<div dir="ltr">On 10.0.0.24<br><br>root@ISN-PHC-CACHE:/home/support # netstat -an<br>Active Internet connections (including servers)<br>Proto Recv-Q Send-Q Local Address Foreign Address (state)<br>tcp4 0 52 10.0.0.24.22 96.255.8.226.50911 ESTABLISHED<br>tcp4 0 0 *.3129 *.* LISTEN<br>tcp4 0 0 *.3128 *.* LISTEN<br>tcp4 0 0 *.81 *.* LISTEN<br>tcp6 0 0 *.81 *.* LISTEN<br>tcp4 0 0 *.22 *.* LISTEN<br>tcp6 0 0 *.22 *.* LISTEN<br>tcp6 0 0 ::1.562 ::1.40066 ESTABLISHED<br>tcp6 0 0 ::1.40066 ::1.562 ESTABLISHED<br>tcp6 0 0 *.561 *.* LISTEN<br>tcp6 0 0 *.562 *.* LISTEN<br>tcp4 0 0 *.199 *.* LISTEN<br>tcp4 0 0 *.10000 *.* LISTEN<br>udp4 0 0 *.3401 *.* <br>udp4 0 0 *.34985 *.* <br>udp4 0 0 *.* *.* <br>udp4 0 0 *.161 *.* <br>udp4 0 0 *.162 *.* <br>udp4 0 0 *.10000 *.* <br>udp4 0 0 127.0.0.1.123 *.* <br>udp6 0 0 fe80::1%lo0.123 *.* <br>udp6 0 0 ::1.123 *.* <br>udp4 0 0 10.0.0.24.123 *.* <br>udp6 0 0 *.123 *.* <br>udp4 0 0 *.123 *.* <br>udp4 0 0 *.514 *.* <br>udp6 0 0 *.514 *.* <br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 5, 2015 at 12:12 PM, Yuri Voinov <span dir="ltr"><<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
</span>- From your PC run telnet 10.0.0.24 80. You've seen if TCP socket opens.<br>
<br>
05.03.15 23:10, Monah Baki пишет:<br>
<span class="">> How can I confirm, I have access only to the BSD box<br>
><br>
> Thanks<br>
><br>
> On Thu, Mar 5, 2015 at 11:12 AM, Yuri Voinov <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>><br>
> wrote:<br>
><br>
</span><div><div class="h5">> Does 80 port outside BSD-box listens?<br>
><br>
> 05.03.15 21:25, Monah Baki пишет:<br>
>>>> root@ISN-PHC-CACHE:/cache/squid/bin # tcpdump -n -e -ttt -i<br>
>>>> pflog0 tcpdump: WARNING: pflog0: no IPv4 address assigned<br>
>>>> tcpdump: verbose output suppressed, use -v or -vv for full<br>
>>>> protocol decode listening on pflog0, link-type PFLOG (OpenBSD<br>
>>>> pflog file), capture size 65535 bytes capability mode sandbox<br>
>>>> enabled 00:00:00.000000 rule 0..16777216/0(match): pass in on<br>
>>>> bge0: 10.0.0.106.5678<br>
>>>>> 255.255.255.255.5678: UDP, length 88<br>
>>>> 00:00:08.342860 rule 0..16777216/0(match): pass in on bge0:<br>
>>>> 10.0.0.14.54264<br>
>>>>> 10.0.0.24.22: Flags [S], seq 3823043622, win 8192, options<br>
>>>>> [mss<br>
>>>> 1460,nop,wscale 2,nop,nop,sackOK], length 0<br>
>>>><br>
>>>><br>
>>>><br>
>>>> On Thu, Mar 5, 2015 at 10:20 AM, Yuri Voinov<br>
>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>><br>
>>>> Hm. No.<br>
>>>><br>
>>>> We not checked only OS.<br>
>>>><br>
>>>> Does your BSD really loads PF module?<br>
>>>><br>
>>>> 05.03.15 21:16, Monah Baki пишет:<br>
>>>>>>> Not sure why the client is running old hard/soft ware,<br>
>>>>>>> could it be cause of the hardware? Is FreeBSD an issue,<br>
>>>>>>> should I switch to linux?<br>
>>>>>>><br>
>>>>>>> On Thu, Mar 5, 2015 at 10:14 AM, Yuri Voinov<br>
>>>>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>><br>
>>>>>>> Wow, 7600!<br>
>>>>>>><br>
>>>>>>> But why is so antique iOS?! Current is 15.4<br>
>>>>>>><br>
>>>>>>> 05.03.15 21:09, Monah Baki пишет:<br>
>>>>>>>>>> PORT STATE SERVICE VERSION 23/tcp open telnet<br>
>>>>>>>>>> Cisco IOS telnetd MAC Address: 88:5A:92:63:77:81<br>
>>>>>>>>>> (Cisco) Device type: router Running: Cisco IOS<br>
>>>>>>>>>> 12.X OS CPE: cpe:/h:cisco:7600_router<br>
>>>>>>>>>> cpe:/o:cisco:ios:12.2 OS details: Cisco 7600<br>
>>>>>>>>>> router (IOS 12.2) Network Distance: 1 hop TCP<br>
>>>>>>>>>> Sequence Prediction: Difficulty=258 (Good luck!)<br>
>>>>>>>>>> IP ID Sequence Generation: Randomized Service<br>
>>>>>>>>>> Info: OS: IOS; Device: switch; CPE:<br>
>>>>>>>>>> cpe:/o:cisco:ios<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> On Thu, Mar 5, 2015 at 9:31 AM, Yuri Voinov<br>
