Search squid archive

Re: squid intercept config

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- From your PC run telnet 10.0.0.24 80. You've seen if TCP socket opens.

05.03.15 23:10, Monah Baki пишет:
> How can I confirm, I have access only to the BSD box
> 
> Thanks
> 
> On Thu, Mar 5, 2015 at 11:12 AM, Yuri Voinov <yvoinov@xxxxxxxxx>
> wrote:
> 
> Does 80 port outside BSD-box listens?
> 
> 05.03.15 21:25, Monah Baki пишет:
>>>> root@ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i
>>>> pflog0 tcpdump: WARNING: pflog0: no IPv4 address assigned
>>>> tcpdump: verbose output suppressed, use -v or -vv for full
>>>> protocol decode listening on pflog0, link-type PFLOG (OpenBSD
>>>> pflog file), capture size 65535 bytes capability mode sandbox
>>>> enabled 00:00:00.000000 rule 0..16777216/0(match): pass in on
>>>> bge0: 10.0.0.106.5678
>>>>> 255.255.255.255.5678: UDP, length 88
>>>> 00:00:08.342860 rule 0..16777216/0(match): pass in on bge0: 
>>>> 10.0.0.14.54264
>>>>> 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options
>>>>> [mss
>>>> 1460,nop,wscale 2,nop,nop,sackOK], length 0
>>>> 
>>>> 
>>>> 
>>>> On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov
>>>> <yvoinov@xxxxxxxxx> wrote:
>>>> 
>>>> Hm. No.
>>>> 
>>>> We not checked only OS.
>>>> 
>>>> Does your BSD really loads PF module?
>>>> 
>>>> 05.03.15 21:16, Monah Baki пишет:
>>>>>>> Not sure why the client is running old hard/soft ware,
>>>>>>> could it be cause of the hardware? Is FreeBSD an issue,
>>>>>>> should I switch to linux?
>>>>>>> 
>>>>>>> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov 
>>>>>>> <yvoinov@xxxxxxxxx> wrote:
>>>>>>> 
>>>>>>> Wow, 7600!
>>>>>>> 
>>>>>>> But why is so antique iOS?! Current is 15.4
>>>>>>> 
>>>>>>> 05.03.15 21:09, Monah Baki пишет:
>>>>>>>>>> PORT   STATE SERVICE VERSION 23/tcp open  telnet
>>>>>>>>>> Cisco IOS telnetd MAC Address: 88:5A:92:63:77:81
>>>>>>>>>> (Cisco) Device type: router Running: Cisco IOS
>>>>>>>>>> 12.X OS CPE: cpe:/h:cisco:7600_router
>>>>>>>>>> cpe:/o:cisco:ios:12.2 OS details: Cisco 7600
>>>>>>>>>> router (IOS 12.2) Network Distance: 1 hop TCP
>>>>>>>>>> Sequence Prediction: Difficulty=258 (Good luck!)
>>>>>>>>>> IP ID Sequence Generation: Randomized Service 
>>>>>>>>>> Info: OS: IOS; Device: switch; CPE:
>>>>>>>>>> cpe:/o:cisco:ios
>>>>>>>>>> 
>>>>>>>>>> 
>>>>>>>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov 
>>>>>>>>>> <yvoinov@xxxxxxxxx> wrote:
>>>>>>>>>> 
>>>>>>>>>> What is Cisco model and iOS version?
>>>>>>>>>> 
>>>>>>>>>> 05.03.15 20:25, Monah Baki пишет:
>>>>>>>>>>>>> Yes, correct
>>>>>>>>>>>>> 
>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri
>>>>>>>>>>>>> Voinov <yvoinov@xxxxxxxxx> wrote:
>>>>>>>>>>>>> 
>>>>>>>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is
>>>>>>>>>>>>> proxy box?
>>>>>>>>>>>>> 
>>>>>>>>>>>>> 05.03.15 20:15, Monah Baki пишет:
>>>>>>>>>>>>>>>> '--prefix=/cache/squid' 
>>>>>>>>>>>>>>>> '--enable-follow-x-forwarded-for' 
>>>>>>>>>>>>>>>> '--with-large-files' '--enable-ssl' 
>>>>>>>>>>>>>>>> '--disable-ipv6' '--enable-esi' 
>>>>>>>>>>>>>>>> '--enable-kill-parent-hack' 
>>>>>>>>>>>>>>>> '--enable-snmp' '--with-pthreads' 
>>>>>>>>>>>>>>>> '--with-filedescriptors=65535' 
>>>>>>>>>>>>>>>> '--enable-cachemgr-hostname=hostname'
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> 
'--enable-storeio=ufs,aufs,diskd,rock'
>>>>>>>>>>>>>>>> '--enable-ipfw-transparent' 
>>>>>>>>>>>>>>>> '--enable-pf-transparent' 
>>>>>>>>>>>>>>>> '--with-nat-devpf' 
>>>>>>>>>>>>>>>> --enable-ltdl-convenience
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri 
>>>>>>>>>>>>>>>> Voinov <yvoinov@xxxxxxxxx> wrote:
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> This looking good too.
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> Stupid question:
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> With witch interception option squid 
>>>>>>>>>>>>>>>> builed?
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> I.e, squid -v?
>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:
>>>>>>>>>>>>>>>>>>> Hi all, can anyone verify if
>>>>>>>>>>>>>>>>>>> this is correct, need to make
>>>>>>>>>>>>>>>>>>> ure that users will be able to
>>>>>>>>>>>>>>>>>>> access the internet via the
>>>>>>>>>>>>>>>>>>> squid.
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> Running FreeBSD with a single 
>>>>>>>>>>>>>>>>>>> interface with Squid-3.5.2
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> Policy based routing on Cisco
>>>>>>>>>>>>>>>>>>> with the following:
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> interface
>>>>>>>>>>>>>>>>>>> GigabitEthernet0/0/1.1
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> encapsulation dot1Q 1 native
