[squid-users] squid intercept config
Monah Baki
monahbaki at gmail.com
Thu Mar 5 17:10:23 UTC 2015
How can I confirm, I have access only to the BSD box
Thanks
On Thu, Mar 5, 2015 at 11:12 AM, Yuri Voinov <yvoinov at gmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Does 80 port outside BSD-box listens?
>
> 05.03.15 21:25, Monah Baki пишет:
> > root at ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i pflog0
> > tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose
> > output suppressed, use -v or -vv for full protocol decode listening
> > on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535
> > bytes capability mode sandbox enabled 00:00:00.000000 rule
> > 0..16777216/0(match): pass in on bge0: 10.0.0.106.5678
> >> 255.255.255.255.5678: UDP, length 88
> > 00:00:08.342860 rule 0..16777216/0(match): pass in on bge0:
> > 10.0.0.14.54264
> >> 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options [mss
> > 1460,nop,wscale 2,nop,nop,sackOK], length 0
> >
> >
> >
> > On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov <yvoinov at gmail.com>
> > wrote:
> >
> > Hm. No.
> >
> > We not checked only OS.
> >
> > Does your BSD really loads PF module?
> >
> > 05.03.15 21:16, Monah Baki пишет:
> >>>> Not sure why the client is running old hard/soft ware, could
> >>>> it be cause of the hardware? Is FreeBSD an issue, should I
> >>>> switch to linux?
> >>>>
> >>>> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov
> >>>> <yvoinov at gmail.com> wrote:
> >>>>
> >>>> Wow, 7600!
> >>>>
> >>>> But why is so antique iOS?! Current is 15.4
> >>>>
> >>>> 05.03.15 21:09, Monah Baki пишет:
> >>>>>>> PORT STATE SERVICE VERSION 23/tcp open telnet Cisco
> >>>>>>> IOS telnetd MAC Address: 88:5A:92:63:77:81 (Cisco)
> >>>>>>> Device type: router Running: Cisco IOS 12.X OS CPE:
> >>>>>>> cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2 OS
> >>>>>>> details: Cisco 7600 router (IOS 12.2) Network Distance:
> >>>>>>> 1 hop TCP Sequence Prediction: Difficulty=258 (Good
> >>>>>>> luck!) IP ID Sequence Generation: Randomized Service
> >>>>>>> Info: OS: IOS; Device: switch; CPE: cpe:/o:cisco:ios
> >>>>>>>
> >>>>>>>
> >>>>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov
> >>>>>>> <yvoinov at gmail.com> wrote:
> >>>>>>>
> >>>>>>> What is Cisco model and iOS version?
> >>>>>>>
> >>>>>>> 05.03.15 20:25, Monah Baki пишет:
> >>>>>>>>>> Yes, correct
> >>>>>>>>>>
> >>>>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov
> >>>>>>>>>> <yvoinov at gmail.com> wrote:
> >>>>>>>>>>
> >>>>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is proxy
> >>>>>>>>>> box?
> >>>>>>>>>>
> >>>>>>>>>> 05.03.15 20:15, Monah Baki пишет:
> >>>>>>>>>>>>> '--prefix=/cache/squid'
> >>>>>>>>>>>>> '--enable-follow-x-forwarded-for'
> >>>>>>>>>>>>> '--with-large-files' '--enable-ssl'
> >>>>>>>>>>>>> '--disable-ipv6' '--enable-esi'
> >>>>>>>>>>>>> '--enable-kill-parent-hack'
> >>>>>>>>>>>>> '--enable-snmp' '--with-pthreads'
> >>>>>>>>>>>>> '--with-filedescriptors=65535'
> >>>>>>>>>>>>> '--enable-cachemgr-hostname=hostname'
> >>>>>>>>>>>>> '--enable-storeio=ufs,aufs,diskd,rock'
> >>>>>>>>>>>>> '--enable-ipfw-transparent'
> >>>>>>>>>>>>> '--enable-pf-transparent'
> >>>>>>>>>>>>> '--with-nat-devpf'
> >>>>>>>>>>>>> --enable-ltdl-convenience
> >>>>>>>>>>>>>
> >>>>>>>>>>>>>
> >>>>>>>>>>>>>
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri
> >>>>>>>>>>>>> Voinov <yvoinov at gmail.com> wrote:
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> This looking good too.
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> Stupid question:
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> With witch interception option squid
> >>>>>>>>>>>>> builed?
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> I.e, squid -v?
> >>>>>>>>>>>>>
> >>>>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:
> >>>>>>>>>>>>>>>> Hi all, can anyone verify if this is
> >>>>>>>>>>>>>>>> correct, need to make ure that users
> >>>>>>>>>>>>>>>> will be able to access the internet
> >>>>>>>>>>>>>>>> via the squid.
