<div dir="ltr"><div>How can I confirm, I have access only to the BSD box<br><br></div>Thanks<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 5, 2015 at 11:12 AM, Yuri Voinov <span dir="ltr"><<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
</span>Does 80 port outside BSD-box listens?<br>
<br>
05.03.15 21:25, Monah Baki пишет:<br>
<span class="">> root@ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i pflog0<br>
> tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose<br>
> output suppressed, use -v or -vv for full protocol decode listening<br>
> on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535<br>
> bytes capability mode sandbox enabled 00:00:00.000000 rule<br>
> 0..16777216/0(match): pass in on bge0: 10.0.0.106.5678<br>
>> 255.255.255.255.5678: UDP, length 88<br>
> 00:00:08.342860 rule 0..16777216/0(match): pass in on bge0:<br>
> 10.0.0.14.54264<br>
>> 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options [mss<br>
> 1460,nop,wscale 2,nop,nop,sackOK], length 0<br>
><br>
><br>
><br>
> On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>><br>
> wrote:<br>
><br>
</span><div><div class="h5">> Hm. No.<br>
><br>
> We not checked only OS.<br>
><br>
> Does your BSD really loads PF module?<br>
><br>
> 05.03.15 21:16, Monah Baki пишет:<br>
>>>> Not sure why the client is running old hard/soft ware, could<br>
>>>> it be cause of the hardware? Is FreeBSD an issue, should I<br>
>>>> switch to linux?<br>
>>>><br>
>>>> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov<br>
>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>><br>
>>>> Wow, 7600!<br>
>>>><br>
>>>> But why is so antique iOS?! Current is 15.4<br>
>>>><br>
>>>> 05.03.15 21:09, Monah Baki пишет:<br>
>>>>>>> PORT STATE SERVICE VERSION 23/tcp open telnet Cisco<br>
>>>>>>> IOS telnetd MAC Address: 88:5A:92:63:77:81 (Cisco)<br>
>>>>>>> Device type: router Running: Cisco IOS 12.X OS CPE:<br>
>>>>>>> cpe:/h:cisco:7600_router cpe:/o:cisco:ios:12.2 OS<br>
>>>>>>> details: Cisco 7600 router (IOS 12.2) Network Distance:<br>
>>>>>>> 1 hop TCP Sequence Prediction: Difficulty=258 (Good<br>
>>>>>>> luck!) IP ID Sequence Generation: Randomized Service<br>
>>>>>>> Info: OS: IOS; Device: switch; CPE: cpe:/o:cisco:ios<br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov<br>
>>>>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>><br>
>>>>>>> What is Cisco model and iOS version?<br>
>>>>>>><br>
>>>>>>> 05.03.15 20:25, Monah Baki пишет:<br>
>>>>>>>>>> Yes, correct<br>
>>>>>>>>>><br>
>>>>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri Voinov<br>
>>>>>>>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>>><br>
>>>>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is proxy<br>
>>>>>>>>>> box?<br>
>>>>>>>>>><br>
>>>>>>>>>> 05.03.15 20:15, Monah Baki пишет:<br>
>>>>>>>>>>>>> '--prefix=/cache/squid'<br>
>>>>>>>>>>>>> '--enable-follow-x-forwarded-for'<br>
>>>>>>>>>>>>> '--with-large-files' '--enable-ssl'<br>
>>>>>>>>>>>>> '--disable-ipv6' '--enable-esi'<br>
>>>>>>>>>>>>> '--enable-kill-parent-hack'<br>
>>>>>>>>>>>>> '--enable-snmp' '--with-pthreads'<br>
>>>>>>>>>>>>> '--with-filedescriptors=65535'<br>
>>>>>>>>>>>>> '--enable-cachemgr-hostname=hostname'<br>
>>>>>>>>>>>>> '--enable-storeio=ufs,aufs,diskd,rock'<br>
>>>>>>>>>>>>> '--enable-ipfw-transparent'<br>
>>>>>>>>>>>>> '--enable-pf-transparent'<br>
>>>>>>>>>>>>> '--with-nat-devpf'<br>
>>>>>>>>>>>>> --enable-ltdl-convenience<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri<br>
>>>>>>>>>>>>> Voinov <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> This looking good too.<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> Stupid question:<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> With witch interception option squid<br>
>>>>>>>>>>>>> builed?<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> I.e, squid -v?<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:<br>
>>>>>>>>>>>>>>>> Hi all, can anyone verify if this is<br>
>>>>>>>>>>>>>>>> correct, need to make ure that users<br>
>>>>>>>>>>>>>>>> will be able to access the internet<br>
>>>>>>>>>>>>>>>> via the squid.<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Running FreeBSD with a single<br>
>>>>>>>>>>>>>>>> interface with Squid-3.5.2<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Policy based routing on Cisco with<br>
