[squid-users] Stuggling with 3.5.16 on FreeBSD-9.3

Amos Jeffries squid3 at treenet.co.nz
Fri Apr 15 15:13:40 UTC 2016

On 16/04/2016 1:29 a.m., Odhiambo Washington wrote:
> With luck, I have managed to get squid to compile successfully (after
> upgrading a few components here and there). I used:


> I have it running now (redirecting using IPFilter/IPNAT), but once in a
> while I see this error about NAT:
> 2016/04/15 16:17:23| ERROR: NAT/TPROXY lookup failed to locate original IPs
> on local= remote= FD 29 flags=33

These are the kernel NAT system telling Squid the connection being
looked up has not record there.

It could be TCP connections being made straight to the intercept port.
If so you need to update the firewall config to prevent them, even from
 In Linux we use a mangle table rule, since that is the filter pre-NAT
that can do it. I'm not sure how FreeBSD would do that. It has to be
done on packets first arrival pre-NAT. Any filter that is applied after
the NAT action will get it wrong due to the NAT changes.

It could be the NAT systems table of connections filling up and
overflowing. If so there should be a kernel sysctl somewhere to increase
that table size.

> In any case, I am planning to rewrite the IPNAT rules into PF and use PF.
> It's the inception stage so I haven't delved deep into ssl-bump
> configurations...


More information about the squid-users mailing list