<div dir="ltr">Actually, now that I am using 3.15 it seems I get the error for port 80 -> 3128 intercepts again <div><br></div><div>
<p class=""><span class="">TCP_MISS/503 4274 GET <a href="http://www.whereIwantToVisit.net/">http://www.whereIwantToVisit.net/</a> - ORIGINAL_DST/<a href="http://162.220.244.7">162.220.244.7</a> text/html</span></p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 4, 2016 at 10:35 AM, Ali Jawad <span dir="ltr"><<a href="mailto:alijawad1@gmail.com" target="_blank">alijawad1@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Amos<div><br><div>Thanks for your input, I did recompile </div><div><br></div><div>See :</div><div>
<p><span>Squid Cache: Version 3.5.15-20160302-r14000</span></p>
<p><span>Service Name: squid</span></p>
<p><span>configure options: '--prefix=/squid' '--includedir=/squid/usr/include' '--enable-ssl-crtd' '--datadir=/squid/usr/share' '--bindir=/squid/usr/sbin' '--libexecdir=/squid/usr/lib/squid' '--localstatedir=/squid/var' '--sysconfdir=/squid/etc/squid' '--enable-arp-acl' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,NCSA,PAM,RADIUS,SASL,SMB,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,session,unix_group,wbinfo_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-referer-log' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl' '--enable-storeio=aufs,diskd,ufs' '--enable-useragent-log' '--enable-wccpv2' '--enable-esi' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=64000' '--with-dl' '--with-openssl' '--with-pthreads' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fpie' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig' '--enable-ltdl-convenience' '--disable-ipv6'</span></p><p><span><br></span></p><p>Yes the IP in question is my squid IP, I am still getting the same error, it is as if squid sends traffic to itself </p><p>Only difference is that I see this in access log now </p><p>
</p><p><span>1457080684.426 0 84.208.223.203 TAG_NONE/200 0 CONNECT 162.220.xx.xx:443 - ORIGINAL_DST/162.220.xx.xx -</span></p><p>Not sure if this means anything .</p><p><br></p><p>Regards</p></div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 4, 2016 at 6:39 AM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 4/03/2016 11:57 a.m., Ali Jawad wrote:<br>
> Hi<br>
> I am using Squid<br>
><br>
> [root@kgoDcyTx9 squid]# /squid/sbin/squid -v<br>
><br>
> Squid Cache: Version 3.4.9<br>
<br>
<br>
</span>When using SSL-Bump functionality first port of call is to ensure you<br>
are using the latest release.<br>
<br>
Today that is 3.5.15 (though I recommend the snapshot tarball instead of<br>
the main one). Or 4.0.7 beta.<br>
<span><br>
<br>
><br>
> Config Options<br>
><br>
><br>
> https_port 3129 intercept ssl-bump generate-host-certificates=on<br>
> dynamic_cert_mem_cache_size=4MB cert=/squid/etc/squid/ssl_cert/myca.pem<br>
> key=/squid/etc/squid/ssl_cert/myca.pem<br>
><br>
><br>
</span><snip outdated settings><br>
<span><br>
><br>
> Iptables Rule<br>
><br>
> iptables -t nat -A PREROUTING -p tcp --dport 443 --destination<br>
> 162.220.xx.xx -j REDIRECT --to-ports 3129<br>
><br>
<br>
</span>So what happens to the Squid traffic going to port 443 ?<br>
<span><br>
><br>
> The problem :<br>
><br>
> There are no certificate errors in the cache log and access log appears to<br>
> log the requested URL, the problem is that Squid shows the error below,<br>
> from the looks of it Squid is trying to send the request to itself on its<br>
> own IP, my assumption is that Squid is not able to detect the proper<br>
> destination during bump "through a config fault of my own" or a missing<br>
<br>
</span>The machine NAT system tells Squid what the destination is supposed to be.<br>
<span><br>
> step. Please advice :<br>
><br>
> The following error was encountered while trying to retrieve the URL:<br>
> ://162.220.xx.xx:443<br>
</span>> <<a href="https://ipv6_1.lagg0.c052.lhr004.ix.nflxvideo.net/://162.220.244.7:443" rel="noreferrer" target="_blank">https://ipv6_1.lagg0.c052.lhr004.ix.nflxvideo.net/://162.220.244.7:443</a>><br>
><br>
> *Connection to 162.220.244.7 failed.*<br>
><br>
<br>
Is "162.220.244.7" your Squid IP?<br>
<br>
<br>
Amos<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>