<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
I kept on adding, now the log is showing an ip and domain that are already in the bypass pool.
<div class=""><br class="">
</div>
<div class="">when I manually define internal and external servers to <a href="http://sipdir.online.lync.com" class="">
sipdir.online.lync.com</a>:443</div>
<div class=""><a href="http://1481069419.028/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069419.028</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
338 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TCP_CLIENT_REFRESH_MISS/200 1067 GET </span><a href="http://lyncdiscover.solcv.com/?" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">http://lyncdiscover.solcv.com/?</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://132.245.1.28/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">132.245.1.28</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
application/</span><a href="http://vnd.microsoft.rtc.autodiscover+xml/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">vnd.microsoft.rtc.autodiscover+xml</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
</span><a href="http://1481069419.276/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069419.276</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
588 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://132.245.1.28:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">132.245.1.28:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- HIER_NONE/- - </span><a href="http://1481069419.276/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069419.276</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
587 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TCP_TUNNEL/200 5568 CONNECT </span><a href="http://lyncdiscover.solcv.com:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">lyncdiscover.solcv.com:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://132.245.1.28/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">132.245.1.28</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- </span><a href="http://1481069434.817/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069434.817</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
428 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://131.253.61.100:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">131.253.61.100:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://131.253.61.100/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">131.253.61.100</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- </span><a href="http://1481069435.779/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069435.779</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
665 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://65.55.44.108:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">65.55.44.108:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://65.55.44.108/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">65.55.44.108</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- </span><a href="http://1481069436.062/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069436.062</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
258 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://65.55.44.108:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">65.55.44.108:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://65.55.44.108/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">65.55.44.108</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
-</span></div>
<div class=""><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class=""><br class="">
</span></div>
<div class=""><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class=""><br class="">
</span></div>
<div class=""><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">ANOTHER
attempt:</span></div>
<div class=""><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class=""><br class="">
</span></div>
<div class=""><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class=""><a href="http://1481069703.652/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">1481069703.652</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
450 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://143.127.102.40:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
- ORIGINAL_DST/</span><a href="http://143.127.102.40/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
- </span><a href="http://1481069704.115/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">1481069704.115</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
443 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://143.127.102.40:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
- ORIGINAL_DST/</span><a href="http://143.127.102.40/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
- </span><a href="http://1481069704.581/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">1481069704.581</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
447 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://143.127.102.40:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
- ORIGINAL_DST/</span><a href="http://143.127.102.40/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-variant-ligatures: normal;" class="">143.127.102.40</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; font-variant-ligatures: normal;" class="">
-</span></span></div>
<div class=""></div>
<div class=""><br class="">
</div>
<div class="">Then, when it is automatic:</div>
<div class=""><br class="">
</div>
<div class=""><a href="http://1481069176.180/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069176.180</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
365 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TCP_MISS/200 1068 GET </span><a href="http://lyncdiscover.solcv.com/?" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">http://lyncdiscover.solcv.com/?</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://52.112.65.206/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">52.112.65.206</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
application/</span><a href="http://vnd.microsoft.rtc.autodiscover+xml/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">vnd.microsoft.rtc.autodiscover+xml</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
</span><a href="http://1481069176.792/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069176.792</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
976 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TAG_NONE/200 0 CONNECT </span><a href="http://52.112.65.206:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">52.112.65.206:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- HIER_NONE/- - </span><a href="http://1481069176.792/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">1481069176.792</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
975 </span><a href="http://10.0.0.38/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">10.0.0.38</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
TCP_TUNNEL/200 7060 CONNECT </span><a href="http://lyncdiscover.solcv.com:443/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">lyncdiscover.solcv.com:443</a><span style="margin: 0px; padding: 0px; box-sizing: inherit; outline: none; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">
- ORIGINAL_DST/</span><a href="http://52.112.65.206/" target="_blank" style="margin: 6px 0px; padding: 0px; box-sizing: inherit; outline: none; cursor: pointer; color: rgb(35, 42, 42); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(236, 240, 240);" class="">52.112.65.206</a></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class=""><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
This is surely harder than it should be. </div>
<div class=""><br class="">
</div>
<div class="">Amos mentioned something about squid 4 handling this better? should I try squid 4? how would the ssl_bumping be any different?</div>
<div class=""><br class="">
</div>
<div class="">Again, thank you for your help!<br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><img height="38" width="45" apple-inline="yes" id="2F870A53-4373-4842-AC7B-B5BCABDEAD05" apple-width="yes" apple-height="yes" src="cid:2FD1C3AB-E45C-49F0-84AB-0F8AC658BD11@routerb408e2.com" class=""></span><em style="font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; color: rgb(0, 128, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);" class=""><strong class="">Piensa
en el medio ambiente antes de imprimir este email.</strong></em> </span></div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 6, 2016, at 6:31 PM, Eliezer Croitoru <<a href="mailto:eliezer@ngtech.co.il" class="">eliezer@ngtech.co.il</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">You should try to think about adding more ip addresses\cirds and domains<br class="">
such as that are in the logs.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
<a href="http://ngtech.co.il/lmgtfy/" class="">http://ngtech.co.il/lmgtfy/</a><br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: eliezer@ngtech.co.il<br class="">
<br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Wednesday, December 7, 2016 12:36 AM<br class="">
To: Eliezer Croitoru <eliezer@ngtech.co.il><br class="">
Cc: 'Amos Jeffries' <squid3@treenet.co.nz>;<br class="">
squid-users@lists.squid-cache.org<br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid<br class="">
(TProxy) HTTP/S<br class="">
<br class="">
