[squid-users] Forward loop when intercepting mode to proxy traffic to local VM

jblank at twu.net jblank at twu.net
Wed Jun 22 11:13:56 UTC 2016

Hey all,

Thanks to a bizarre client requirement (don't ask, it's head-hurty), I am 
required to maintain a legacy server which only supports obsolete SHA-1 
encryption. To keep things relatively safe, I'm attempting to contain the 
problem within a VM and use Squid on the VM's host to "re-encrypt" 
incoming traffic.

That is:
Outside world talks SHA2 to Squid; Squid internally talks SHA1 to the VM; 
Squid gets the response from the VM and passes it along (re-encrypting it 
to SHA2).

At least, that's the idea. But forget about SSL/encryption for the moment; 
I can't even get this concept working with plain old unencrypted HTTP.

The VM is running locally, and accessible via host-only networking on I set up a local /etc/hosts alternative JUST for 
Squid's use, which tells Squid that "myhost.mydomain.com" is actually Yet Squid seems to be ignoring this. Incoming requests for 
http://myhost.mydomain.com/ throw a standard Squid "Access Denied." 
page. cache.log reveals the presence of a forward loop:

2016/06/22 06:48:47 kid1| WARNING: Forwarding loop detected for:
GET /favicon.ico HTTP/1.1
Host: myhost.mydomain.com
Pragma: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) 
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Accept: */*
Referer: http://myhost.mydomain.com/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Via: 1.1 myhost (squid/3.4.8)
Cache-Control: no-cache
Connection: keep-alive

2016/06/22 06:48:47 kid1| ERROR: No forward-proxy ports configured.
2016/06/22 06:48:47 kid1| ERROR: No forward-proxy ports configured.

access.log, meanwhile, reports:

1466592527.367      0 TCP_MISS/403 3917 GET 
http://myhost.mydomain.com/favicon.ico - HIER_NONE/- text/html
1466592527.367      0 TCP_MISS/403 4000 GET 
http://myhost.mydomain.com/favicon.ico - ORIGINAL_DST/ text/html

(Here, "" is the EXTERNAL IP address of the VM host-- i.e., the 
actual "outside world" IP of myhost.mydomain.com, as opposed to the 
internal-only which it should be translated into. "" 
is the IP of my workstation running my Web browser.)

Below is the ENTIRE text of my /etc/squid3/squid.conf; at one point in 
this process, I got so frustrated that I pared it down to the absolute 

hosts_file /etc/squid3/squid_hosts
always_direct allow all
cache deny all
acl FROM_ALL src all
acl TO_LOCAL dst
acl TO_LOCAL dst
http_access allow FROM_ALL
http_access allow TO_LOCAL
http_access deny all
http_port 80 intercept

I've been bashing my head against this problem all evening to no effect. I 
am fairly sure I could simply solve my problem by writing a miniscule 
proxy script in PHP, Perl or Python, and using Apache's mod_rewrite rules 
to point all incoming Web requests through said proxy script. But I'd 
really rather not "re-invent the wheel"; I'd really rather use Squid.

Any help would be very much appreciated!



More information about the squid-users mailing list