<div dir="ltr"><div><div><div>Hi Amos,<br><br></div>Thanks for the assist. So basically from my end, the squid proxy which I am responsible for, I shouldn't concentrate on changing any of it's configuration, but instead tell them to try to solve on their end?<br></div>If yes, what are we looking at, their router setup?<br><br></div>Thanks <br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 6, 2015 at 11:26 PM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 6/03/2015 1:19 a.m., Monah Baki wrote:<br>
> Hi all, can anyone verify if this is correct, need to make ure that users<br>
> will be able to access the internet via the squid.<br>
><br>
> Running FreeBSD with a single interface with Squid-3.5.2<br>
><br>
> Policy based routing on Cisco with the following:<br>
><br>
><br>
> interface GigabitEthernet0/0/1.1<br>
><br>
> encapsulation dot1Q 1 native<br>
><br>
> ip address 10.0.0.9 255.255.255.0<br>
><br>
> no ip redirects<br>
><br>
> no ip unreachables<br>
><br>
> ip nat inside<br>
><br>
> standby 1 ip 10.0.0.10<br>
><br>
> standby 1 priority 120<br>
><br>
> standby 1 preempt<br>
><br>
> standby 1 name HSRP<br>
><br>
> ip policy route-map CFLOW<br>
><br>
><br>
><br>
> ip access-list extended REDIRECT<br>
><br>
> deny tcp host 10.0.0.24 any eq www<br>
><br>
> permit tcp host 10.0.0.23 any eq www<br>
><br>
><br>
><br>
> route-map CFLOW permit 10<br>
><br>
> match ip address REDIRECT<br>
> set ip next-hop 10.0.0.24<br>
><br>
> In my /etc/pf.conf<br>
> rdr pass inet proto tcp from <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> to any port 80 -> 10.0.0.24 port<br>
> 3129<br>
><br>
> # block in<br>
> pass in log quick on bge0<br>
> pass out log quick on bge0<br>
> pass out keep state<br>
><br>
> and finally in my squid.conf:<br>
> http_port 3128<br>
> http_port 3129 intercept<br>
><br>
><br>
><br>
> And for testing purposes from the squid server:<br>
> ./squidclient -h 10.0.0.24 -p 3128 <a href="http://www.freebsd.org/" target="_blank">http://www.freebsd.org/</a><br>
><br>
> If I replace -p 3128 with -p 80, I get a access denied, and if I omit the<br>
> -p 3128 completely, I can access the websites.<br>
<br>
</div></div>If you omit the -p entirely squidclient assumes "-p 3128" (the proxy<br>
default listening port), so it works exactly the same as if you had used<br>
-p 3128 explicitly.<br>
<br>
If you use -p 80 you also need to change the pther parameters so they<br>
generate port-80 syntax message:<br>
- the -h with IP or hostname of the remote web server, and<br>
- the URL parameters being a relative URL, and<br>
- the -j parameter with Host: header domain name of the server<br>
...<br>
eg.<br>
squidclient -h <a href="http://www.freebsd.org" target="_blank">www.freebsd.org</a> -j <a href="http://www.freebsd.org" target="_blank">www.freebsd.org</a> -p 80 /<br>
<br>
NP: if your squidclient is too old to support -j, use this instead:<br>
-H 'Host: <a href="http://www.freebsd.org" target="_blank">www.freebsd.org</a>\n'<br>
<br>
** this test should work from the squid box without having gone through<br>
the proxy. Only from the client machine should it work *with* NAT<br>
passing it through the proxy.<br>
<br>
<br>
<br>
Using a proxy syntax message sent directly to the proxy receiving port,<br>
or with the proxy as receiving IP on port 80 (NAT'ed to Squid) is a<br>
guaranted forwarding loop failure.<br>
<br>
<br>
That doesn't fix your clients issue, but hopefully makes it clear that<br>
the above desribed test is broken enough to prevent you identifying when<br>
the client issue is fixed if that happens on some change.<br>
<span class="HOEnZb"><font color="#888888"><br>
Amos<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div></div></blockquote></div><br></div>