[squid-users] squid intercept config

Thu Mar 5 15:09:04 UTC 2015

PORT   STATE SERVICE VERSION
23/tcp open  telnet  Cisco IOS telnetd
MAC Address: 88:5A:92:63:77:81 (Cisco)
Device type: router
Running: Cisco IOS 12.X
OS CPE: cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2
OS details: Cisco 7600 router (IOS 12.2)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: Randomized
Service Info: OS: IOS; Device: switch; CPE: cpe:/o:cisco:ios

On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov <yvoinov at gmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> What is Cisco model and iOS version?
>
> 05.03.15 20:25, Monah Baki пишет:
> > Yes, correct
> >
> > On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov <yvoinov at gmail.com>
> > wrote:
> >
> > 10.0.0.23 is your host? And 10.0.0.24 is proxy box?
> >
> > 05.03.15 20:15, Monah Baki пишет:
> >>>> '--prefix=/cache/squid' '--enable-follow-x-forwarded-for'
> >>>> '--with-large-files' '--enable-ssl' '--disable-ipv6'
> >>>> '--enable-esi' '--enable-kill-parent-hack' '--enable-snmp'
> >>>> '--with-pthreads' '--with-filedescriptors=65535'
> >>>> '--enable-cachemgr-hostname=hostname'
> >>>> '--enable-storeio=ufs,aufs,diskd,rock'
> >>>> '--enable-ipfw-transparent' '--enable-pf-transparent'
> >>>> '--with-nat-devpf' --enable-ltdl-convenience
> >>>>
> >>>>
> >>>>
> >>>>
> >>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri Voinov
> >>>> <yvoinov at gmail.com> wrote:
> >>>>
> >>>> This looking good too.
> >>>>
> >>>> Stupid question:
> >>>>
> >>>> With witch interception option squid builed?
> >>>>
> >>>> I.e, squid -v?
> >>>>
> >>>> 05.03.15 18:19, Monah Baki пишет:
> >>>>>>> Hi all, can anyone verify if this is correct, need to
> >>>>>>> make ure that users will be able to access the internet
> >>>>>>> via the squid.
> >>>>>>>
> >>>>>>> Running FreeBSD with a single interface with
> >>>>>>> Squid-3.5.2
> >>>>>>>
> >>>>>>> Policy based routing on Cisco with the following:
> >>>>>>>
> >>>>>>>
> >>>>>>> interface GigabitEthernet0/0/1.1
> >>>>>>>
> >>>>>>> encapsulation dot1Q 1 native
> >>>>>>>
> >>>>>>> ip address 10.0.0.9 255.255.255.0
> >>>>>>>
> >>>>>>> no ip redirects
> >>>>>>>
> >>>>>>> no ip unreachables
> >>>>>>>
> >>>>>>> ip nat inside
> >>>>>>>
> >>>>>>> standby 1 ip 10.0.0.10
> >>>>>>>
> >>>>>>> standby 1 priority 120
> >>>>>>>
> >>>>>>> standby 1 preempt
> >>>>>>>
> >>>>>>> standby 1 name HSRP
> >>>>>>>
> >>>>>>> ip policy route-map CFLOW
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> ip access-list extended REDIRECT
> >>>>>>>
> >>>>>>> deny   tcp host 10.0.0.24 any eq www
> >>>>>>>
> >>>>>>> permit tcp host 10.0.0.23 any eq www
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> route-map CFLOW permit 10
> >>>>>>>
> >>>>>>> match ip address REDIRECT set ip next-hop 10.0.0.24
> >>>>>>>
> >>>>>>> In my /etc/pf.conf rdr pass inet proto tcp from
> >>>>>>> 10.0.0.0/8 to any port 80 -> 10.0.0.24 port 3129
> >>>>>>>
> >>>>>>> # block in pass in log quick on bge0 pass out log quick
> >>>>>>> on bge0 pass out keep state
> >>>>>>>
> >>>>>>> and finally in my squid.conf: http_port 3128 http_port
> >>>>>>> 3129 intercept
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> And for testing purposes from the squid server:
> >>>>>>> ./squidclient -h 10.0.0.24 -p 3128
> >>>>>>> http://www.freebsd.org/
> >>>>>>>
> >>>>>>> If I replace -p 3128 with -p 80, I get a access denied,
> >>>>>>> and if I omit the -p 3128 completely, I can access the
> >>>>>>> websites.
> >>>>>>>
> >>>>>>> tcpdump with (-p 3128)
> >>>>>>>
> >>>>>>> 13:15:02.681106 IP ISN-PHC-CACHE.44017 >
> >>>>>>> wfe0.ysv.freebsd.org.http: Flags [.], ack 17377, win
> >>>>>>> 1018, options [nop,nop,TS val 985588797 ecr
> >>>>>>> 1054387720], length 0 13:15:02.681421 IP
> >>>>>>> wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags
> >>>>>>> [.], seq 17377:18825, ack 289, win 1040, options
> >>>>>>> [nop,nop,TS val 1054387720 ecr 985588501], length 1448
> >>>>>>> 13:15:02.681575 IP wfe0.ysv.freebsd.org.http >
> >>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq 18825:20273, ack
> >>>>>>> 289, win 1040, options [nop,nop,TS val 1054387720 ecr
> >>>>>>> 985588501], length 1448
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> Did I miss anything?
> >>>>>>>
> >>>>>>> Thanks Monah
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> _______________________________________________
> >>>>>>> squid-users mailing list
> >>>>>>> squid-users at lists.squid-cache.org
> >>>>>>> http://lists.squid-cache.org/listinfo/squid-users
> >>>>>>>
> >>>>> _______________________________________________
> >>>>> squid-users mailing list squid-users at lists.squid-cache.org
> >>>>> http://lists.squid-cache.org/listinfo/squid-users
> >>>>>
> >>>>
> >>
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBAgAGBQJU+Gi2AAoJENNXIZxhPexG5ZsH/jmkZq8gHsA0LSfGBS4PcIb8
> fghHqg00FH48WqCWo4WtagehI1MFU7wdtxERhDJWyO2a3kaOg6i8BfWgC0Cnu3WX
> AMRMs8z2f2Foz9o1UgLMb3LLLQOuXjioCHq0RKFaW5TD70Fqk14CHNCDOSTaHEMv
> e/65hh4aGek1f5wxAGCfPGoX7tTtiH0DZ/XBZ7YOlAqrl0wcAYLI+1gTq2zOk98Y
> Q6zu9whBqKeZvBXMxu8aLyxan3RZcGDeSDlF89l+jwNw+6enHgVElsU22+1eQ54P
> IxmIAaJEbNmSFisj1wb+XRV5SsdjN8etQcBgh5rCz4TWqh9UgsW1K2BonLH4yns=
> =hEYd
> -----END PGP SIGNATURE-----
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150305/d91a8ae0/attachment-0001.html>