<div dir="ltr">#<br># Recommended minimum configuration:<br>#<br><br># Example rule allowing access from your local networks.<br># Adapt to list your (internal) IP networks from where browsing<br># should be allowed<br>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network<br>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network<br>acl localnet src fc00::/7 # RFC 4193 local private network range<br>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br><br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br>acl CONNECT method CONNECT<br><br>#<br># Recommended minimum Access Permission configuration:<br>#<br># Deny requests to certain unsafe ports<br>http_access deny !Safe_ports<br><br># Deny CONNECT to other than secure SSL ports<br>http_access deny CONNECT !SSL_ports<br><br># Only allow cachemgr access from localhost<br>http_access allow localhost manager<br>http_access deny manager<br><br># We strongly recommend the following be uncommented to protect innocent<br># web applications running on the proxy server who think the only<br># one who can access services on "localhost" is a local user<br>#http_access deny to_localhost<br><br>#<br># INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>#<br><br># Example rule allowing access from your local networks.<br># Adapt localnet in the ACL section to list your (internal) IP networks<br># from where browsing should be allowed<br>http_access allow localnet<br>http_access allow localhost<br><br># And finally deny all other access to this proxy<br>http_access deny all<br><br># Squid normally listens to port 3128<br>http_port 3128<br>http_port 3129 intercept<br><br># Uncomment and adjust the following to add a disk cache directory.<br>cache_dir ufs /usr/local/squid/var/cache/squid 350000 16 256<br><br><br>#<br># Add any of your own refresh_pattern entries above these.<br>#<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br>half_closed_clients off<br>quick_abort_min 0 KB<br>quick_abort_max 0 KB<br>vary_ignore_expire on<br>reload_into_ims on<br>memory_pools off<br>cache_mem 4096 MB<br>visible_hostname isn-phc-cache<br>minimum_object_size 0 bytes<br>maximum_object_size 512 MB<br>maximum_object_size 512 KB<br>ipcache_size 1024<br>ipcache_low 90<br>ipcache_high 95<br>cache_swap_low 98<br>cache_swap_high 100<br>fqdncache_size 16384<br>retry_on_error on<br>offline_mode off<br>logfile_rotate 10<br>dns_nameservers 8.8.8.8 41.78.211.30<br><br><div class="gmail_extra"><br><br><br></div><div class="gmail_extra">access.log:<br><br>1426267535.210 198 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.211 198 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.211 198 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.223 301 10.0.0.23 TCP_MISS/200 222 GET <a href="http://rma-api.gravity.com/v1/beacons/log">http://rma-api.gravity.com/v1/beacons/log</a>? - ORIGINAL_DST/<a href="http://80.239.148.18">80.239.148.18</a> text/html<br>1426267535.244 195 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.333 423 10.0.0.23 TCP_MISS/200 1420 GET <a href="http://hpr.outbrain.com/utils/get">http://hpr.outbrain.com/utils/get</a>? - ORIGINAL_DST/<a href="http://50.31.185.42">50.31.185.42</a> text/x-json<br>1426267535.345 412 10.0.0.23 TCP_MISS/200 11179 GET <a href="http://p.visualrevenue.com/">http://p.visualrevenue.com/</a>? - ORIGINAL_DST/<a href="http://50.31.185.40">50.31.185.40</a> text/javascript<br>1426267535.346 411 10.0.0.23 TCP_MISS/200 423 GET <a href="http://t1.visualrevenue.com/">http://t1.visualrevenue.com/</a>? - ORIGINAL_DST/<a href="http://64.74.232.44">64.74.232.44</a> image/gif<br>1426267535.363 128 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 327 GET <a href="http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/js/vendor/jquery.ba-bbq.js">http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/js/vendor/jquery.ba-bbq.js</a> - ORIGINAL_DST/<a href="http://80.239.152.153">80.239.152.153</a> application/x-javascript<br>1426267535.381 193 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.406 189 