Search squid archive

Re: ISSUE accssing content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I see a few issues.

1. The report from the log shows a 192.168.*.* address, common LAN IP

Then in the squid.conf:
2. You have wvdial destination as 10.1.*.* addresses, which is a completely different internal network.
Typically there will be no internal routing or communication from a 192.168..*.* address to/from a 10.*.*.* address without a custom routing server with 2 network connections, one from each IP set and to act as the DNS intermediary for routing. Otherwise for network/internet connections, the computer/browser sees its own IP as local network, and everything else including 10.*.*.* as an external address out on the internet. I would suggest getting both the browsing computer and the server on the same IP subset, as in 192.168.122.x or 10.1.4.x, otherwise these issues are likely to continue.

3. Next in the squid.conf is http_port which should be port number only, no IP address, especially 0.0.0.0 which can cause conflicts with squid 3.x versions. Best bet is use just port only, as in: "http_port 3128" or in your case "http_port 8080", which is the port (with server IP found in ifconfig) the browser will use to connect through the squid server.
4. The bypass local network means any IP connection attempt to a local network IP will not use the proxy. This goes back to the 2 different IP subsets. One option is to enter a proxy exception as 10.*.*.* (if the websense server is using 10.x.x.x IP address).


Mike


On 7/24/2015 10:35 AM, Jagannath Naidu wrote:
Dear List,

I have been working on this for last two weeks, but never got it resolved. 

We have a application server (SERVER) in our local network and a desktop  application (CLIENT). The application picks proxy settings from IE. And we also have a wensense proxy server 

case 1: when there is no proxy set 
application works. No logs in squid server access.log

case 2: when proxy ip address set and checked "bypass local network"
application works. No logs in squid server access.log 

case 3: when proxy ip address is set to wensense proxy server. UNCHECKED "bypass local network"
application works. We dont have access to websense server and hence we can not check logs 


case 4: when proxy ip address is set to proxy server ip address. UNCHECKED "bypass local network"
application does not work :-(. Below are the logs. 


1437751240.149      7 192.168.122.1 TCP_MISS/404 579 GET http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application - HIER_DIRECT/10.1.4.46 text/html
1437751240.992     94 192.168.122.1 TCP_DENIED/407 3757 CONNECT 0.client-channel.google.com:443 - HIER_NONE/- text/html
1437751240.996      0 192.168.122.1 TCP_DENIED/407 4059 CONNECT 0.client-channel.google.com:443 - HIER_NONE/- text/html
1437751242.327      5 192.168.122.1 TCP_MISS/404 579 GET http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm - HIER_DIRECT/10.1.4.46 text/html
1437751244.777      1 192.168.122.1 TCP_MISS/503 4048 POST http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal - HIER_NONE/- text/html

squid -v
Squid Cache: Version 3.3.8
configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro  -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=%{_PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig'


squid.conf 

acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 8180
acl CONNECT method CONNECT
acl wvdial dst 10.1.4.45 10.1.4.50 10.1.4.53 10.1.4.48 10.1.4.54 10.1.4.46 10.1.4.51 10.1.4.47 10.1.4.55 10.1.4.49 10.1.4.52 10.1.2.4
http_access allow wvdial
acl dialer dstdomain .htmedia.net
http_access allow dialer
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
visible_hostname = NOIDAPROXY01.MYDOMAIN.NET
append_domain  .mydomain.net
ignore_expect_100 on
dns_v4_first on
auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=HTMEDIA.NET
auth_param ntlm children 1000
auth_param ntlm keep_alive off
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 100
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
acl auth proxy_auth REQUIRED
http_access allow all auth
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 0.0.0.0:8080
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320


It was the same behavior with squid-3.1.10-19. I thought, upgrading to squid 3.3 would help. Please help me resolving this mystery. 


--
Thanks & Regards

Jagannath Naidu 



_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux