<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
Since upgrading from 3.1.22 to 3.4.8 I have been unable to get
the transparent mode<br>
to accept my IP. I am seeing permission denied in the transaction
when I do a packet dump.<br>
I have read the documentation making changes for 3.4.8. <br>
I even allowed everything and no go.<br>
<br>
I also compiled squid and here is my configure script:<br>
<br>
./configure \<br>
--prefix=/usr/share/squid-3.4.8 \<br>
--libdir=/usr/lib${LIBDIRSUFFIX} \<br>
--sysconfdir=/etc/squid \<br>
--localstatedir=/var/log/squid \<br>
--datadir=/usr/share/squid-3.4.8 \<br>
--with-pidfile=/var/run/squid/squid.pid \<br>
--mandir=/usr/man \<br>
--with-logdir=/var/log/squid \<br>
--enable-snmp \<br>
--enable-ipf-transparent \<br>
--enable-ipfw-transparent <br>
# --enable-auth="basic" \<br>
# --enable-basic-auth-helpers="NCSA" \<br>
# --enable-linux-netfilter \<br>
# --enable-async-io \<br>
# --disable-strict-error-checking<br>
<br>
My machine the browser is on:<br>
<br>
66.159.32.31<br>
<br>
The machine that is running squid:<br>
<br>
66.159.47.22<br>
<br>
Here is my squid.conf<br>
<br>
===================================================================================<br>
<br>
#<br>
# Recommended minimum configuration:<br>
#<br>
<br>
cache_effective_user squid<br>
cache_effective_group squid<br>
<br>
# Example rule allowing access from your local networks.<br>
# Adapt to list your (internal) IP networks from where browsing<br>
# should be allowed<br>
acl localnet src all # RFC1918 possible internal network<br>
#acl localnet src 66.159.32.0/24 # RFC1918 possible internal
network<br>
#acl localnet src 108.161.167.0/24 # RFC1918 possible internal
network<br>
#acl localnet src 66.159.47.0/24 # RFC1918 possible internal
network<br>
#acl localnet src 127.0.0.0/24 # RFC1918 possible internal network<br>
<br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl CONNECT method CONNECT<br>
<br>
#<br>
# Recommended minimum Access Permission configuration:<br>
#<br>
# Deny requests to certain unsafe ports<br>
########http_access deny !Safe_ports<br>
<br>
# Deny CONNECT to other than secure SSL ports<br>
###########http_access deny CONNECT !SSL_ports<br>
<br>
# Only allow cachemgr access from localhost<br>
###############http_access allow localhost manager<br>
<br>
###############http_access deny manager<br>
<br>
# We strongly recommend the following be uncommented to protect
innocent<br>
# web applications running on the proxy server who think the only<br>
# one who can access services on "localhost" is a local user<br>
############http_access deny to_localhost<br>
<br>
#<br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>
#<br>
# Example rule allowing access from your local networks.<br>
# Adapt localnet in the ACL section to list your (internal) IP
networks<br>
# from where browsing should be allowed<br>
<br>
http_access allow localnet<br>
http_access allow localhost<br>
<br>
# And finally deny all other access to this proxy<br>
#http_access deny all<br>
http_access allow all<br>
<br>
# Squid normally listens to port 3128<br>
http_port 3128 <br>
http_port 3129 intercept<br>
<br>
always_direct allow all<br>
<br>
# Uncomment and adjust the following to add a disk cache directory.<br>
cache_dir ufs /usr/share/squid/cache 100 32 512<br>
<br>
# Leave coredumps in the first cache dir<br>
coredump_dir /var/log/squid/cache/squid<br>
<br>
#<br>
# Add any of your own refresh_pattern entries above these.<br>
#<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
<br>
==================================================================================<br>
<pre class="moz-signature" cols="72"><big>And I have configured my browser to use HTTP Proxy 66.159.47.22 Port 3129</big>
<big>I also setup iptables on my machine as follows and that didn't work either. Same permission
denied.</big>
<big>/sbin/iptables -t nat -A OUTPUT -p tcp -s 66.159.32.31 --dport 80 -j DNAT --to 66.159.47.22:3129
Let me know if further info is needed. Any help would be greatly appreciated.
</big>
--
Regards,
Frank Torontour
Network Administrator
<a class="moz-txt-link-abbreviated" href="mailto:frank@cronomagic.com">frank@cronomagic.com</a>
514-341-1579 EXT-214
1-800-427-6012 Ext-214</pre>
</body>
</html>