<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version rmj.rmm.rup.rpr">
<TITLE>RE: [squid-users] Response Blocked from sites with multiple IPs (Host Header Forgery)</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Hey,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">There are couple options to do that.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Since you are using Debian</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> 8 the most used are:</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">- </FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">Bind</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">- </FONT> <FONT FACE="Calibri">Unbound</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">They both have a very simple installation and configuration.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">The first step would be to let squid access the caching service.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">If you can point your clients to this specific DNS host it would be good but if not and you are able to</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">Intercept DNS traffic,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">you can try to see how Interception of all</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">8.8.8.8 and other dns services works.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">You can use the iptables REDIRECT which is similar to what you might use in\for squid.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">The next tutorial is for CentOS but have the needed configuration snippets that would work with any Unbound</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">installation</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">:</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="http://www.tecmint.com/setup-dns-cache-server-in-centos-7/"><SPAN LANG="en-us"><U><FONT COLOR="#0563C1" FACE="Calibri">http://www.tecmint.com/setup-dns-cache-server-in-centos-7/</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">And another one which looks a bit different</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="https://calomel.org/unbound_dns.html"><SPAN LANG="en-us"><U><FONT COLOR="#0563C1" FACE="Calibri">https://calomel.org/unbound_dns.html</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">And another guide for ubnutu on using Bind as a caching dns service:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-caching-or-forwarding-dns-server-on-ubuntu-14-04"><SPAN LANG="en-us"><U><FONT COLOR="#0563C1" FACE="Calibri">https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-caching-or-forwarding-dns-server-on-ubuntu-14-04</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Which should work almost the same for Debian.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">If you need more details let me know.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Eliezer</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL>----</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Eliezer Croitoru</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Linux System Administrator</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Mobile: +972-5-28704261</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Email: eliezer@ngtech.co.il</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-----Original Message-----</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">From: squid-users [<A HREF="mailto:squid-users-bounces@lists.squid-cache.org">mailto:squid-users-bounces@lists.squid-cache.org</A>] On Behalf Of Eng Hooda</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Sent: Saturday, June 11, 2016 7:44 PM</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">To: squid-users@lists.squid-cache.org; Amos Jeffries</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Subject: [squid-users] Response Blocked from sites with multiple IPs (Host Header Forgery)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Thank You for your response.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">What is the best way to setup recursive resolver ?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Best Regards,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Eng Hooda</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL>--------------------------------------------</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">On Fri, 6/10/16, Amos Jeffries <squid3@treenet.co.nz> wrote:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Subject: Re: [squid-users] Response Blocked from sites with multiple IPs (Host Header Forgery)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> To: squid-users@lists.squid-cache.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Date: Friday, June 10, 2016, 12:54 AM</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> On 10/06/2016 6:09 a.m.,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Eng Hooda wrote:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > Hello Squid Users,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > I have just started using squid less than a week ago .</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > My setup is a transparent</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> proxy with sslbump , I peek for media streaming sites then terminate their connections then I splice all.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > I noticed that some https sites (not all of the time) , does not respond , when Investigated I found the following in cache.log :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > 3105 2016/06/09 12:45:40.630 kid1|</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> SECURITY ALERT: on URL: mail.live.com:443 > 3106 2016/06/09 12:45:40.631 kid1| SECURITY ALERT: Host header forgery detected on</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> local=157.55.43.16:443 remote=10.3.1.80:58328 FD 94 flags=33 (local IP does not match any domain IP) ></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> 3330 2016/06/09 13:26:26.676 kid1| SECURITY ALERT: on URL:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> mail.live.com:443</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> > 3331 2016/06/09</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> 13:26:26.676 kid1| SECURITY ALERT: Host header forgery detected on local=157.56.122.210:443 remote=10.3.1.80:58414 FD 141 flags=33 (local IP does not match any domain IP) > 3530 2016/06/09 13:49:49.481 kid1| SECURITY ALERT: on URL: mail.live.com:443 > 3531 2016/06/09 13:49:49.481 kid1| SECURITY ALERT: Host header forgery detected on</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> local=157.55.43.17:443 remote=10.3.1.80:58616 FD 119</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> flags=33 (local IP does not match any domain IP) > > I searched for a solution which lead me to (1st result) : > <A HREF="http://wiki.squid-cache.org/KnowledgeBase/HostHeaderForgery">http://wiki.squid-cache.org/KnowledgeBase/HostHeaderForgery</A></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > I read it and it</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> seems to be a dead end .</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > What I understood that client requested page from a certain IP , reply came from another IP then it's blocked for security reasons.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > Well I tried to</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> nslookup the mentioned IPs , and all of them are sub domains of mail.live.com</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> No, all of</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> them claim to be in their reverse-DNS responses. That is just the IP address owners view of things.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> In the case of an attack its the</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> attackers</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> opinion about what you should believe. Not safe.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Forward-DNS results which</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> provide the domain owners authoritative list of what IPs they are using. Say a different message contradicting those reverse-DNS results ...</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > also tried to nslookup mail.live.com , and every time I get different IPs > </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Exactly. So do Squid and the</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> client. Which means Squid is almost always unable to see the IP the client is contacting as being a valid one for that domain.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > nslookup mail.live.com</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> > Server:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> google-public-dns-a.google.com</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> ></SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Address: 8.8.8.8</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> > </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> It is a problem caused by</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Google DNS.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> The best way to</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> get around it is to setup a recursive resolver on your network that is used by both Squid and clients.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Diverting the client</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> port 53 traffic to it</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> if necessary.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> If you wish</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> to use Google DNS after having that available, then</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> 8.8.8.8</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> should be setup as a parent of that</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> local resolver. Not as something</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Squid or</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> client contact separately.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> That setup makes the google DNS results more often be cached in the shared resolver for long enough that Squid can see it when it does the validation steps.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> NP: there are other causes of this known, related to connection persistence, and SSL-Bump SNI being validated. They are bugs in Squid and still being worked on fixing. So dont expect the above to solve all instances of it.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> Amos</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> </SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL> _______________________________________________</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> squid-users mailing list</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> squid-users@lists.squid-cache.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> <A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="he"><FONT FACE="Arial"><SPAN DIR=RTL>_______________________________________________</SPAN></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">squid-users mailing list</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">squid-users@lists.squid-cache.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"><A HREF="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>