Date: Sat, 18 Nov 2017 22:06:31 +0000
From: Antony Stone <Antony.Stone@xxxxxxxxxx.source.it >
To: squid-users@lists.squid-cache.org
Subject: Re: Squid Behavior to Ping Destination on
Registered Ports
Message-ID: <201711182206.31894.Antony.Stone@xxxxxxxxxxxxxxxxxxxx >
Content-Type: Text/Plain; charset="iso-8859-15"
On Saturday 18 November 2017 at 21:21:38, Kevin Wong wrote:
> My firewall (Juniper SRX) caught outbound ICMP flows using vulnerable ports
That makes no sense. ICMP doesn't use port numbers.
That is why I asked the list and was a follow up question if somebody replied it is "normal traffic to find the path to the destination or proxies in between".
> before initiating outbound HTTP traffic. I am running an updated Squid
> Proxy on Ubuntu 16.04. Can anybody explain or confirm the Squid behavior?
What ICMP traffic are you blocking and why?
Besides some basic IDS rules, I'm not blocking ICMP traffic. What's being blocked are all ports that are not explicitly allowed outbound. In this case, ports 1024, 1280, and 1536 were blocked and 80/tcp, 53/udp are allowed outbound.
Antony.
--
I bought a book about anti-gravity. The reviews say you can't put it down.
Please reply to the list;
please *don't* CC me.
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
