-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hm. No. We not checked only OS. Does your BSD really loads PF module? 05.03.15 21:16, Monah Baki пишет: > Not sure why the client is running old hard/soft ware, could it be > cause of the hardware? Is FreeBSD an issue, should I switch to > linux? > > On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov <yvoinov@xxxxxxxxx> > wrote: > > Wow, 7600! > > But why is so antique iOS?! Current is 15.4 > > 05.03.15 21:09, Monah Baki пишет: >>>> PORT STATE SERVICE VERSION 23/tcp open telnet Cisco IOS >>>> telnetd MAC Address: 88:5A:92:63:77:81 (Cisco) Device type: >>>> router Running: Cisco IOS 12.X OS CPE: >>>> cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2 OS details: >>>> Cisco 7600 router (IOS 12.2) Network Distance: 1 hop TCP >>>> Sequence Prediction: Difficulty=258 (Good luck!) IP ID >>>> Sequence Generation: Randomized Service Info: OS: IOS; >>>> Device: switch; CPE: cpe:/o:cisco:ios >>>> >>>> >>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov >>>> <yvoinov@xxxxxxxxx> wrote: >>>> >>>> What is Cisco model and iOS version? >>>> >>>> 05.03.15 20:25, Monah Baki пишет: >>>>>>> Yes, correct >>>>>>> >>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov >>>>>>> <yvoinov@xxxxxxxxx> wrote: >>>>>>> >>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is proxy box? >>>>>>> >>>>>>> 05.03.15 20:15, Monah Baki пишет: >>>>>>>>>> '--prefix=/cache/squid' >>>>>>>>>> '--enable-follow-x-forwarded-for' >>>>>>>>>> '--with-large-files' '--enable-ssl' >>>>>>>>>> '--disable-ipv6' '--enable-esi' >>>>>>>>>> '--enable-kill-parent-hack' '--enable-snmp' >>>>>>>>>> '--with-pthreads' '--with-filedescriptors=65535' >>>>>>>>>> '--enable-cachemgr-hostname=hostname' >>>>>>>>>> '--enable-storeio=ufs,aufs,diskd,rock' >>>>>>>>>> '--enable-ipfw-transparent' >>>>>>>>>> '--enable-pf-transparent' '--with-nat-devpf' >>>>>>>>>> --enable-ltdl-convenience >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri Voinov >>>>>>>>>> <yvoinov@xxxxxxxxx> wrote: >>>>>>>>>> >>>>>>>>>> This looking good too. >>>>>>>>>> >>>>>>>>>> Stupid question: >>>>>>>>>> >>>>>>>>>> With witch interception option squid builed? >>>>>>>>>> >>>>>>>>>> I.e, squid -v? >>>>>>>>>> >>>>>>>>>> 05.03.15 18:19, Monah Baki пишет: >>>>>>>>>>>>> Hi all, can anyone verify if this is >>>>>>>>>>>>> correct, need to make ure that users will >>>>>>>>>>>>> be able to access the internet via the >>>>>>>>>>>>> squid. >>>>>>>>>>>>> >>>>>>>>>>>>> Running FreeBSD with a single interface >>>>>>>>>>>>> with Squid-3.5.2 >>>>>>>>>>>>> >>>>>>>>>>>>> Policy based routing on Cisco with the >>>>>>>>>>>>> following: >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> interface GigabitEthernet0/0/1.1 >>>>>>>>>>>>> >>>>>>>>>>>>> encapsulation dot1Q 1 native >>>>>>>>>>>>> >>>>>>>>>>>>> ip address 10.0.0.9 255.255.255.0 >>>>>>>>>>>>> >>>>>>>>>>>>> no ip redirects >>>>>>>>>>>>> >>>>>>>>>>>>> no ip unreachables >>>>>>>>>>>>> >>>>>>>>>>>>> ip nat inside >>>>>>>>>>>>> >>>>>>>>>>>>> standby 1 ip 10.0.0.10 >>>>>>>>>>>>> >>>>>>>>>>>>> standby 1 priority 120 >>>>>>>>>>>>> >>>>>>>>>>>>> standby 1 preempt >>>>>>>>>>>>> >>>>>>>>>>>>> standby 1 name HSRP >>>>>>>>>>>>> >>>>>>>>>>>>> ip policy route-map CFLOW >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> ip access-list extended REDIRECT >>>>>>>>>>>>> >>>>>>>>>>>>> deny tcp host 10.0.0.24 any eq www >>>>>>>>>>>>> >>>>>>>>>>>>> permit tcp host 10.0.0.23 any eq www >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> route-map CFLOW permit 10 >>>>>>>>>>>>> >>>>>>>>>>>>> match ip address REDIRECT set ip next-hop >>>>>>>>>>>>> 10.0.0.24 >>>>>>>>>>>>> >>>>>>>>>>>>> In my /etc/pf.conf rdr pass inet proto tcp >>>>>>>>>>>>> from 10.0.0.0/8 to any port 80 -> 10.0.0.24 >>>>>>>>>>>>> port 3129 >>>>>>>>>>>>> >>>>>>>>>>>>> # block in pass in log quick on bge0 pass >>>>>>>>>>>>> out log quick on bge0 pass out keep state >>>>>>>>>>>>> >>>>>>>>>>>>> and finally in my squid.conf: http_port >>>>>>>>>>>>> 3128 http_port 3129 intercept >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> And for testing purposes from the squid >>>>>>>>>>>>> server: ./squidclient -h 10.0.0.24 -p 3128 >>>>>>>>>>>>> http://www.freebsd.org/ >>>>>>>>>>>>> >>>>>>>>>>>>> If I replace -p 3128 with -p 80, I get a >>>>>>>>>>>>> access denied, and if I omit the -p 3128 >>>>>>>>>>>>> completely, I can access the websites. >>>>>>>>>>>>> >>>>>>>>>>>>> tcpdump with (-p 3128) >>>>>>>>>>>>> >>>>>>>>>>>>> 13:15:02.681106 IP ISN-PHC-CACHE.44017 > >>>>>>>>>>>>> wfe0.ysv.freebsd.org.http: Flags [.], ack >>>>>>>>>>>>> 17377, win 1018, options [nop,nop,TS val >>>>>>>>>>>>> 985588797 ecr 1054387720], length 0 >>>>>>>>>>>>> 13:15:02.681421 IP >>>>>>>>>>>>> wfe0.ysv.freebsd.org.http > >>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq >>>>>>>>>>>>> 17377:18825, ack 289, win 1040, options >>>>>>>>>>>>> [nop,nop,TS val 1054387720 ecr 985588501], >>>>>>>>>>>>> length 1448 13:15:02.681575 IP >>>>>>>>>>>>> wfe0.ysv.freebsd.org.http > >>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq >>>>>>>>>>>>> 18825:20273, ack 289, win 1040, options >>>>>>>>>>>>> [nop,nop,TS val 1054387720 ecr 985588501], >>>>>>>>>>>>> length 1448 >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Did I miss anything? >>>>>>>>>>>>> >>>>>>>>>>>>> Thanks Monah >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> >>>>>>>>>>>>> squid-users mailing list >>>>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx >>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users >>>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>>> > >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>> squid-users mailing list >>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx >>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users >>>>>>>>>>> >>>>>>>>>> >>>>>>>> >>>>>>> >>>>> >>>> >> > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBAgAGBQJU+HQ9AAoJENNXIZxhPexGzdkIAJKlI1/eYSwBD/vqY1nk+nRr 6PsBHLm8fVFU9iEOq+PXFOsm9F1L6Ak86+XI24BB/LYEzbrFGAIalu+BbZiS3dsR Ym9MkaiKfJEqNz7ajKzyydRB4t6MFULGrqQXJeYUH0zUraTB1iJwn1fyXEoyssKW 4wet9JbFIbCZyNNzeXMHhpZ3bNy1/bbgHk+paBwJCCgvriiHW+Jn3L6Ppd0HvNXY QD5P3YQrUuPVYxjZtkMCEwigv5cqV3aOyn9NzMwwjLrGSfogK529gA22QK5NJiMV 65yGags/Z++SfVTL+7MYnVOWkmYFExmMdIXHw9T4WZ8cMZQd2j3EkuiRw8EHf5M= =0UyO -----END PGP SIGNATURE----- _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