<br class="">
Hello Eliezer and thanks again.<br class="">
<br class="">
I ran the script with the tproxy argument.<br class="">
<br class="">
Tried to reconnect skype for business... <br class="">
<br class="">
After about a 3 min wait, a pop up saying "Skype for Business couldn't find<br class="">
a skype for business server" and access log shows: <br class="">
<br class="">
1481061269.006 400 10.0.0.38 TCP_MISS/200 1068 GET<br class="">
http://lyncdiscover.solcv.com/? - ORIGINAL_DST/132.245.1.28<br class="">
application/vnd.microsoft.rtc.autodiscover+xml<br class="">
1481061269.270 667 10.0.0.38 TAG_NONE/200 0 CONNECT 132.245.1.28:443 -<br class="">
HIER_NONE/- -<br class="">
1481061269.270 665 10.0.0.38 TCP_TUNNEL/200 5568 CONNECT<br class="">
lyncdiscover.solcv.com:443 - ORIGINAL_DST/132.245.1.28 -<br class="">
1481061269.770 596 10.0.0.38 TAG_NONE/200 0 CONNECT 52.112.64.14:443 -<br class="">
HIER_NONE/- -<br class="">
1481061269.770 594 10.0.0.38 TCP_TUNNEL/200 6981 CONNECT<br class="">
webdir0a.online.lync.com:443 - ORIGINAL_DST/52.112.64.14 -<br class="">
1481061270.679 897 10.0.0.38 TAG_NONE/200 0 CONNECT 52.112.64.14:443 -<br class="">
HIER_NONE/- -<br class="">
1481061270.679 895 10.0.0.38 TCP_TUNNEL/200 7733 CONNECT<br class="">
webdir0a.online.lync.com:443 - ORIGINAL_DST/52.112.64.14 -<br class="">
1481061272.178 841 10.0.0.38 TAG_NONE/200 0 CONNECT 23.100.120.65:443 -<br class="">
HIER_NONE/- -<br class="">
1481061272.178 840 10.0.0.38 TCP_TUNNEL/200 20539 CONNECT<br class="">
login.microsoftonline.com:443 - ORIGINAL_DST/23.100.120.65 -<br class="">
1481061273.713 641 10.0.0.38 TAG_NONE/200 0 CONNECT 52.112.64.14:443 -<br class="">
HIER_NONE/- -<br class="">
1481061273.713 640 10.0.0.38 TCP_TUNNEL/200 8037 CONNECT<br class="">
webdir0a.online.lync.com:443 - ORIGINAL_DST/52.112.64.14 -<br class="">
1481061273.751 3054 10.0.0.38 TAG_NONE/200 0 CONNECT 52.112.64.14:443 -<br class="">
HIER_NONE/- -<br class="">
1481061273.751 3052 10.0.0.38 TCP_TUNNEL/200 24458 CONNECT<br class="">
webdir0a.online.lync.com:443 - ORIGINAL_DST/52.112.64.14 -<br class="">
1481061273.751 1544 10.0.0.38 TAG_NONE/200 0 CONNECT 52.112.64.14:443 -<br class="">
HIER_NONE/- -<br class="">
1481061273.751 1543 10.0.0.38 TCP_TUNNEL/200 11653 CONNECT<br class="">
webdir0a.online.lync.com:443 - ORIGINAL_DST/52.112.64.14 -<br class="">
<br class="">
<br class="">
so I added more ip ranges to the cidr-to-bypass.txt and ran the script again<br class="">
<br class="">
<br class="">
1481063243.370 371 10.0.0.38 TCP_MISS/200 1068 GET<br class="">
http://lyncdiscover.solcv.com/? - ORIGINAL_DST/134.170.113.210<br class="">
application/vnd.microsoft.rtc.autodiscover+xml<br class="">
1481063278.271 74233 10.0.0.38 TAG_NONE/200 0 CONNECT 104.208.31.113:443 -<br class="">
HIER_NONE/- -<br class="">
1481063278.271 74231 10.0.0.38 TCP_TUNNEL/200 6746 CONNECT<br class="">
pipe.skype.com:443 - ORIGINAL_DST/104.208.31.113 -<br class="">
1481063344.143 60720 10.0.0.38 TAG_NONE/200 0 CONNECT 104.208.31.113:443 -<br class="">
HIER_NONE/- -<br class="">
1481063344.143 60719 10.0.0.38 TCP_TUNNEL/200 6389 CONNECT<br class="">
pipe.skype.com:443 - ORIGINAL_DST/104.208.31.113 -<br class="">
<br class="">
a new set showed up...<br class="">
<br class="">
what more can we do?<br class="">
<br class="">
keep adding ip ranges?<br class="">
<br class="">
thanks<br class="">
<br class="">
Piensa en el medio ambiente antes de imprimir este email.<br class="">
________________________________________<br class="">
From: Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
Sent: Tuesday, December 6, 2016 4:36:56 PM<br class="">
To: Sameh Onaissi<br class="">
Cc: 'Amos Jeffries'; mailto:squid-users@lists.squid-cache.org<br class="">
Subject: RE: [squid-users] Skype for Business behind a transparent squid<br class="">
(TProxy) HTTP/S <br class="">
<br class="">
Try the next script:<br class="">
https://gist.github.com/elico/a54c2c8f8e1a2407b42210896b960f4b <br class="">
https://gist.github.com/elico/a54c2c8f8e1a2407b42210896b960f4b<br class="">
https://gist.github.com/elico/a54c2c8f8e1a2407b42210896b960f4b<br class="">
gist.github.com<br class="">
bypass squid interception for skype<br class="">
<br class="">
<br class="">
<br class="">
It has two modes: regular and tproxy.<br class="">
In your case you should run the script with:<br class="">
$ bypass-skype-cidr.sh tproxy<br class="">
<br class="">
The tproxy flag should do the trick for you.<br class="">
<br class="">
Let me know if it works for you.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
http://ngtech.co.il/lmgtfy/<br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: mailto:eliezer@ngtech.co.il<br class="">
<br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Tuesday, December 6, 2016 9:24 PM<br class="">
