On 10/4/21 5:18 PM, Henning Svane wrote: > I search more on the problem and it shows that Squid as default only use IPv6 I really doubt that. Your access.log records seem to confirm my belief that your Squid was listening on an IPv4 address (at least) -- Squid would not see (and log) requests from IPv4 clients like 10.40.61.11 if it were listening on IPv6 only. Unfortunately, the exact meaning of "::" and "[::]" addresses (and even "tcp6 ... ::" lines in netstat!) depends on the environment. Lots of folks (mis)interpret those symbols as "any IPv6 address". That interpretation is correct in some environments and wrong in many others. Here is one detailed answer that enumerates a few cases, including what looks like yours (except for an sshd instead of Squid): https://serverfault.com/a/39561 You can, of course, verify whether Squid listens on an IPv4 address by connecting to port 3128 on that IPv4 address using telnet or another program. Please note that Squid listening address has nothing to do with Squid outgoing address. That is why I suggested that you disable (misconfigured?) IPv6 in your environment so that Squid does not try to forward a request it received via IPv4 using a Squid-server connection with IPv6 addresses. HTH, Alex. > See here from status " sudo systemctl status squid" > Oct 04 20:39:01 APTProxy squid[51517]: Max Swap size: 0 KB > Oct 04 20:39:01 APTProxy squid[51517]: Using Least Load store dir selection > Oct 04 20:39:01 APTProxy squid[51517]: Current Directory is / > Oct 04 20:39:01 APTProxy squid[51517]: Finished loading MIME types and icons. > Oct 04 20:39:01 APTProxy squid[51517]: HTCP Disabled. > Oct 04 20:39:01 APTProxy squid[51517]: Pinger socket opened on FD 14 > Oct 04 20:39:01 APTProxy squid[51517]: Squid plugin modules loaded: 0 > Oct 04 20:39:01 APTProxy squid[51517]: Adaptation support is off. > Oct 04 20:39:01 APTProxy squid[51517]: Accepting HTTP Socket connections at local=[::]:3128 remote=[::] FD 12 flags=9 > Oct 04 20:39:02 APTProxy squid[51517]: storeLateRelease: released 0 objects > > sudo netstat -ntulp | grep LISTEN > tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN > tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN > tcp6 0 0 :::8000 :::* LISTEN > tcp6 0 0 :::3128 :::* LISTEN > tcp6 0 0 :::22 :::* LISTEN > > According to documentation this should get it to listen on both IPv4 and IPv6, but it do not work > X:X:X:X:Port > X:X:X:X:X:X:X:X:Port > > I have now remove dual stack as it is not possible to get IPv4 to work with dual stack. > It looks like works as design, but think that somebody need to look at the design as this is not smart. > > If anybody knows of a way to get this to work with dual stack. Please let me know. > > I have set it up to use IPv6 instead but that work not, get an error 403 Forbidden. > I cannot see why it is forbidden, I have allowed the IPv6 ip range. > > But force it to use pure IPv4 works. > > Regards > Henning > > -----Oprindelig meddelelse----- > Fra: Alex Rousskov <rousskov@xxxxxxxxxxxxxxxxxxxxxxx> > Sendt: 4. oktober 2021 19:55 > Til: Henning Svane <hsv@xxxxxxxxx>; squid-users@xxxxxxxxxxxxxxxxxxxxx > Emne: Re: SV: Squid do not reply > > On 10/4/21 1:18 PM, Henning Svane wrote: > >> I can see some request to IPv6, but I do not have IPv6 as my ISP do not offer it yet. > > It looks like your Squid does not know that your environment does not support IPv6. This is either a bug in Squid OR a misconfigured Squid build or deployment environment. > > >> I use dual stack to be future ready, as I hope my ISP sone will enter >> the modern age. > > This is not my area of expertise, but if your environment is lying to Squid that IPv6 is supported, then Squid may use IPv6 (and Squid will fail when it does use IPv6). Consider disabling IPv6 in your environment because IPv6 does not work yet, even though it is your ISP fault that it does not. > > > HTH, > > Alex. > > >> 1633311799.437 57 10.40.63.11 TCP_REFRESH_MODIFIED/200 114201 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633311799.470 31 10.40.63.11 TCP_REFRESH_MODIFIED/200 100971 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633311799.503 31 10.40.63.11 TCP_REFRESH_MODIFIED/200 114203 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633311799.768 224 10.40.63.11 TCP_MISS/200 1256699 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/main/binary-amd64/by-hash/SHA256/7cc00b82849880eab961e81146ad6e23770386b5> >> 1633311799.914 137 10.40.63.11 TCP_MISS/200 863985 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/universe/binary-amd64/by-hash/SHA256/1711a00ad226337b7ee774ec39dc4abd7841d> >> 1633319549.416 30020 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633319549.425 30027 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://ppa.launchpad.net/vbernat/haproxy-2.4/ubuntu/dists/focal/InRele >> ase - HIER_DIRECT/2001:67c:1560:8008::19 - >> 1633319579.447 30029 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633319579.455 30028 10.40.61.11 TCP_MISS_ABORTED/000 0 GET http://ppa.launchpad.net/vbernat/haproxy-2.4/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:67c:1560:8008::19 - >> 1633319579.487 37 10.40.61.11 TCP_REFRESH_UNMODIFIED/200 114208 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633319579.528 37 10.40.61.11 TCP_REFRESH_UNMODIFIED/200 100978 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633319579.566 37 10.40.61.11 TCP_REFRESH_UNMODIFIED/200 114210 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 text/plain >> 1633319579.875 230 10.40.61.11 TCP_MISS/200 1256699 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/main/binary-amd64/by-hash/SHA256/7cc00b82849880eab961e81146ad6e23770386b5> >> 1633319580.046 156 10.40.61.11 TCP_MISS/200 863985 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/universe/binary-amd64/by-hash/SHA256/1711a00ad226337b7ee774ec39dc4abd7841d> >> 1633339143.582 30030 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://ppa.launchpad.net/vbernat/haproxy-2.4/ubuntu/dists/focal/InRele >> ase - HIER_DIRECT/2001:67c:1560:8008::19 - >> 1633339143.582 30030 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633339173.613 30029 10.40.61.11 TCP_MISS_ABORTED/000 0 GET >> http://ppa.launchpad.net/vbernat/haproxy-2.4/ubuntu/dists/focal/InRele >> ase - HIER_DIRECT/2001:67c:1560:8008::19 - >> 1633339173.613 30029 10.40.61.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633339173.636 21 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339173.646 10 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339173.657 10 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339214.784 11 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339214.795 10 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339214.806 10 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339214.814 41 10.40.61.11 TCP_MISS/304 351 GET http://ppa.launchpad.net/vbernat/haproxy-2.4/ubuntu/dists/focal/InRelease - HIER_DIRECT/91.189.95.85 - >> 1633339214.816 9 10.40.61.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633339314.276 239404 10.40.61.11 NONE/503 0 CONNECT >> changelogs.ubuntu.com:443 - HIER_NONE/- - >> 1633351198.272 240065 10.40.63.11 NONE/503 0 CONNECT >> changelogs.ubuntu.com:443 - HIER_NONE/- - >> 1633353563.799 30030 10.40.63.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633353593.823 30023 10.40.63.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633353593.845 22 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633353593.858 13 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633353593.869 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633360882.874 30025 10.40.63.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633360897.217 0 10.40.63.11 TCP_MISS/200 2581 GET cache_object://10.40.63.11/info - HIER_NONE/- text/plain >> 1633360912.905 30030 10.40.63.