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.408 190 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.408 191 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.418 200 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.437 188 10.0.0.23 TCP_MISS/200 431 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.464 128 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 327 GET <a href="http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/1.3.4/js/player/CNNAPIVideoPlayer.js">http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/1.3.4/js/player/CNNAPIVideoPlayer.js</a> - ORIGINAL_DST/<a href="http://80.239.152.153">80.239.152.153</a> application/x-javascript<br>1426267535.494 128 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 327 GET <a href="http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/1.3.4/js/legacy/CNNVideoPlayer.js">http://z.cdn.turner.com/cnn/.element/widget/video/videoapi/api/1.3.4/js/legacy/CNNVideoPlayer.js</a> - ORIGINAL_DST/<a href="http://80.239.152.153">80.239.152.153</a> application/x-javascript<br>1426267535.604 217 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.609 256 10.0.0.23 TCP_REFRESH_UNMODIFIED/200 41017 GET <a href="http://cdn.gigya.com/js/gigya.js">http://cdn.gigya.com/js/gigya.js</a>? - ORIGINAL_DST/<a href="http://80.239.148.17">80.239.148.17</a> text/javascript<br>1426267535.619 206 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.622 208 10.0.0.23 TCP_MISS/200 412 GET <a href="http://jadserve.postrelease.com/trk.gif">http://jadserve.postrelease.com/trk.gif</a>? - ORIGINAL_DST/<a href="http://54.225.133.227">54.225.133.227</a> image/gif<br>1426267535.696 129 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 312 GET <a href="http://z.cdn.turner.com/cnn/.element/img/3.0/video/cnn_embedDefault.png">http://z.cdn.turner.com/cnn/.element/img/3.0/video/cnn_embedDefault.png</a> - ORIGINAL_DST/<a href="http://80.239.152.153">80.239.152.153</a> image/png<br>1426267536.071 656 10.0.0.23 TCP_MISS/302 849 GET <a href="http://metrics.cnn.com/b/ss/cnn-adbp-domestic/1/H.26.1/s11300422861240">http://metrics.cnn.com/b/ss/cnn-adbp-domestic/1/H.26.1/s11300422861240</a>? - ORIGINAL_DST/<a href="http://66.235.141.144">66.235.141.144</a> text/plain<br>1426267536.075 257 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 348 GET <a href="http://cdn.gigya.com/js/gigya.services.plugins.base.min.js">http://cdn.gigya.com/js/gigya.services.plugins.base.min.js</a>? - ORIGINAL_DST/<a href="http://80.239.148.17">80.239.148.17</a> text/javascript<br>1426267536.203 128 10.0.0.23 TCP_MISS/200 381 GET <a href="http://b.scorecardresearch.com/r">http://b.scorecardresearch.com/r</a>? - ORIGINAL_DST/<a href="http://80.239.148.16">80.239.148.16</a> image/gif<br>1426267536.570 393 10.0.0.23 TCP_MISS/304 338 GET <a href="http://cdn3.gigya.com/js/gigya.services.socialize.plugins.simpleshare.min.js">http://cdn3.gigya.com/js/gigya.services.socialize.plugins.simpleshare.min.js</a> - ORIGINAL_DST/<a href="http://80.239.148.32">80.239.148.32</a> text/javascript<br>1426267536.746 125 10.0.0.23 TCP_MISS/304 340 GET <a href="http://static.chartbeat.com/js/chartbeat.js">http://static.chartbeat.com/js/chartbeat.js</a> - ORIGINAL_DST/<a href="http://23.67.1.243">23.67.1.243</a> application/x-javascript<br>1426267536.819 199 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 233 GET <a href="http://data.cnn.com/jsonp/video/nowPlayingSchedule.json">http://data.cnn.com/jsonp/video/nowPlayingSchedule.json</a>? - ORIGINAL_DST/<a href="http://157.166.238.237">157.166.238.237</a> -<br>1426267536.942 260 10.0.0.23 TCP_MISS/200 677 GET <a href="http://beacon.krxd.net/optout_check">http://beacon.krxd.net/optout_check</a>? - ORIGINAL_DST/<a href="http://176.34.190.30">176.34.190.30</a> text/javascript<br>1426267537.027 236 10.0.0.23 TCP_MISS/200 758 GET <a href="http://t.co/i/adsct">http://t.co/i/adsct</a>? - ORIGINAL_DST/<a href="http://199.16.156.11">199.16.156.11</a> image/gif<br>1426267537.146 362 10.0.0.23 TCP_MISS/200 758 GET <a