OK heres the difference
http_port 192.168.10.254:3128 intercept
http_port 192.168.10.254:3129
I had to setup squid on a second port not in intercept mode and set the
WPAD file to send HTTPS requests there.
Why will the intercept port accept HTTPS CONNECT requests in 3.1 but not
3.4?
Regards
Andrew
On 09/07/15 14:05, Andrew Wood wrote:
Ive had Squid 3.1 running on a Debian 7 server for a couple of years
working in intercept mode for HTTP traffic and using WPAD to force
HTTPS to be CONNECT tunneled through Squid and it works fine.
Im now trying to set up a similar system for someone else using Squid
3.4 which is the version in Debian 8. Everything is configured
identically between the two as I copied the iptables rule file and the
squid.conf file over, the only thing changed was the IP address ranges
for the LAN
HTTP intercept is working OK but HTTPS connect requests are being
refused. Despite the fact that the WPAD file had been updated with the
new IP address and is being served correctly from lighttpd.
I can only conclude therefore that there is some difference between
Squid 3.1 and 3.4 which means it no longer likes my configuration.
Below is the Squid.conf file
VLAN1 is the staff LAN with IP addresses 192.168.10 and VLAN2 is the
public Wifi LAN with IP addresses 192.168.100
Is there anything here in the squid file which Im doing wrong?
Many thanks
#squid.conf:
#set which port to accept clients on & which interfaces to accept
clients on
http_port 192.168.10.254:3128 intercept
http_port 192.168.100.254:3128 intercept
#set delay pool to do bandwidth throttling on VLAN2
delay_pools 1
delay_class 1 2
delay_parameters 1 250000/500000 125000/500000
#ORd
acl AllUsers src all
acl ToSentryBoxVL1 dstdom_regex ^192.168.10.254$
acl ToWPADServer dstdom_regex ^wpad.commsmuseum.local$
acl ToPublicWiFiGateway dstdom_regex ^192.168.100.254$
acl PublicWiFiLAN src 192.168.100.0/24
acl PrivateLAN src 192.168.10.0/24
acl DestinedForPrivateLAN dst 192.168.10.0/24
acl DestinedForPublicWiFiLAN dst 192.168.100.0/24
acl ProhibitedSitesDomains dstdomain
"/var/squidblacklist.org/domains.squid"
acl IPAddressForHostname dstdom_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
acl SafePorts port 80 443
acl SSLPorts port 443
#block users tunneling
acl CONNECT method CONNECT
http_access deny CONNECT !SSLPorts
#disable caching
cache deny all
#add VLAN2 to delay pool 1
delay_access 1 allow PublicWiFiLAN
#force traffic coming in on VLAN2 to go out on VLAN2
tcp_outgoing_address 192.168.100.254 PublicWiFiLAN
tcp_outgoing_address 192.168.10.254 PrivateLAN
#block traffic between VLAN1 & VLAN2
#iptables does this for everything EXCEPT stuff coming through Squid
#because iptables sees stuff coming out of squid as originating from
the localhost
#hence iptables FORWARD rules dont apply
http_access deny PublicWiFiLAN DestinedForPrivateLAN
http_access deny PrivateLAN DestinedForPublicWiFiLAN
#show splash screen to new users on public wifi to show t&c etc
#pass session length as arg to perl script cache +ve & -ve responses
for 0 secs so
#perl script is always called. Script is responsible for deciding how
long a session is valid for
#%SRC passes client ip on stdin
external_acl_type currentsessiontype ttl=60 negative_ttl=0 %SRC
/var/publicwifisessions/checksession.pl
acl currentsession external currentsessiontype
#will stop on first of these which matches so watch order!
http_access deny ProhibitedSitesDomains
http_access allow ToPublicWiFiGateway
http_access allow ToSentryBoxVL1
http_access allow ToWPADServer
http_access deny CONNECT PublicWiFiLAN !currentsession
http_access deny PublicWiFiLAN !currentsession
http_access deny IPAddressForHostname
http_access deny !SafePorts
http_access allow PrivateLAN
http_access allow PublicWiFiLAN
http_access deny AllUsers
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