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633360942.936 30030 10.40.63.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633360942.959 22 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633360942.970 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633360942.981 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633363175.859 30030 10.40.63.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633363205.889 30029 10.40.63.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633363205.913 23 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633363205.926 12 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633363205.937 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633364224.510 30029 10.40.63.11 TCP_MISS_ABORTED/000 0 GET >> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - >> HIER_DIRECT/2001:878:346::116 - >> 1633364254.540 30030 10.40.63.11 TCP_MISS_ABORTED/000 0 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease - HIER_DIRECT/2001:878:346::116 - >> 1633364254.563 22 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633364254.574 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease - HIER_DIRECT/130.225.254.116 - >> 1633364254.585 10 10.40.63.11 TCP_MISS/304 355 GET http://dk.archive.ubuntu.com/ubuntu/dists/focal-security/InRelease - HIER_DIRECT/130.225.254.116 - >> >> Regards >> Henning >> -----Oprindelig meddelelse----- >> Fra: Alex Rousskov <rousskov@xxxxxxxxxxxxxxxxxxxxxxx> >> Sendt: 4. oktober 2021 18:57 >> Til: Henning Svane <hsv@xxxxxxxxx>; squid-users@xxxxxxxxxxxxxxxxxxxxx >> Emne: Re: Squid do not reply >> >> On 10/4/21 12:32 PM, Henning Svane wrote: >> >>> I have tried to install my first Squid proxy as a proxy for >>> installation for ubuntu APT >>> >>> But the apt-get cannot access cache or get through the proxy. >>> >>> What have I missed or should have done otherwise ? >> >> What apt-related lines do you see in Squid's access.log? >> >> Alex. >> >> >> >>> Most of the time when I run >>> >>> sudo apt-get update >>> >>> or other updates or install commands >>> >>> I get the reply: >>> >>> odin@APTProxy:~$ sudo apt-get update >>> >>> [sudo] password for odin: >>> >>> 0% [Waiting for headers] >>> >>> >>> >>> And it stay on 0% until it time out and sends this output: >>> >>> [sudo] password for odin: >>> >>> Err:1 http://dk.archive.ubuntu.com/ubuntu >>> <http://dk.archive.ubuntu.com/ubuntu> focal InRelease >>> >>> Connection failed [IP: 10.40.63.11 20080] >>> >>> Hit:2 http://dk.archive.ubuntu.com/ubuntu focal-updates InRelease >>> >>> Hit:3 http://dk.archive.ubuntu.com/ubuntu focal-backports InRelease >>> >>> Hit:4 http://dk.archive.ubuntu.com/ubuntu focal-security InRelease >>> >>> Reading package lists... Done >>> >>> W: Failed to fetch >>> http://dk.archive.ubuntu.com/ubuntu/dists/focal/InRelease Connection >>> failed [IP: 10.40.63.11 3128] >>> >>> W: Some index files failed to download. They have been ignored, or >>> old ones used instead. >>> >>> >>> >>> Squid.conf : >>> >>> acl localhost src 127.0.0.1/32 ::1 >>> >>> acl localhost src 10.0.0.0/8 >>> >>> acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 >>> >>> acl localnet src 10.0.0.0/8 # RFC1918 possible internal network >>> >>> #acl localnet src 172.16.0.0/12 # RFC1918 possible internal network >>> >>> acl localnet src 192.168.0.0/16 # RFC1918 possible internal network >>> >>> acl localnet src FC00:18F:11AB::/48 >>> >>> >>> >>> acl SSL_ports port 443 >>> >>> acl Safe_ports port 80 # http >>> >>> acl Safe_ports port 443 # https >>> >>> acl CONNECT method CONNECT >>> >>> #acl allowed_websites dstdomain "/etc/squid/web_allowed.acl" >>> >>> http_access allow manager localhost >>> >>> http_access deny manager >>> >>> http_access deny !Safe_ports >>> >>> http_access deny CONNECT !SSL_ports >>> >>> http_access allow localnet >>> >>> http_access allow localhost >>> >>> http_access deny all >>> >>> http_port 3128 >>> >>> maximum_object_size 4096 MB >>> >>> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 >>> >>> refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 >>> >>> refresh_pattern . 