[squid-users] squid intercept config
Yuri Voinov
yvoinov at gmail.com
Thu Mar 5 16:12:55 UTC 2015
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Does 80 port outside BSD-box listens?
05.03.15 21:25, Monah Baki пишет:
> root at ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i pflog0
> tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose
> output suppressed, use -v or -vv for full protocol decode listening
> on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535
> bytes capability mode sandbox enabled 00:00:00.000000 rule
> 0..16777216/0(match): pass in on bge0: 10.0.0.106.5678
>> 255.255.255.255.5678: UDP, length 88
> 00:00:08.342860 rule 0..16777216/0(match): pass in on bge0:
> 10.0.0.14.54264
>> 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options [mss
> 1460,nop,wscale 2,nop,nop,sackOK], length 0
>
>
>
> On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov <yvoinov at gmail.com>
> wrote:
>
> Hm. No.
>
> We not checked only OS.
>
> Does your BSD really loads PF module?
>
> 05.03.15 21:16, Monah Baki пишет:
>>>> Not sure why the client is running old hard/soft ware, could
>>>> it be cause of the hardware? Is FreeBSD an issue, should I
>>>> switch to linux?
>>>>
>>>> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov
>>>> <yvoinov at gmail.com> wrote:
>>>>
>>>> Wow, 7600!
>>>>
>>>> But why is so antique iOS?! Current is 15.4
>>>>
>>>> 05.03.15 21:09, Monah Baki пишет:
>>>>>>> PORT STATE SERVICE VERSION 23/tcp open telnet Cisco
>>>>>>> IOS telnetd MAC Address: 88:5A:92:63:77:81 (Cisco)
>>>>>>> Device type: router Running: Cisco IOS 12.X OS CPE:
>>>>>>> cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2 OS
>>>>>>> details: Cisco 7600 router (IOS 12.2) Network Distance:
>>>>>>> 1 hop TCP Sequence Prediction: Difficulty=258 (Good
>>>>>>> luck!) IP ID Sequence Generation: Randomized Service
>>>>>>> Info: OS: IOS; Device: switch; CPE: cpe:/o:cisco:ios
>>>>>>>
>>>>>>>
>>>>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov
>>>>>>> <yvoinov at gmail.com> wrote:
>>>>>>>
>>>>>>> What is Cisco model and iOS version?
>>>>>>>
>>>>>>> 05.03.15 20:25, Monah Baki пишет:
>>>>>>>>>> Yes, correct
>>>>>>>>>>
>>>>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov
>>>>>>>>>> <yvoinov at gmail.com> wrote:
>>>>>>>>>>
>>>>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is proxy
>>>>>>>>>> box?
>>>>>>>>>>
>>>>>>>>>> 05.03.15 20:15, Monah Baki пишет:
>>>>>>>>>>>>> '--prefix=/cache/squid'
>>>>>>>>>>>>> '--enable-follow-x-forwarded-for'
>>>>>>>>>>>>> '--with-large-files' '--enable-ssl'
>>>>>>>>>>>>> '--disable-ipv6' '--enable-esi'
>>>>>>>>>>>>> '--enable-kill-parent-hack'
>>>>>>>>>>>>> '--enable-snmp' '--with-pthreads'
>>>>>>>>>>>>> '--with-filedescriptors=65535'
>>>>>>>>>>>>> '--enable-cachemgr-hostname=hostname'
>>>>>>>>>>>>> '--enable-storeio=ufs,aufs,diskd,rock'
>>>>>>>>>>>>> '--enable-ipfw-transparent'
>>>>>>>>>>>>> '--enable-pf-transparent'
>>>>>>>>>>>>> '--with-nat-devpf'
>>>>>>>>>>>>> --enable-ltdl-convenience
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri
>>>>>>>>>>>>> Voinov <yvoinov at gmail.com> wrote:
>>>>>>>>>>>>>
>>>>>>>>>>>>> This looking good too.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Stupid question:
>>>>>>>>>>>>>
>>>>>>>>>>>>> With witch interception option squid
>>>>>>>>>>>>> builed?
>>>>>>>>>>>>>
>>>>>>>>>>>>> I.e, squid -v?