>>>>>>>>>> <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>>><br>
>>>>>>>>>> What is Cisco model and iOS version?<br>
>>>>>>>>>><br>
>>>>>>>>>> 05.03.15 20:25, Monah Baki пишет:<br>
>>>>>>>>>>>>> Yes, correct<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:23 AM, Yuri<br>
>>>>>>>>>>>>> Voinov <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> 10.0.0.23 is your host? And 10.0.0.24 is<br>
>>>>>>>>>>>>> proxy box?<br>
>>>>>>>>>>>>><br>
>>>>>>>>>>>>> 05.03.15 20:15, Monah Baki пишет:<br>
>>>>>>>>>>>>>>>> '--prefix=/cache/squid'<br>
>>>>>>>>>>>>>>>> '--enable-follow-x-forwarded-for'<br>
>>>>>>>>>>>>>>>> '--with-large-files' '--enable-ssl'<br>
>>>>>>>>>>>>>>>> '--disable-ipv6' '--enable-esi'<br>
>>>>>>>>>>>>>>>> '--enable-kill-parent-hack'<br>
>>>>>>>>>>>>>>>> '--enable-snmp' '--with-pthreads'<br>
>>>>>>>>>>>>>>>> '--with-filedescriptors=65535'<br>
>>>>>>>>>>>>>>>> '--enable-cachemgr-hostname=hostname'<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
'--enable-storeio=ufs,aufs,diskd,rock'<br>
>>>>>>>>>>>>>>>> '--enable-ipfw-transparent'<br>
>>>>>>>>>>>>>>>> '--enable-pf-transparent'<br>
>>>>>>>>>>>>>>>> '--with-nat-devpf'<br>
>>>>>>>>>>>>>>>> --enable-ltdl-convenience<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> On Thu, Mar 5, 2015 at 9:14 AM, Yuri<br>
>>>>>>>>>>>>>>>> Voinov <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> This looking good too.<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> Stupid question:<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> With witch interception option squid<br>
>>>>>>>>>>>>>>>> builed?<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> I.e, squid -v?<br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>> 05.03.15 18:19, Monah Baki пишет:<br>
>>>>>>>>>>>>>>>>>>> Hi all, can anyone verify if<br>
>>>>>>>>>>>>>>>>>>> this is correct, need to make<br>
>>>>>>>>>>>>>>>>>>> ure that users will be able to<br>
>>>>>>>>>>>>>>>>>>> access the internet via the<br>
>>>>>>>>>>>>>>>>>>> squid.<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> Running FreeBSD with a single<br>
>>>>>>>>>>>>>>>>>>> interface with Squid-3.5.2<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> Policy based routing on Cisco<br>
>>>>>>>>>>>>>>>>>>> with the following:<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> interface<br>
>>>>>>>>>>>>>>>>>>> GigabitEthernet0/0/1.1<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> encapsulation dot1Q 1 native<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> ip address 10.0.0.9<br>
>>>>>>>>>>>>>>>>>>> 255.255.255.0<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> no ip redirects<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> no ip unreachables<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> ip nat inside<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> standby 1 ip 10.0.0.10<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> standby 1 priority 120<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> standby 1 preempt<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> standby 1 name HSRP<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> ip policy route-map CFLOW<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> ip access-list extended<br>
>>>>>>>>>>>>>>>>>>> REDIRECT<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> deny tcp host 10.0.0.24 any<br>
>>>>>>>>>>>>>>>>>>> eq www<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> permit tcp host 10.0.0.23 any<br>
>>>>>>>>>>>>>>>>>>> eq www<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> route-map CFLOW permit 10<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> match ip address REDIRECT set<br>
>>>>>>>>>>>>>>>>>>> ip next-hop 10.0.0.24<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> In my /etc/pf.conf rdr pass<br>