To: Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
Cc: Amos Jeffries <mailto:squid3@treenet.co.nz>;<br class="">
mailto:squid-users@lists.squid-cache.org<br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid<br class="">
(TProxy) HTTP/S<br class="">
<br class="">
Yes please, I would appreciate help with that script. <br class="">
<br class="">
As I aforementioned, totally new to all this<br class="">
<br class="">
<br class="">
<br class="">
Piensa en el medio ambiente antes de imprimir este email. <br class="">
<br class="">
On Dec 6, 2016, at 1:27 PM, Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
wrote:<br class="">
<br class="">
Now you can enhance the script by adding manually the ntop skype related<br class="">
networks based on:<br class="">
https://github.com/ntop/nDPI/blob/d9a2d9a6bd4d476d666d26cb713952760a975d92/s<br class="">
rc/lib/ndpi_content_match.c.inc#L286<br class="">
<br class="">
/*<br class="">
Skype (Microsoft CDN)<br class="">
157.56.135.64/26, 157.56.185.0/26, 157.56.52.0/26,<br class="">
157.56.53.128/25, 157.56.198.0/26<br class="">
157.60.0.0/16, 157.54.0.0/15 <br class="">
13.107.3.128/32<br class="">
13.107.3.129/32<br class="">
111.221.64.0 - 111.221.127.255<br class="">
91.190.216.0/21 (AS198015 Skype Communications Sarl)<br class="">
91.190.218.0/24<br class="">
40.126.129.109/32<br class="">
65.55.223.0/26<br class="">
*/<br class="">
<br class="">
If you need help scripting this let me know.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
http://ngtech.co.il/lmgtfy/<br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: mailto:eliezer@ngtech.co.il<br class="">
<br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Tuesday, December 6, 2016 7:29 PM<br class="">
To: Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
Cc: Amos Jeffries <mailto:squid3@treenet.co.nz>;<br class="">
mailto:squid-users@lists.squid-cache.org<br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid<br class="">
(TProxy) HTTP/S<br class="">
<br class="">
Hello, <br class="">
<br class="">
OK, I added the ssl_bump slice on the skype domains text file<br class="">
I installed ipset and ran the script.<br class="">
<br class="">
Now access.log has much less skype related logs:<br class="">
<br class="">
What is left is:<br class="">
1481044996.398 3412 10.0.0.11 TAG_NONE/200 0 CONNECT 132.245.1.32:443 -<br class="">
ORIGINAL_DST/132.245.1.32 -<br class="">
1481044996.423 0 10.0.0.11 TAG_NONE/400 3998 REGISTER<br class="">
sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
1481045000.296 372 10.0.0.11 TAG_NONE/200 0 CONNECT 134.170.113.207:443 -<br class="">
ORIGINAL_DST/134.170.113.207 -<br class="">
1481045000.325 0 10.0.0.11 TAG_NONE/400 3998 REGISTER<br class="">
sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
1481045008.685 4259 10.0.0.11 TAG_NONE/200 0 CONNECT 134.170.113.207:443 -<br class="">
ORIGINAL_DST/134.170.113.207 -<br class="">
1481045008.726 0 10.0.0.11 TAG_NONE/400 3998 REGISTER<br class="">
sip:solcv.comSIP/2.0 - HIER_NONE/- text/html<br class="">
<br class="">
<br class="">
although http://solve.com is in the text file.<br class="">
<br class="">
I ran whois on the first IP and got:<br class="">
<br class="">
NetRange: 132.245.0.0 - 132.245.255.255<br class="">
CIDR: 132.245.0.0/16<br class="">
NetName: MICROSOFT<br class="">
<br class="">
<br class="">
Same with the 134.170. address. Can we slice that range?<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
Sameh Onaissi<br class="">
Ingeniero de Soporte<br class="">
Sol Cable Visión<br class="">
Cel: 316-3023424<br class="">
Email: mailto:sameh.onaissi@solcv.com<br class="">
<br class="">
<br class="">
<br class="">
Piensa en el medio ambiente antes de imprimir este email. <br class="">
<br class="">
On Dec 6, 2016, at 12:11 PM, Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
wrote:<br class="">
<br class="">
Hey,<br class="">
<br class="">
Depends on your OS you will need to installthe ipset package.<br class="">
Try to run "apt-get install ipset".<br class="">
And then run the script.<br class="">
<br class="">
Eliezer<br class="">
<br class="">
----<br class="">
http://ngtech.co.il/lmgtfy/<br class="">
Linux System Administrator<br class="">
Mobile: +972-5-28704261<br class="">
Email: mailto:eliezer@ngtech.co.il<br class="">
<Untitled Attachment 1.jpg><br class="">
<br class="">
From: Sameh Onaissi [mailto:sameh.onaissi@solcv.com] <br class="">
Sent: Tuesday, December 6, 2016 5:23 PM<br class="">
To: Amos Jeffries <mailto:squid3@treenet.co.nz><br class="">
Cc: Eliezer Croitoru <mailto:eliezer@ngtech.co.il><br class="">
Subject: Re: [squid-users] Skype for Business behind a transparent squid<br class="">