>>>>>>>>>>>>>>>> the following:<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> interface GigabitEthernet0/0/1.1<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> encapsulation dot1Q 1 native<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> ip address 10.0.0.9 255.255.255.0<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> no ip redirects<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> no ip unreachables<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> ip nat inside<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> standby 1 ip 10.0.0.10<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> standby 1 priority 120<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> standby 1 preempt<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> standby 1 name HSRP<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> ip policy route-map CFLOW<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> ip access-list extended REDIRECT<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> deny tcp host 10.0.0.24 any eq www<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> permit tcp host 10.0.0.23 any eq www<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> route-map CFLOW permit 10<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> match ip address REDIRECT set ip<br>
>>>>>>>>>>>>>>>> next-hop 10.0.0.24<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> In my /etc/pf.conf rdr pass inet<br>
>>>>>>>>>>>>>>>> proto tcp from <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> to any port<br>
>>>>>>>>>>>>>>>> 80 -> 10.0.0.24 port 3129<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> # block in pass in log quick on bge0<br>
>>>>>>>>>>>>>>>> pass out log quick on bge0 pass out<br>
>>>>>>>>>>>>>>>> keep state<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> and finally in my squid.conf:<br>
>>>>>>>>>>>>>>>> http_port 3128 http_port 3129<br>
>>>>>>>>>>>>>>>> intercept<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> And for testing purposes from the<br>
>>>>>>>>>>>>>>>> squid server: ./squidclient -h<br>
>>>>>>>>>>>>>>>> 10.0.0.24 -p 3128<br>
>>>>>>>>>>>>>>>> <a href="http://www.freebsd.org/" target="_blank">http://www.freebsd.org/</a><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> If I replace -p 3128 with -p 80, I<br>
>>>>>>>>>>>>>>>> get a access denied, and if I omit<br>
>>>>>>>>>>>>>>>> the -p 3128 completely, I can access<br>
>>>>>>>>>>>>>>>> the websites.<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> tcpdump with (-p 3128)<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> 13:15:02.681106 IP<br>
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017 ><br>
>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http: Flags [.],<br>
>>>>>>>>>>>>>>>> ack 17377, win 1018, options<br>
>>>>>>>>>>>>>>>> [nop,nop,TS val 985588797 ecr<br>
>>>>>>>>>>>>>>>> 1054387720], length 0 13:15:02.681421<br>
>>>>>>>>>>>>>>>> IP wfe0.ysv.freebsd.org.http ><br>
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq<br>
>>>>>>>>>>>>>>>> 17377:18825, ack 289, win 1040,<br>
>>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720<br>
>>>>>>>>>>>>>>>> ecr 985588501], length 1448<br>
>>>>>>>>>>>>>>>> 13:15:02.681575 IP<br>
>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http ><br>
>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.], seq<br>
>>>>>>>>>>>>>>>> 18825:20273, ack 289, win 1040,<br>
>>>>>>>>>>>>>>>> options [nop,nop,TS val 1054387720<br>
>>>>>>>>>>>>>>>> ecr 985588501], length 1448<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Did I miss anything?<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Thanks Monah<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> _______________________________________________<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
><br>
>>>>>>>>>>>>>>>><br>
squid-users mailing list<br>
>>>>>>>>>>>>>>>> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>>>>>>>>>>>>>>>> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>><br>
>>>>>>>>>>>>>>>><br>
><br>
>>>>>>>>>>>>>>>><br>
_______________________________________________<br>
>>>>>>>>>>>>>> squid-users mailing list<br>
>>>>>>>>>>>>>> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>>>>>>>>>>>>>> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>><br>
>>>>>>><br>
>>>>><br>
>>>><br>
>><br>
><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</div></div>iQEcBAEBAgAGBQJU+ICHAAoJENNXIZxhPexGX9oH/ibNwg5eWJg+hfTfbNmxHNKb<br>
D5b08bvJsbtbP8N5RVZQTnzKvLNOEnoVLHU22Zh9HDSy1OJ4fFyggNLFZPrAb09M<br>
BH8URJSCjlMQudKXC5heZMaOu2V4idO70Cvif8I+pB1DcManxT3jldqYDFOClqjc<br>
AV+NinCwEwxpcLjE1TL/a8MfVPjFw2EcI3P0Ne2IOwz1CwIsiTNcQr2kkX3MZq6b<br>
S/ZbMygeHQvdNqMNxnv4o9ZdW0G/J7+2BCYly9Ks9mwOn7tA9qkueNTMXB/WAYXs<br>
3355SSl69GVSMMJRCiAiXdm9x7flnPgN/kJUVgJ0sfWvhN+ahkbgDHph4qJWP3I=<br>
=5Obg<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br></div>