0 20% 4320 >>> >>> refresh_all_ims on >>> >>> #debug_options ALL,5 >>> >>> >>> >>> "/etc/squid/web_allowed.acl" >>> >>> .ubuntu.com >>> >>> .launchpad.net >>> >>> >>> >>> If I run >>> >>> squidclient -h 10.40.63.11 -p 3128 -v mgr:info >>> >>> The reply are the following: >>> >>> Request: >>> >>> GET cache_object://10.40.63.11/info HTTP/1.0 >>> >>> Host: 10.40.63.11 >>> >>> User-Agent: squidclient/4.10 >>> >>> Accept: */* >>> >>> Connection: close >>> >>> >>> >>> >>> >>> . >>> >>> HTTP/1.1 200 OK >>> >>> Server: squid/4.10 >>> >>> Mime-Version: 1.0 >>> >>> Date: Mon, 04 Oct 2021 15:21:37 GMT >>> >>> Content-Type: text/plain;charset=utf-8 >>> >>> Expires: Mon, 04 Oct 2021 15:21:37 GMT >>> >>> Last-Modified: Mon, 04 Oct 2021 15:21:37 GMT >>> >>> X-Cache: MISS from APTProxy >>> >>> X-Cache-Lookup: MISS from APTProxy:20080 >>> >>> Via: 1.1 APTProxy (squid/4.10) >>> >>> Connection: close >>> >>> >>> >>> Squid Object Cache: Version 4.10 >>> >>> Build Info: Ubuntu linux >>> >>> Service Name: squid >>> >>> Start Time: Mon, 04 Oct 2021 07:33:47 GMT >>> >>> Current Time: Mon, 04 Oct 2021 15:21:37 GMT >>> >>> Connection information for squid: >>> >>> Number of clients accessing cache: 2 >>> >>> Number of HTTP requests received: 20 >>> >>> Number of ICP messages received: 0 >>> >>> Number of ICP messages sent: 0 >>> >>> Number of queued ICP replies: 0 >>> >>> Number of HTCP messages received: 0 >>> >>> Number of HTCP messages sent: 0 >>> >>> Request failure ratio: 0.00 >>> >>> Average HTTP requests per minute since start: 0.0 >>> >>> Average ICP messages per minute since start: 0.0 >>> >>> Select loop called: 65913 times, 425.864 ms avg >>> >>> Cache information for squid: >>> >>> Hits as % of all requests: 5min: 0.0%, 60min: 0.0% >>> >>> Hits as % of bytes sent: 5min: -0.0%, 60min: -0.0% >>> >>> Memory hits as % of hit requests: 5min: 0.0%, 60min: >>> 0.0% >>> >>> Disk hits as % of hit requests: 5min: 0.0%, 60min: 0.0% >>> >>> Storage Swap size: 0 KB >>> >>> Storage Swap capacity: 0.0% used, 0.0% free >>> >>> Storage Mem size: 212 KB >>> >>> Storage Mem capacity: 0.1% used, 99.9% free >>> >>> Mean Object Size: 0.00 KB >>> >>> Requests given to unlinkd: 0 >>> >>> Median Service Times (seconds) 5 min 60 min: >>> >>> HTTP Requests (All): 0.00000 0.00000 >>> >>> Cache Misses: 0.00000 0.00000 >>> >>> Cache Hits: 0.00000 0.00000 >>> >>> Near Hits: 0.00000 0.00000 >>> >>> Not-Modified Replies: 0.00000 0.00000 >>> >>> DNS Lookups: 0.00000 0.00000 >>> >>> ICP Queries: 0.00000 0.00000 >>> >>> Resource usage for squid: >>> >>> UP Time: 28069.974 seconds >>> >>> CPU Time: 2.997 seconds >>> >>> CPU Usage: 0.01% >>> >>> CPU Usage, 5 minute avg: 0.01% >>> >>> CPU Usage, 60 minute avg: 0.01% >>> >>> Maximum Resident Size: 94016 KB >>> >>> Page faults with physical i/o: 0 >>> >>> Memory accounted for: >>> >>> Total accounted: 655 KB >>> >>> memPoolAlloc calls: 68992 >>> >>> memPoolFree calls: 69118 >>> >>> File descriptor usage for squid: >>> >>> Maximum number of file descriptors: 1024 >>> >>> Largest file desc currently in use: 16 >>> >>> Number of file desc currently in use: 9 >>> >>> Files queued for open: 0 >>> >>> Available number of file descriptors: 1015 >>> >>> Reserved number of file descriptors: 100 >>> >>> Store Disk files open: 0 >>> >>> Internal Data Structures: >>> >>> 53 StoreEntries >>> >>> 53 StoreEntries with MemObjects >>> >>> 0 Hot Object Cache Items >>> >>> 0 on-disk objects >>> >>> >>> >>> Regards >>> >>> Henning >>> >>> >>> >>> >>> _______________________________________________ >>> squid-users mailing list >>> squid-users@xxxxxxxxxxxxxxxxxxxxx >>> http://lists.squid-cache.org/listinfo/squid-users >>> > _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