(TProxy) HTTP/S<br class="">
<br class="">
Amos, thanks for the reply. <br class="">
<br class="">
<br class="">
This is getting more confusing.<br class="">
<br class="">
I changed the script to: http://pastebin.com/jLgywstg<br class="">
<br class="">
And I ran it, but I am getting errors:<br class="">
<br class="">
sudo sh http://bypass.sh/ + iptables -t mangle -L PREROUTING + grep<br class="">
bypasspool + [ 1 -ne 0 ] + iptables -t mangle -I PREROUTING -m set<br class="">
--match-set bypasspool dst,src -j DIVERT iptables http://v1.6.0/ Set<br class="">
bypasspool doesn't exist. Try `iptables -h' or 'iptables --help' for more<br class="">
information. + ipset create bypasspool hash:ip http://bypass.sh/ 10:<br class="">
http://bypass.sh/ ipset: not found + read item +<br class="">
echohttp://lyncdiscover.solcv.com/ http://lyncdiscover.solcv.com/ + host -4<br class="">
http://lyncdiscover.solcv.com/ + grep has address + awk {print $4} + xargs<br class="">
-l1 ipset add bypasspool xargs: ipset: No such file or directory + read item<br class="">
+ echo http://webdir0a.online.lync.com/http://webdir0a.online.lync.com/ +<br class="">
host -4 http://webdir0a.online.lync.com/ + grep has address + awk {print $4}<br class="">
+ xargs -l1 ipset add bypasspool xargs: ipset: No such file or directory<br class="">
<br class="">
. this goes on the same for all the domains in the text file<br class="">
<br class="">
My iptables is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
I did not quite understand what you meant by <br class="">
You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
should I incorporate the bypass script into my iptables.sh script? run<br class="">
iptables first then bypass?<br class="">
<br class="">
<br class="">
<br class="">
On a side note, would adding ssl_bump exceptions to squid.conf do it?<br class="">
Something like: <br class="">
<br class="">
acl skype_domains <path to file><br class="">
ssl_bump splice skype_domains<br class="">
ssl_bump bump all<br class="">
<br class="">
<br class="">
<br class="">
Again, thanks again for your help.<br class="">
<br class="">
<br class="">
<br class="">
<Untitled Attachment 2.jpg> Piensa en el medio ambiente antes de imprimir<br class="">
este email.<br class="">
<br class="">
On Dec 6, 2016, at 9:50 AM, Amos Jeffries <mailto:squid3@treenet.co.nz><br class="">
wrote:<br class="">
<br class="">
On 7/12/2016 3:19 a.m., Sameh Onaissi wrote:<br class="">
Hello,<br class="">
<br class="">
I tried doing the changes to nat/REDIRECT in iptables.sh and I must have<br class="">
messed up somewhere, so I am sticking with mangle/tproxy for now since squid<br class="">
is working with them.<br class="">
<br class="">
How can I change Eliezer's script to mangle/tproxy?<br class="">
https://gist.github.com/elico/e0faadf0cc63942c5aaade808a87deef<br class="">
<br class="">
Excuse my novice knowledge in iptables.<br class="">
<br class="">
No worries.<br class="">
<br class="">
You need to change where iptables attaches the 'bypasspool'. Both the<br class="">
table/location (-t) and the jump/action (-j).<br class="">
<br class="">
iptables -t mangle -L PREROUTING |grep bypasspool<br class="">
if [ "$?" -ne "0" ];then<br class="">
<br class="">
iptables -t mangle -I 2 PREROUTING \<br class="">
-m set --match-set bypasspool dst,src \<br class="">
-j DIVERT<br class="">
<br class="">
fi<br class="">
<br class="">
You should test whether -m set or -m socket work faster and put that one<br class="">
first. My change above places it at line 2 (after -m socket) assuming<br class="">
your iptables script is still <http://pastebin.com/SqpbmYQQ><br class="">
<br class="">
(Your script should do that line adding, not Eliezers - so that you can<br class="">
be sure the order is always correct).<br class="">
<br class="">
<br class="">
BTW: you should use iptables-save / iptables-restore instead of a slow<br class="">
script calling iptables "manually". Those other tools will ensure there<br class="">
are no gaps in the firewall initialization for nasty traffic to sneak<br class="">
through.<br class="">
<br class="">
I am looking at access.log to collect all domains I see heading to skype for<br class="">
business, as well as IPs. My question is, can I add the domains AND IPs into<br class="">
the domains-to-bypass.txt that the above script uses?<br class="">
<br class="">
IIRC you should be able to use domain as the parameter to ipset. But it<br class="">
will resolve the domain immediately and only add those IPs that it finds<br class="">
at that time into the pool. Any future changes, or a hidden set of IPs<br class="">
that rotate in/out will not be listed.<br class="">
<br class="">
Amos<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>