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> Running FreeBSD with a single
> >>>>>>>>>>>>>>>> interface with Squid-3.5.2
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> Policy based routing on Cisco with
> >>>>>>>>>>>>>>>> the following:
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> interface GigabitEthernet0/0/1.1
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> encapsulation dot1Q 1 native
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> ip address 10.0.0.9 255.255.255.0
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> no ip redirects
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> no ip unreachables
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> ip nat inside
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> standby 1 ip 10.0.0.10
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> standby 1 priority 120
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> standby 1 preempt
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> standby 1 name HSRP
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> ip policy route-map CFLOW
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> ip access-list extended REDIRECT
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> deny tcp host 10.0.0.24 any eq www
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> permit tcp host 10.0.0.23 any eq www
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> route-map CFLOW permit 10
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> match ip address REDIRECT set ip
> >>>>>>>>>>>>>>>> next-hop 10.0.0.24
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> In my /etc/pf.conf rdr pass inet
> >>>>>>>>>>>>>>>> proto tcp from 10.0.0.0/8 to any port
> >>>>>>>>>>>>>>>> 80 -> 10.0.0.24 port 3129
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> # block in pass in log quick on bge0
> >>>>>>>>>>>>>>>> pass out log quick on bge0 pass out
> >>>>>>>>>>>>>>>> keep state
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> and finally in my squid.conf:
> >>>>>>>>>>>>>>>> http_port 3128 http_port 3129
> >>>>>>>>>>>>>>>> intercept
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> And for testing purposes from the
> >>>>>>>>>>>>>>>> squid server: ./squidclient -h
> >>>>>>>>>>>>>>>> 10.0.0.24 -p 3128
> >>>>>>>>>>>>>>>> http://www.freebsd.org/
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> If I replace -p 3128 with -p 80, I
> >>>>>>>>>>>>>>>> get a access denied, and if I omit
> >>>>>>>>>>>>>>>> the -p 3128 completely, I can access
> >>>>>>>>>>>>>>>> the websites.
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> tcpdump with (-p 3128)
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> 13:15:02.681106 IP
> >>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017 >
> >>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http: Flags [.],
> >>>>>>>>>>>>>>>> ack 17377, win 1018, options
> >>>>>>>>>>>>>>>> [nop,nop,TS val 985588797 ecr
> >>>>>>>>>>>>>>>> 1054387720], length 0 13:15:02.681421
> >>>>>>>>>>>>>>>> IP wfe0.ysv.freebsd.org.http >
> >>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
> >>>>>>>>>>>>>>>> 17377:18825, ack 289, win 1040,
> >>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720
> >>>>>>>>>>>>>>>> ecr 985588501], length 1448
> >>>>>>>>>>>>>>>> 13:15:02.681575 IP
> >>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http >
> >>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq
> >>>>>>>>>>>>>>>> 18825:20273, ack 289, win 1040,
> >>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720
> >>>>>>>>>>>>>>>> ecr 985588501], length 1448
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> Did I miss anything?
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> Thanks Monah
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>> _______________________________________________
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >
> >>>>>>>>>>>>>>>>
> squid-users mailing list
> >>>>>>>>>>>>>>>> squid-users at lists.squid-cache.org
> >>>>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
> >>>>>>>>>>>>>>>>
> >>>>>>>>>>>>>>
> >>>>>>>>>>>>>>>>
> >>>>
> >>>>>>>>>>>>>>>>
> >
> >>>>>>>>>>>>>>>>
> _______________________________________________
> >>>>>>>>>>>>>> squid-users mailing list
> >>>>>>>>>>>>>> squid-users at lists.squid-cache.org
> >>>>>>>>>>>>>> http://lists.squid-cache.org/listinfo/squid-users
> >>>>>>>>>>>>>>
> >>>>>>>>>>>>>
> >>>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>
> >>>>>>>
> >>>>>
> >>>>
> >>
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBAgAGBQJU+ICHAAoJENNXIZxhPexGX9oH/ibNwg5eWJg+hfTfbNmxHNKb
> D5b08bvJsbtbP8N5RVZQTnzKvLNOEnoVLHU22Zh9HDSy1OJ4fFyggNLFZPrAb09M
> BH8URJSCjlMQudKXC5heZMaOu2V4idO70Cvif8I+pB1DcManxT3jldqYDFOClqjc
> AV+NinCwEwxpcLjE1TL/a8MfVPjFw2EcI3P0Ne2IOwz1CwIsiTNcQr2kkX3MZq6b
> S/ZbMygeHQvdNqMNxnv4o9ZdW0G/J7+2BCYly9Ks9mwOn7tA9qkueNTMXB/WAYXs
> 3355SSl69GVSMMJRCiAiXdm9x7flnPgN/kJUVgJ0sfWvhN+ahkbgDHph4qJWP3I=
> =5Obg
> -----END PGP SIGNATURE-----
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150305/0efaa89e/attachment-0001.html>
More information about the squid-users
mailing list