Re: squid intercept config

[Monah Baki <monahbaki@xxxxxxxxx>]

root@ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i pflog0
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes
capability mode sandbox enabled
00:00:00.000000 rule 0..16777216/0(match): pass in on bge0: 10.0.0.106.5678 > 255.255.255.255.5678: UDP, length 88
00:00:08.342860 rule 0..16777216/0(match): pass in on bge0: 10.0.0.14.54264 > 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0

On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov <yvoinov@xxxxxxxxx> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hm. No.

We not checked only OS.

Does your BSD really loads PF module?

05.03.15 21:16, Monah Baki пишет:
> Not sure why the client is running old hard/soft ware, could it be
> cause of the hardware? Is FreeBSD an issue, should I switch to
> linux?
>
> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov <yvoinov@xxxxxxxxx>
> wrote:
>

> Wow, 7600!
>
> But why is so antique iOS?! Current is 15.4
>
> 05.03.15 21:09, Monah Baki пишет:
>>>> PORT   STATE SERVICE VERSION 23/tcp open  telnet  Cisco IOS
>>>> telnetd MAC Address: 88:5A:92:63:77:81 (Cisco) Device type:
>>>> router Running: Cisco IOS 12.X OS CPE:
>>>> cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2 OS details:
>>>> Cisco 7600 router (IOS 12.2) Network Distance: 1 hop TCP
>>>> Sequence Prediction: Difficulty=258 (Good luck!) IP ID
>>>> Sequence Generation: Randomized Service Info: OS: IOS;
>>>> Device: switch; CPE: cpe:/o:cisco:ios
>>>>
>>>>
>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov
>>>> <yvoinov@xxxxxxxxx> wrote:
>>>>
>>>> What is Cisco model and iOS version?
>>>>
>>>> 05.03.15 20:25, Monah Baki пишет:
>>>>>>> Yes, correct
>>>>>>>
>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov
>>>>>>> <yvoinov@xxxxxxxxx> wrote:
>>>>>>>
>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is proxy box?
>>>>>>>
>>>>>>> 05.03.15 20:15, Monah Baki пишет:
>>>>>>>>>> '--prefix=/cache/squid'
>>>>>>>>>> '--enable-follow-x-forwarded-for'
>>>>>>>>>> '--with-large-files' '--enable-ssl'
>>>>>>>>>> '--disable-ipv6' '--enable-esi'
>>>>>>>>>> '--enable-kill-parent-hack' '--enable-snmp'
>>>>>>>>>> '--with-pthreads' '--with-filedescriptors=65535'
>>>>>>>>>> '--enable-cachemgr-hostname=hostname'
>>>>>>>>>> '--enable-storeio=ufs,aufs,diskd,rock'
>>>>>>>>>> '--enable-ipfw-transparent'
>>>>>>>>>> '--enable-pf-transparent' '--with-nat-devpf'
>>>>>>>>>> --enable-ltdl-convenience
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri Voinov
>>>>>>>>>> <yvoinov@xxxxxxxxx> wrote:
>>>>>>>>>>
>>>>>>>>>> This looking good too.
>>>>>>>>>>
>>>>>>>>>> Stupid question:
>>>>>>>>>>
>>>>>>>>>> With witch interception option squid builed?
>>>>>>>>>>
>>>>>>>>>> I.e, squid -v?
>>>>>>>>>>
>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:
>>>>>>>>>>>>> Hi all, can anyone verify if this is
>>>>>>>>>>>>> correct, need to make ure that users will
>>>>>>>>>>>>> be able to access the internet via the
>>>>>>>>>>>>> squid.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Running FreeBSD with a single interface
>>>>>>>>>>>>> with Squid-3.5.2
>>>>>>>>>>>>>
>>>>>>>>>>>>> Policy based routing on Cisco with the
>>>>>>>>>>>>> following:
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> interface GigabitEthernet0/0/1.1
>>>>>>>>>>>>>
>>>>>>>>>>>>> encapsulation dot1Q 1 native
>>>>>>>>>>>>>
>>>>>>>>>>>>> ip address 10.0.0.9 255.255.255.0
>>>>>>>>>>>>>
>>>>>>>>>>>>> no ip redirects