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> ip address 10.0.0.9
>>>>>>>>>>>>>>>>>>> 255.255.255.0
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> no ip redirects
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> no ip unreachables
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> ip nat inside
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> standby 1 ip 10.0.0.10
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> standby 1 priority 120
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> standby 1 preempt
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> standby 1 name HSRP
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> ip policy route-map CFLOW
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> ip access-list extended
>>>>>>>>>>>>>>>>>>> REDIRECT
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> deny   tcp host 10.0.0.24 any
>>>>>>>>>>>>>>>>>>> eq www
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> permit tcp host 10.0.0.23 any
>>>>>>>>>>>>>>>>>>> eq www
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> route-map CFLOW permit 10
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> match ip address REDIRECT set
>>>>>>>>>>>>>>>>>>> ip next-hop 10.0.0.24
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> In my /etc/pf.conf rdr pass
>>>>>>>>>>>>>>>>>>> inet proto tcp from 10.0.0.0/8
>>>>>>>>>>>>>>>>>>> to any port 80 -> 10.0.0.24
>>>>>>>>>>>>>>>>>>> port 3129
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> # block in pass in log quick on
>>>>>>>>>>>>>>>>>>> bge0 pass out log quick on bge0
>>>>>>>>>>>>>>>>>>> pass out keep state
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> and finally in my squid.conf: 
>>>>>>>>>>>>>>>>>>> http_port 3128 http_port 3129 
>>>>>>>>>>>>>>>>>>> intercept
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> And for testing purposes from
>>>>>>>>>>>>>>>>>>> the squid server: ./squidclient
>>>>>>>>>>>>>>>>>>> -h 10.0.0.24 -p 3128 
>>>>>>>>>>>>>>>>>>> http://www.freebsd.org/
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> If I replace -p 3128 with -p
>>>>>>>>>>>>>>>>>>> 80, I get a access denied, and
>>>>>>>>>>>>>>>>>>> if I omit the -p 3128
>>>>>>>>>>>>>>>>>>> completely, I can access the
>>>>>>>>>>>>>>>>>>> websites.
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> tcpdump with (-p 3128)
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 13:15:02.681106 IP 
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017 > 
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http:
>>>>>>>>>>>>>>>>>>> Flags [.], ack 17377, win 1018,
>>>>>>>>>>>>>>>>>>> options [nop,nop,TS val
>>>>>>>>>>>>>>>>>>> 985588797 ecr 1054387720],
>>>>>>>>>>>>>>>>>>> length 0 13:15:02.681421 IP
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http > 
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.],
>>>>>>>>>>>>>>>>>>> seq 17377:18825, ack 289, win
>>>>>>>>>>>>>>>>>>> 1040, options [nop,nop,TS val
>>>>>>>>>>>>>>>>>>> 1054387720 ecr 985588501],
>>>>>>>>>>>>>>>>>>> length 1448 13:15:02.681575 IP 
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http > 
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.],
>>>>>>>>>>>>>>>>>>> seq 18825:20273, ack 289, win
>>>>>>>>>>>>>>>>>>> 1040, options [nop,nop,TS val
>>>>>>>>>>>>>>>>>>> 1054387720 ecr 985588501],
>>>>>>>>>>>>>>>>>>> length 1448
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> Did I miss anything?
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> Thanks Monah
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> _______________________________________________
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>
>>>>>>>>>>>>>>>>>>>
>
>>>>>>>>>>>>>>>>>>> 
squid-users mailing list
>>>>>>>>>>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> 
http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>>>>> 
>>>>>>>>>>>>>>>>>>> 
>>>> 
>>>>>>>>>>>>>>>>>>> 
> _______________________________________________
>>>>>>>>>>>>>>>>> squid-users mailing list 
>>>>>>>>>>>>>>>>> squid-users@xxxxxxxxxxxxxxxxxxxxx 
>>>>>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>
>>>>
>>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJU+I5pAAoJENNXIZxhPexG68cIAIjP0CaVSgjlexyNc4xATrws
SGS2hfPSOwPNJ32YVL43OJKtGLAMlumeo2oxJyZjdUFKftT5g7h8ldRKY3tPcV1m
lYo+lbS4FOA0MspbK9oGP+xiZhvB8jnxmLxM13+Rnmf1309rYhhIyL7y7yih02i/
KIulMyYwjZC8BvsCHRAjhxIiMQ0AJEO17hzs/6OCIkIjYNiswl9D8MbH0KOuKJMy
4BpYMpYnzDjfJAehwD7n1xnta3GvLhHbUL7fcYO9hvCX1mzZW/06nFpKQL/5pF06
CVmtTAtg85JlFESBlA9JHbDOV3AGn0bOC5KFtIqX3osFz46Ac+HqOV8P0kXm85k=
=eSQL
-----END PGP SIGNATURE-----
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users





[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux