<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:24px"><div dir="ltr" id="yui_3_16_0_1_1415765045085_6748"><span>hello peter</span></div><div dir="ltr"><br><span></span></div><div id="yui_3_16_0_1_1415765045085_6751" dir="ltr"><span id="yui_3_16_0_1_1415765045085_6750">can you check if your squid does gre return? <br></span></div><div id="yui_3_16_0_1_1415765045085_6752" dir="ltr"><br><span id="yui_3_16_0_1_1415765045085_6750"></span></div><div id="yui_3_16_0_1_1415765045085_6753" dir="ltr"><br><span id="yui_3_16_0_1_1415765045085_6750"></span></div><div id="yui_3_16_0_1_1415765045085_6754" dir="ltr"><span id="yui_3_16_0_1_1415765045085_6750">It is unrelated to your issue though :)</span></div><div id="yui_3_16_0_1_1415765045085_6755"> </div><div id="yui_3_16_0_1_1415765045085_6758" class="signature"><div id="yui_3_16_0_1_1415765045085_6757"><strong id="yui_3_16_0_1_1415765045085_6756">Thanks and regards<br><br>Yogesh Gawankar</strong></div><div id="yui_3_16_0_1_1415765045085_6759" style="BACKGROUND-COLOR:transparent;FONT-STYLE:normal;FONT-FAMILY:arial, helvetica, clean, sans-serif;COLOR:rgb(0,0,0);FONT-SIZE:13px;"><br><strong id="yui_3_16_0_1_1415765045085_6760"><var id="yui-ie-cursor"></var></strong></div></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 24px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font face="Arial" size="2"> On Wednesday, November 12, 2014 9:02 AM, Amos Jeffries <squid3@treenet.co.nz> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">-----BEGIN PGP SIGNED MESSAGE-----<br clear="none">Hash: SHA1<br clear="none"><br clear="none">On 12/11/2014 7:47 a.m., Peter Gross wrote:<br clear="none">> Hi, I am a new user of Squid and would first like to thank the<br clear="none">> developers for this excellent software. This is my first post to<br clear="none">> the mailing list ... I have been tasked with setting up quite<br clear="none">> restrictive web access control at work. I plan to use an<br clear="none">> intercepting squid proxy with SSL bump. There will also be WCCPv2<br clear="none">> to/from a Cisco IOS router. Since this is quite a bit of<br clear="none">> complexity, I though it prudent to start slowly, in steps. So first<br clear="none">> -- to get my feet wet -- I set up squid (version 3.4.8, built using<br clear="none">> rpmbuild from the src rpm from ngtech) on a home linux server<br clear="none">> (Centos 5.11 -- no Cisco at home) which is also the firewall router<br clear="none">> for my home network. I also decided to start out with plain vanilla<br clear="none">> proxying (no interception -- use browser setting). This worked <br clear="none">> fine. I then tested HTTP interception by changing squid.conf from: <br clear="none">> http_port 3128 -to- http_port 3128 intercept<br clear="none"><br clear="none">Please use a second http_port with a different number for each input<br clear="none">"mode". Squid needs at least one forward-proxy port for things like<br clear="none">icons URLs in error pages - 3128 is the port number W3C allocated for<br clear="none">that.<br clear="none"><br clear="none">> <br clear="none">> and adding the following rule to my shorewall firewall: <br clear="none">> REDIRECT:info loc:192.168.101.9 3128 tcp http<br clear="none">> <br clear="none">> I wanted to test intercepting just one host before turning it on<br clear="none">> for all hosts and wireless devices in my network.<br clear="none">> <br clear="none">> 192.168.101.9 is another Centos PC on my network. Squid is running<br clear="none">> on 192.168.101.253.<br clear="none">> <br clear="none">> The interception seemed to work fine ... access.log showed lots of <br clear="none">> successful proxy activity. Then came the problem: going to <br clear="none">> <a shape="rect" href="https://www.google.com/" target="_blank">https://www.google.com </a>failed (not every time, but frequently). If<br clear="none">> I turned off the REDIRECT line in the shorewall rules file and<br clear="none">> restarted shorewall, no problem. This seemed very peculiar because<br clear="none">> no HTTPS traffic should be redirected to the proxy.<br clear="none"><br clear="none">Correct. Very perculiar.<br clear="none"><br clear="none">> Here are the errors that showed up in cache.log when redirection<br clear="none">> (NAT-ing) was on:<br clear="none">> <br clear="none">> 2014/11/11 11:03:42 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed<br clear="none">> on local=192.168.101.253:3128 remote=192.168.101.9:34165 FD 11<br clear="none">> flags=33: (92) Protocol not available<br clear="none"><br clear="none">That is forward-proxy traffic going to the port with intercept on it.<br clear="none">Separating the ports should help you identify if this is error pages<br clear="none">embeded objects or not.<br clear="none"><br clear="none"><br clear="none">Amos<br clear="none">-----BEGIN PGP SIGNATURE-----<br clear="none">Version: GnuPG v2.0.22 (MingW32)<br clear="none"><br clear="none">iQEcBAEBAgAGBQJUYtSvAAoJELJo5wb/XPRjcJ0H/jeEbRpFJYp0v5nfTWlwdOTV<br clear="none">ajA2SpQ+3GY0s8iPX0FJnl2mFSfNVs5V+515/iOSGfEUhIS/+qGyWCqIjA79tTHy<br clear="none">dTx9eKOc1boF/7nadgfFl/60rpJprNfuosh9iIhkDShC3bNzz3y5lcPVyPi4bhKD<br clear="none">wkG/dT5GdUdVTVn1aA1cojebrJ2SUMe/NMyFdEADIyOLSNsDT000MMB4Mr3VnVBA<br clear="none">68nq6wdGdnK0/ydm/OvErruVgPqQGP/IvpdLaHw0+2ck2fYRlzgB9+6P1an24rDA<br clear="none">hgsn0sZ/MfIxJd/biC5Pk0gnNzapVI+n4E2NIx+F0aN/y2Bgn0+AncvEqKnSS3U=<br clear="none">=tp1A<br clear="none">-----END PGP SIGNATURE-----<div class="yqt1393407857" id="yqtfd33095"><br clear="none">_______________________________________________<br clear="none">squid-users mailing list<br clear="none"><a shape="rect" ymailto="mailto:squid-users@lists.squid-cache.org" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br clear="none"><a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>