[squid-users] Squid 3.5 TAG_NONE/503 HIER_NONE

[Rejaine Monteiro]

Hello guys,

I had a squid-proxy (squid-3.5.21-5.3.1.x86_64) running on a OpenSUSE
Leap 42.2

Everything is working well, access all the sites (http or https
sites), except  these two:

   www.uai.com.br or www.em.com.br

There is no blocking on the firewall (if bypass squid , access is
normally done) and the ip address is resolved normally.

And I am using a basic setup and of squid, without rules or access policies...

The only error you have in access.log is this:

1527006832.956     15 ::1 TAG_NONE/503 0 CONNECT www.em.com.br:443 -
HIER_NONE/- -
1527006834.376      0 ::1 TAG_NONE/503 0 CONNECT www.em.com.br:443 -
HIER_NONE/- -
1527006834.544      0 ::1 TAG_NONE/503 0 CONNECT www.em.com.br:443 -
HIER_NONE/- -
1527006834.686      0 ::1 TAG_NONE/503 0 CONNECT www.em.com.br:443 -
HIER_NONE/- -
1527006836.382     17 ::1 TAG_NONE/503 0 CONNECT www.uai.com.br:443 -
HIER_NONE/- -
1527006836.494      0 ::1 TAG_NONE/503 0 CONNECT www.uai.com.br:443 -
HIER_NONE/- -

The cache.log show only this:

2018/05/22 13:51:16.555 kid1| 33,2| client_side.cc(817) swanSong:
local=[::1]:3128 remote=[::1]:39166 flags=1
2018/05/22 13:53:28.197 kid1| 33,2| client_side.cc(817) swanSong:
local=[::1]:3128 remote=[::1]:39180 flags=1
2018/05/22 13:53:28.316 kid1| 33,2| client_side.cc(817) swanSong:
local=[::1]:3128 remote=[::1]:39184 flags=1
2018/05/22 13:53:36.972 kid1| 33,2| client_side.cc(817) swanSong:
local=[::1]:3128 remote=[::1]:39188 flags=1
2018/05/22 13:53:37.139 kid1| 33,2| client_side.cc(817) swanSong:
local=[::1]:3128 remote=[::1]:39190 flags=1


# My squid.conf
========================

acl localnet src 10.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT

visible_hostname localhost
debug_options ALL, 1 33.2

#Test (putting this did not help at all)
acl no-cache url_regex -i .uai.com.br .em.com.br
cache deny no-cache
acl no-parent url_regex -i .uai.com.br .em.com.br
always_direct allow no-parent

http_access deny! Safe_ports
http_access allow localhost manager
http_access deny manager

http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
coredump_dir / var / cache / squid
========================

I already tried using dns_v4_first on/off , via on/off , forwarded_for on/off
I also tried: ssl_bump peek all, ssl_bump splice all or  ssl_bump bump all

And this others configurations:

  pinger_enable off
  half_closed_clients off
  quick_abort_min 0 KB
  quick_abort_max 0 KB
  quick_abort_pct 95
  client_persistent_connections off
  server_persistent_connections off

None of this worked. Any tips?