720 ecr 985588501], length 1448
>>>>
>>>>
>>>>
>>>>> Did I miss anything?
>>>>
>>>>> Thanks Monah
>>>>
>>>>
>>>>
>>>>> _______________________________________________
>>>>> squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx
>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>
>>>> _______________________________________________ squid-users
>>>> mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx
>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>
>>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJU+F8UAAoJENNXIZxhPexGUd0H/ikmReyo7lGbuMVZelLLdawa
mtKS3N+dfyVWDT6LCGlgJaWFYV8N0Xqvf3dUv73xkrr3Gqoh6pQIVDdUJOObOC/7
/yX9qIPfHxz8pic18Hm3/RCwoeSzXp75JgD8LMy2xkOxto+Gvx3pFBBfMyViBYz9
VTCumGjDvx7pVlcO8MlmZ86jdSvBoEpLYi8J9rjD+11UKhA5mzy8gqzC8OCCTLvc
mP9NcUfvIFPFIW//SyzS+X1DiM/fGJ/jFsJ6QVxU8oY///zpHWyXE9oYZzZ62DqA
2VtPKduIu2NVZ/ibbnPI4CEU52Ct0uz2scbC1ZEvSqrkfYklg+RGDPj3ckcwGMU=
=xmOu
-----END PGP SIGNATURE-----

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users