href="http://t.co/i/adsct">http://t.co/i/adsct</a>? - ORIGINAL_DST/<a href="http://199.16.156.11">199.16.156.11</a> image/gif<br>1426267537.171 388 10.0.0.23 TCP_MISS/200 758 GET <a href="http://t.co/i/adsct">http://t.co/i/adsct</a>? - ORIGINAL_DST/<a href="http://199.16.156.11">199.16.156.11</a> image/gif<br>1426267537.230 432 10.0.0.23 TCP_MISS/302 481 GET <a href="http://apiservices.krxd.net/um">http://apiservices.krxd.net/um</a>? - ORIGINAL_DST/<a href="http://54.243.83.18">54.243.83.18</a> text/html<br>1426267537.603 173 10.0.0.23 TCP_MISS/204 676 GET <a href="http://beacon.krxd.net/pixel.gif">http://beacon.krxd.net/pixel.gif</a>? - ORIGINAL_DST/<a href="http://176.34.190.30">176.34.190.30</a> image/gif<br>1426267537.618 247 10.0.0.23 TCP_MISS/200 322 GET <a href="http://ping.chartbeat.net/ping">http://ping.chartbeat.net/ping</a>? - ORIGINAL_DST/<a href="http://54.235.85.218">54.235.85.218</a> image/gif<br>1426267537.892 388 10.0.0.23 TCP_MISS/200 68649 GET <a href="http://z.cdn.turner.com/xslo/cvp/core/base/0/CVPBase.swf">http://z.cdn.turner.com/xslo/cvp/core/base/0/CVPBase.swf</a>? - ORIGINAL_DST/<a href="http://80.239.152.153">80.239.152.153</a> application/x-shockwave-flash<br>1426267538.024 130 10.0.0.23 TCP_REFRESH_UNMODIFIED/304 329 GET <a href="http://js.moatads.com/turner763610601596/moatad.js">http://js.moatads.com/turner763610601596/moatad.js</a> - ORIGINAL_DST/<a href="http://80.239.148.9">80.239.148.9</a> application/x-javascript<br><br></div><div class="gmail_extra"><div class="gmail_quote">On Fri, Mar 13, 2015 at 12:18 PM, Yuri Voinov <span dir="ltr"><<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
<br>
</span>13.03.15 21:58, Monah Baki пишет:<br>
<span class="">> Hi All,<br>
><br>
> Installed squid on CentOS 6.6 and it's working, but mY access.log<br>
> shows all TCP_MISS and no TCP_HIT. The following config:<br>
><br>
> squid.conf # Squid normally listens to port 3128 http_port 3128<br>
> http_port 3129 intercept<br>
<br>
</span>And that's all????<br>
<div><div class="h5"><br>
><br>
><br>
><br>
> iptables<br>
><br>
> # Generated by iptables-save v1.4.7 on Fri Mar 13 16:04:02 2015<br>
> *nat :PREROUTING ACCEPT [10:2031] :POSTROUTING ACCEPT [0:0] :OUTPUT<br>
> ACCEPT [0:0] -A PREROUTING -s <a href="http://147.245.252.13/32" target="_blank">147.245.252.13/32</a> -p tcp -m tcp<br>
> --dport 80 -j ACCEPT -A PREROUTING -s <a href="http://10.0.0.24/32" target="_blank">10.0.0.24/32</a> -p tcp -m tcp<br>
> --dport 80 -j ACCEPT -A PREROUTING -s <a href="http://147.245.252.13/32" target="_blank">147.245.252.13/32</a> -p tcp -m<br>
> tcp --dport 80 -j ACCEPT -A PREROUTING -p tcp -m tcp --dport 80 -j<br>
> REDIRECT --to-ports 3129 -A POSTROUTING -j MASQUERADE COMMIT #<br>
> Completed on Fri Mar 13 16:04:02 2015 # Generated by iptables-save<br>
> v1.4.7 on Fri Mar 13 16:04:02 2015 *filter :INPUT ACCEPT [0:0]<br>
> :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1818:649971] -A INPUT -m<br>
> state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j<br>
> REJECT --reject-with icmp-port-unreachable -A INPUT -i lo -j<br>
> ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j<br>
> ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 3129 -m state<br>
> --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp<br>
> --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -j<br>
> REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT<br>
> --reject-with icmp-host-prohibited COMMIT # Completed on Fri Mar 13<br>
> 16:04:02 2015 # Generated by iptables-save v1.4.7 on Fri Mar 13<br>
> 16:04:02 2015 *mangle :PREROUTING ACCEPT [68:6199] :INPUT ACCEPT<br>
> [68:6199] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [26:3064]<br>
> :POSTROUTING ACCEPT [26:3064] -A PREROUTING -p tcp -m tcp --dport<br>
> 3129 -j DROP COMMIT # Completed on Fri Mar 13 16:04:02 2015<br>
><br>
><br>
> Accessing sites, shows the IP address of the proxy 147.245.252.13.<br>
><br>
> Am I missing something in IPTables that it is not caching?<br>
><br>
><br>
> Thanks Monah<br>
><br></div></div></blockquote></div><br></div></div>