<div dir="ltr">Bruno,<div><br></div><div>Yes, there is; This was also my first guess, but according to similar questions in forums and such, access.log lists such cases as TCP_DENIED/403 rather than TCP_MISS/403.</div><div><br></div><div>I've also tried removing the ACL entry after your message, and indeed the message changes to TCP_DENIED/403. So it's unlikely for it to be an ACL related issue.</div><div><br></div><div>Ty.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-07-20 17:08 GMT-03:00 Bruno de Paula Larini <span dir="ltr"><<a href="mailto:bruno.larini@riosoft.com.br" target="_blank">bruno.larini@riosoft.com.br</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Just a basic question: is there an ACL allowing your hosts in
squid.conf? Squid will promptly answer with a 403 error otherwise.<div><div class="h5"><br>
<br>
<br>
Em 20/07/2016 16:42, Guilherme Scaglia escreveu:<br>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div class="gmail_quote">
<div dir="ltr">Hi.
<div>
<div><br>
</div>
<div>I've being trying to setup a local squid server on my
home LAN to cache HTTP (not HTTPS) pages. I want to
avoid any client configuration, so I'm aiming for a
transparent proxy - with squid in intercept mode.<br>
</div>
<div><br>
</div>
<div>In my network setup, the squid server is inside the
LAN together with its clients, and not siting between
the clients and the router/modem like all guides assume.
Furthermore, requests originating from the same machine
where squid is running should be cached as well.</div>
<div><br>
</div>
<div>I've setup squid inside a docker container, on a
fedora 24 image. The squid version is 3.5.19. On
squid.conf I've added a new http_port line, for port
8080 with the intercept flag:</div>
<div>http_port 8080 intercept</div>
<div><br>
</div>
<div>My router is a Mikrotik router board, so it's trivial
to setup a DNAT rule to redirect all TCP requests to the
squid server. To avoid forward loops, I've marked all
packets originating from squid with DSCP 4 using
iptables rules, and excluded those from the DNAT rule on
the router. I've tested this by running wget requests
from inside the docker container, and those went by
without any redirection.</div>
</div>
<div><br>
</div>
<div>Now comes the problem:</div>
<div>When any of the redirected requests reach squid, squid
will reply instantly with TCP_MISS/403. Since all traffic
from the squid machine is marked with a specific DSCP,
it's also easy to see squid made no requests to the
outside world before giving that reply. Running tcpdump on
the host machine shows no other packets are being sent
other than the 403 reply.</div>
<div><br>
</div>
<div>What's happening? why doesn't squid tries to fetch the
request pages at all?<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>From my understanding, my setup is roughly equivalent
to <a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat" target="_blank">http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat</a>,
only the DNAT is happening outside the squid box; There is
no reason this should interfere with anything.</div>
<div><br>
</div>
<div><a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute" target="_blank">http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute</a>
seens to recommend routing without DNAT; This seems weird,
as the only way I can see this working is if the squid
machine accepted packets to any address as their own.</div>
<div><br>
</div>
<div><br>
</div>
<div>TL;DR:</div>
<div>When running squid in intercept mode, inside a docker
container, routing traffic to it through dst-nat rules on
a external router, squid will reply with '403 forbidden'
to all requests. Access.log lists TCP_MISS/403, but
tcpdump indicates that squid is never trying to query the
requested page at all.<br>
</div>
</div>
</div>
<br>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><pre>_______________________________________________
squid-users mailing list
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
</div>
<br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><br></div>