>>>>>>>>>>>>>>>>>>> inet proto tcp from <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a><br>
>>>>>>>>>>>>>>>>>>> to any port 80 -> 10.0.0.24<br>
>>>>>>>>>>>>>>>>>>> port 3129<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> # block in pass in log quick on<br>
>>>>>>>>>>>>>>>>>>> bge0 pass out log quick on bge0<br>
>>>>>>>>>>>>>>>>>>> pass out keep state<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> and finally in my squid.conf:<br>
>>>>>>>>>>>>>>>>>>> http_port 3128 http_port 3129<br>
>>>>>>>>>>>>>>>>>>> intercept<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> And for testing purposes from<br>
>>>>>>>>>>>>>>>>>>> the squid server: ./squidclient<br>
>>>>>>>>>>>>>>>>>>> -h 10.0.0.24 -p 3128<br>
>>>>>>>>>>>>>>>>>>> <a href="http://www.freebsd.org/" target="_blank">http://www.freebsd.org/</a><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> If I replace -p 3128 with -p<br>
>>>>>>>>>>>>>>>>>>> 80, I get a access denied, and<br>
>>>>>>>>>>>>>>>>>>> if I omit the -p 3128<br>
>>>>>>>>>>>>>>>>>>> completely, I can access the<br>
>>>>>>>>>>>>>>>>>>> websites.<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> tcpdump with (-p 3128)<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> 13:15:02.681106 IP<br>
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017 ><br>
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http:<br>
>>>>>>>>>>>>>>>>>>> Flags [.], ack 17377, win 1018,<br>
>>>>>>>>>>>>>>>>>>> options [nop,nop,TS val<br>
>>>>>>>>>>>>>>>>>>> 985588797 ecr 1054387720],<br>
>>>>>>>>>>>>>>>>>>> length 0 13:15:02.681421 IP<br>
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http ><br>
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.],<br>
>>>>>>>>>>>>>>>>>>> seq 17377:18825, ack 289, win<br>
>>>>>>>>>>>>>>>>>>> 1040, options [nop,nop,TS val<br>
>>>>>>>>>>>>>>>>>>> 1054387720 ecr 985588501],<br>
>>>>>>>>>>>>>>>>>>> length 1448 13:15:02.681575 IP<br>
>>>>>>>>>>>>>>>>>>> wfe0.ysv.freebsd.org.http ><br>
>>>>>>>>>>>>>>>>>>> ISN-PHC-CACHE.44017: Flags [.],<br>
>>>>>>>>>>>>>>>>>>> seq 18825:20273, ack 289, win<br>
>>>>>>>>>>>>>>>>>>> 1040, options [nop,nop,TS val<br>
>>>>>>>>>>>>>>>>>>> 1054387720 ecr 985588501],<br>
>>>>>>>>>>>>>>>>>>> length 1448<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> Did I miss anything?<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> Thanks Monah<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>> _______________________________________________<br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>><br>
>>>>>>>>>>>>>>>>>>><br>
><br>
>>>>>>>>>>>>>>>>>>><br>
squid-users mailing list<br>
>>>>>>>>>>>>>>>>>>> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>>>>><br>
>>>>>>>>>>>>>>>>>>><br>
>>>><br>
>>>>>>>>>>>>>>>>>>><br>
> _______________________________________________<br>
>>>>>>>>>>>>>>>>> squid-users mailing list<br>
>>>>>>>>>>>>>>>>> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
>>>>>>>>>>>>>>>>> <a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
>>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>>>><br>
>>>>>>>>>>>>>><br>
>>>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>><br>
>>>>>>><br>
>>>>><br>
>>>><br>
>><br>
><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</div></div>iQEcBAEBAgAGBQJU+I5pAAoJENNXIZxhPexG68cIAIjP0CaVSgjlexyNc4xATrws<br>
SGS2hfPSOwPNJ32YVL43OJKtGLAMlumeo2oxJyZjdUFKftT5g7h8ldRKY3tPcV1m<br>
lYo+lbS4FOA0MspbK9oGP+xiZhvB8jnxmLxM13+Rnmf1309rYhhIyL7y7yih02i/<br>
KIulMyYwjZC8BvsCHRAjhxIiMQ0AJEO17hzs/6OCIkIjYNiswl9D8MbH0KOuKJMy<br>
4BpYMpYnzDjfJAehwD7n1xnta3GvLhHbUL7fcYO9hvCX1mzZW/06nFpKQL/5pF06<br>
CVmtTAtg85JlFESBlA9JHbDOV3AGn0bOC5KFtIqX3osFz46Ac+HqOV8P0kXm85k=<br>
=eSQL<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br></div>