>>>>>>>>>>>>>
>>>>>>>>>>>>> no ip unreachables
>>>>>>>>>>>>>
>>>>>>>>>>>>> ip nat inside
>>>>>>>>>>>>>
>>>>>>>>>>>>> standby 1 ip 10.0.0.10
>>>>>>>>>>>>>
>>>>>>>>>>>>> standby 1 priority 120
>>>>>>>>>>>>>
>>>>>>>>>>>>> standby 1 preempt
>>>>>>>>>>>>>
>>>>>>>>>>>>> standby 1 name HSRP
>>>>>>>>>>>>>
>>>>>>>>>>>>> ip policy route-map CFLOW
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> ip access-list extended REDIRECT
>>>>>>>>>>>>>
>>>>>>>>>>>>> deny   tcp host 10.0.0.24 any eq www
>>>>>>>>>>>>>
>>>>>>>>>>>>> permit tcp host 10.0.0.23 any eq www
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> route-map CFLOW permit 10
>>>>>>>>>>>>>
>>>>>>>>>>>>> match ip address REDIRECT set ip next-hop
>>>>>>>>>>>>> 10.0.0.24
>>>>>>>>>>>>>
>>>>>>>>>>>>> In my /etc/pf.conf rdr pass inet proto tcp
>>>>>>>>>>>>> from 10.0.0.0/8 to any port 80 -> 10.0.0.24
>>>>>>>>>>>>> port 3129
>>>>>>>>>>>>>
>>>>>>>>>>>>> # block in pass in log quick on bge0 pass
>>>>>>>>>>>>> out log quick on bge0 pass out keep state
>>>>>>>>>>>>>
>>>>>>>>>>>>> and finally in my squid.conf: http_port
>>>>>>>>>>>>> 3128 http_port 3129 intercept
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> And for testing purposes from the squid
>>>>>>>>>>>>> server: ./squidclient -h 10.0.0.24 -p 3128
>>>>>>>>>>>>> http://www.freebsd.org/
>>>>>>>>>>>>>
>>>>>>>>>>>>> If I replace -p 3128 with -p 80, I get a
>>>>>>>>>>>>> access denied, and if I omit the -p 3128
>>>>>>>>>>>>> completely, I can access the websites.
>>>>>>>>>>>>>
>>>>>>>>>>>>> tcpdump with (-p 3128)
>>>>>>>>>>>>>
>>>>>>>>>>>>> 13:15:02.681106 IP ISN-PHC-CACHE.44017 >
>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http: Flags [.], ack
>>>>>>>>>>>>> 17377, win 1018, options [nop,nop,TS val
>>>>>>>>>>>>> 985588797 ecr 1054387720], length 0
>>>>>>>>>>>>> 13:15:02.681421 IP
>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http >
>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
>>>>>>>>>>>>> 17377:18825, ack 289, win 1040, options
>>>>>>>>>>>>> [nop,nop,TS val 1054387720 ecr 985588501],
>>>>>>>>>>>>> length 1448 13:15:02.681575 IP
>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http >
>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
>>>>>>>>>>>>> 18825:20273, ack 289, win 1040, options
>>>>>>>>>>>>> [nop,nop,TS val 1054387720 ecr 985588501],
>>>>>>>>>>>>> length 1448
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> Did I miss anything?
>>>>>>>>>>>>>
>>>>>>>>>>>>> Thanks Monah
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> _______________________________________________
>>>>>>>>>>>>>
>>>>>>>>>>>>>
squid-users mailing list
>>>>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx
>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>>>
>
>>>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>> squid-users mailing list
>>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx
>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>
>>>>
>>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJU+HQ9AAoJENNXIZxhPexGzdkIAJKlI1/eYSwBD/vqY1nk+nRr
6PsBHLm8fVFU9iEOq+PXFOsm9F1L6Ak86+XI24BB/LYEzbrFGAIalu+BbZiS3dsR
Ym9MkaiKfJEqNz7ajKzyydRB4t6MFULGrqQXJeYUH0zUraTB1iJwn1fyXEoyssKW
4wet9JbFIbCZyNNzeXMHhpZ3bNy1/bbgHk+paBwJCCgvriiHW+Jn3L6Ppd0HvNXY
QD5P3YQrUuPVYxjZtkMCEwigv5cqV3aOyn9NzMwwjLrGSfogK529gA22QK5NJiMV
65yGags/Z++SfVTL+7MYnVOWkmYFExmMdIXHw9T4WZ8cMZQd2j3EkuiRw8EHf5M=
=0UyO
-----END PGP SIGNATURE-----

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users