Re: ISSUE accssing content

Mike <mcsnv96@xxxxxxx> · Fri, 24 Jul 2015 13:57:20 -0500



    I see a few issues.

      
      1. The report from the log shows a 192.168.*.* address, common LAN
      IP

      
      Then in the squid.conf:

      2. You have wvdial destination as 10.1.*.* addresses, which is a
      completely different internal network.

      Typically there will be no internal routing or communication from
      a 192.168..*.* address to/from a 10.*.*.* address without a custom
      routing server with 2 network connections, one from each IP set
      and to act as the DNS intermediary for routing. Otherwise for
      network/internet connections, the computer/browser sees its own IP
      as local network, and everything else including 10.*.*.* as an
      external address out on the internet. I would suggest getting both
      the browsing computer and the server on the same IP subset, as in
      192.168.122.x or 10.1.4.x, otherwise these issues are likely to
      continue. 

      
      3. Next in the squid.conf is http_port which should be port number
      only, no IP address, especially 0.0.0.0 which can cause conflicts
      with squid 3.x versions. Best bet is use just port only, as in:
      "http_port 3128" or in your case "http_port 8080", which is the
      port (with server IP found in ifconfig) the browser will use to
      connect through the squid server.

      4. The bypass local network means any IP connection attempt to a
      local network IP will not use the proxy. This goes back to the 2
      different IP subsets. One option is to enter a proxy exception as
      10.*.*.* (if the websense server is using 10.x.x.x IP address).

      
      Mike

      
      On 7/24/2015 10:35 AM, Jagannath Naidu wrote:

    
        Dear List,
        

        I have been working on this for last two weeks, but never
          got it resolved. 
        

        We have a application server (SERVER) in our local network
          and a desktop  application (CLIENT). The application picks
          proxy settings from IE. And we also have a wensense proxy
          server 
        

        case 1: when there is no proxy set 
        application works. No logs in squid server access.log
        

        case 2: when proxy ip address set and checked "bypass local
          network"
        application works. No logs in squid server access.log 
        

        case 3: when proxy ip address is set to wensense proxy
          server. UNCHECKED "bypass local network"
        application works. We dont have access to websense server
          and hence we can not check logs 
        

        case 4: when proxy ip address is set to proxy server ip
          address. UNCHECKED "bypass local network"
        application does not work :-(. Below are the logs. 
        

        1437751240.149      7 192.168.122.1 TCP_MISS/404 579 GET http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application
          - HIER_DIRECT/10.1.4.46 text/html
        1437751240.992     94 192.168.122.1 TCP_DENIED/407 3757
          CONNECT 0.client-channel.google.com:443
          - HIER_NONE/- text/html
        1437751240.996      0 192.168.122.1 TCP_DENIED/407 4059
          CONNECT 0.client-channel.google.com:443
          - HIER_NONE/- text/html
        1437751242.327      5 192.168.122.1 TCP_MISS/404 579 GET http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm
          - HIER_DIRECT/10.1.4.46 text/html
        1437751244.777      1 192.168.122.1 TCP_MISS/503 4048 POST
          http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal
          - HIER_NONE/- text/html
        

          squid -v
          Squid Cache: Version 3.3.8
          configure options:  '--build=x86_64-redhat-linux-gnu'
            '--host=x86_64-redhat-linux-gnu' '--program-prefix='
            '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin'
            '--sbindir=/usr/sbin' '--sysconfdir=/etc'
            '--datadir=/usr/share' '--includedir=/usr/include'
            '--libdir=/usr/lib64' '--libexecdir=/usr/libexec'
            '--sharedstatedir=/var/lib' '--mandir=/usr/share/man'
            '--infodir=/usr/share/info'
            '--disable-strict-error-checking' '--exec_prefix=/usr'
            '--libexecdir=/usr/lib64/squid' '--localstatedir=/var'
            '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid'
            '--with-logdir=$(localstatedir)/log/squid'
            '--with-pidfile=$(localstatedir)/run/squid.pid'
            '--disable-dependency-tracking' '--enable-eui'
            '--enable-follow-x-forwarded-for' '--enable-auth'
            '--enable-auth-basic=DB,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam'
            '--enable-auth-ntlm=smb_lm,fake'
            '--enable-auth-digest=file,LDAP,eDirectory'
            '--enable-auth-negotiate=kerberos'
            '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group'
            '--enable-cache-digests'
            '--enable-cachemgr-hostname=localhost'
            '--enable-delay-pools' '--enable-epoll'
            '--enable-icap-client' '--enable-ident-lookups'
            '--enable-linux-netfilter'
            '--enable-removal-policies=heap,lru' '--enable-snmp'
            '--enable-ssl' '--enable-ssl-crtd'
            '--enable-storeio=aufs,diskd,ufs' '--enable-wccpv2'
            '--enable-esi' '--enable-ecap' '--with-aio'
            '--with-default-user=squid' '--with-filedescriptors=16384'
            '--with-dl' '--with-openssl' '--with-pthreads'
            'build_alias=x86_64-redhat-linux-gnu'
            'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe
            -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
            -fstack-protector-strong --param=ssp-buffer-size=4
            -grecord-gcc-switches   -m64 -mtune=generic -fpie'
            'LDFLAGS=-Wl,-z,relro  -pie -Wl,-z,relro -Wl,-z,now'
            'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
            -fexceptions -fstack-protector-strong
            --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64
            -mtune=generic -fpie'
'PKG_CONFIG_PATH=%{_PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
        
        
        squid.conf 
        

          acl localnet src 10.0.0.0/8     # RFC1918
            possible internal network
          acl localnet src 172.16.0.0/12  # RFC1918
            possible internal network
          acl localnet src 192.168.0.0/16 # RFC1918
            possible internal network
          acl localnet src fc00::/7       # RFC 4193 local private
            network range
          acl localnet src fe80::/10      # RFC 4291 link-local
            (directly plugged) machines
          acl SSL_ports port 443
          acl Safe_ports port 80          # http
          acl Safe_ports port 21          # ftp
          acl Safe_ports port 443         # https
          acl Safe_ports port 70          # gopher
          acl Safe_ports port 210         # wais
          acl Safe_ports port 1025-65535  # unregistered ports
          acl Safe_ports port 280         # http-mgmt
          acl Safe_ports port 488         # gss-http
          acl Safe_ports port 591         # filemaker
          acl Safe_ports port 777         # multiling http
          acl Safe_ports port 8180
          acl CONNECT method CONNECT
          acl wvdial dst 10.1.4.45 10.1.4.50 10.1.4.53 10.1.4.48
            10.1.4.54 10.1.4.46 10.1.4.51 10.1.4.47 10.1.4.55 10.1.4.49
            10.1.4.52 10.1.2.4
          http_access allow wvdial
          acl dialer dstdomain .htmedia.net
          http_access allow dialer
          http_access deny !Safe_ports
          http_access deny CONNECT !SSL_ports
          http_access allow localhost manager
          http_access deny manager
          visible_hostname = NOIDAPROXY01.MYDOMAIN.NET
          append_domain  .mydomain.net
          ignore_expect_100 on
          dns_v4_first on
          auth_param ntlm program /usr/bin/ntlm_auth --diagnostics
            --helper-protocol=squid-2.5-ntlmssp --domain=HTMEDIA.NET
          auth_param ntlm children 1000
          auth_param ntlm keep_alive off
          auth_param basic program /usr/bin/ntlm_auth
            --helper-protocol=squid-2.5-basic
          auth_param basic children 100
          auth_param basic realm Squid proxy-caching web server
          auth_param basic credentialsttl 2 hours
          acl auth proxy_auth REQUIRED
          http_access allow all auth
          http_access allow localnet
          http_access allow localhost
          http_access deny all
          http_port 0.0.0.0:8080
          coredump_dir /var/spool/squid
          refresh_pattern ^ftp:           1440    20%     10080
          refresh_pattern ^gopher:        1440    0%      1440
          refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
          refresh_pattern .               0       20%     4320
        
        
        It was the same behavior with squid-3.1.10-19. I thought,
          upgrading to squid 3.3 would help. Please help me resolving
          this mystery. 
        

        -- 

        
                  Thanks & Regards

                    
                    Jagannath Naidu 
                    

      _______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

    
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users