On 16/04/2016 1:29 a.m., Odhiambo Washington wrote: > > With luck, I have managed to get squid to compile successfully (after > upgrading a few components here and there). I used: Yay! > > I have it running now (redirecting using IPFilter/IPNAT), but once in a > while I see this error about NAT: > <snip> > 2016/04/15 16:17:23| ERROR: NAT/TPROXY lookup failed to locate original IPs > on local=192.168.55.254:13128 remote=192.168.55.62:57724 FD 29 flags=33 These are the kernel NAT system telling Squid the connection being looked up has not record there. It could be TCP connections being made straight to the intercept port. If so you need to update the firewall config to prevent them, even from localhost. In Linux we use a mangle table rule, since that is the filter pre-NAT that can do it. I'm not sure how FreeBSD would do that. It has to be done on packets first arrival pre-NAT. Any filter that is applied after the NAT action will get it wrong due to the NAT changes. It could be the NAT systems table of connections filling up and overflowing. If so there should be a kernel sysctl somewhere to increase that table size. > > In any case, I am planning to rewrite the IPNAT rules into PF and use PF. > It's the inception stage so I haven't delved deep into ssl-bump > configurations... > HTH Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