>>>>>>>>>>>>>
>>>>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:
>>>>>>>>>>>>>>>> Hi all, can anyone verify if this is
>>>>>>>>>>>>>>>> correct, need to make ure that users
>>>>>>>>>>>>>>>> will be able to access the internet
>>>>>>>>>>>>>>>> via the squid.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Running FreeBSD with a single
>>>>>>>>>>>>>>>> interface with Squid-3.5.2
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Policy based routing on Cisco with
>>>>>>>>>>>>>>>> the following:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> interface GigabitEthernet0/0/1.1
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> encapsulation dot1Q 1 native
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ip address 10.0.0.9 255.255.255.0
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> no ip redirects
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> no ip unreachables
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ip nat inside
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> standby 1 ip 10.0.0.10
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> standby 1 priority 120
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> standby 1 preempt
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> standby 1 name HSRP
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ip policy route-map CFLOW
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ip access-list extended REDIRECT
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> deny tcp host 10.0.0.24 any eq www
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> permit tcp host 10.0.0.23 any eq www
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> route-map CFLOW permit 10
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> match ip address REDIRECT set ip
>>>>>>>>>>>>>>>> next-hop 10.0.0.24
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> In my /etc/pf.conf rdr pass inet
>>>>>>>>>>>>>>>> proto tcp from 10.0.0.0/8 to any port
>>>>>>>>>>>>>>>> 80 -> 10.0.0.24 port 3129
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> # block in pass in log quick on bge0
>>>>>>>>>>>>>>>> pass out log quick on bge0 pass out
>>>>>>>>>>>>>>>> keep state
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> and finally in my squid.conf:
>>>>>>>>>>>>>>>> http_port 3128 http_port 3129
>>>>>>>>>>>>>>>> intercept
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> And for testing purposes from the
>>>>>>>>>>>>>>>> squid server: ./squidclient -h
>>>>>>>>>>>>>>>> 10.0.0.24 -p 3128
>>>>>>>>>>>>>>>> http://www.freebsd.org/
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> If I replace -p 3128 with -p 80, I
>>>>>>>>>>>>>>>> get a access denied, and if I omit
>>>>>>>>>>>>>>>> the -p 3128 completely, I can access
>>>>>>>>>>>>>>>> the websites.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> tcpdump with (-p 3128)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> 13:15:02.681106 IP
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017 >
>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http: Flags [.],
>>>>>>>>>>>>>>>> ack 17377, win 1018, options
>>>>>>>>>>>>>>>> [nop,nop,TS val 985588797 ecr
>>>>>>>>>>>>>>>> 1054387720], length 0 13:15:02.681421
>>>>>>>>>>>>>>>> IP wfe0.ysv.freebsd.org.http >
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
>>>>>>>>>>>>>>>> 17377:18825, ack 289, win 1040,
>>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720
>>>>>>>>>>>>>>>> ecr 985588501], length 1448
>>>>>>>>>>>>>>>> 13:15:02.681575 IP
>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http >
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
>>>>>>>>>>>>>>>> 18825:20273, ack 289, win 1040,
>>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720
>>>>>>>>>>>>>>>> ecr 985588501], length 1448
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Did I miss anything?
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Thanks Monah
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> _______________________________________________
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>
>>>>>>>>>>>>>>>>
squid-users mailing list
>>>>>>>>>>>>>>>> squid-users at lists.squid-cache.org
>>>>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>
>>>>>>>>>>>>>>>>
>
>>>>>>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>>>>> squid-users mailing list
>>>>>>>>>>>>>> squid-users at lists.squid-cache.org
>>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>
>>>>
>>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBAgAGBQJU+ICHAAoJENNXIZxhPexGX9oH/ibNwg5eWJg+hfTfbNmxHNKb
D5b08bvJsbtbP8N5RVZQTnzKvLNOEnoVLHU22Zh9HDSy1OJ4fFyggNLFZPrAb09M
BH8URJSCjlMQudKXC5heZMaOu2V4idO70Cvif8I+pB1DcManxT3jldqYDFOClqjc
AV+NinCwEwxpcLjE1TL/a8MfVPjFw2EcI3P0Ne2IOwz1CwIsiTNcQr2kkX3MZq6b
S/ZbMygeHQvdNqMNxnv4o9ZdW0G/J7+2BCYly9Ks9mwOn7tA9qkueNTMXB/WAYXs
3355SSl69GVSMMJRCiAiXdm9x7flnPgN/kJUVgJ0sfWvhN+ahkbgDHph4qJWP3I=
=5Obg
-----END PGP SIGNATURE-----
More information about the squid-users
mailing list