<div dir="ltr"><span style="font-size:12.8px">The site I was having trouble with was </span><a href="http://video.foxnews.com/" target="_blank" style="font-size:12.8px">video.foxnews.com</a><span style="font-size:12.8px">. The page loads but the actual video hangs with "spinning wheel of death". I took Amos suggestion and added deny via, request-x-forward and that fixed the issue but I was trying to create the anonymous proxy paranoid setup initially, and Amos suggestion won't achieve that.</span><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 19, 2016 at 9:28 AM, Robert Watson <span dir="ltr"><<a href="mailto:robert@gillecaluim.com" target="_blank">robert@gillecaluim.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">The site I was having trouble with was <a href="http://video.foxnews.com" target="_blank">video.foxnews.com</a>. I took Amos suggestion and added deny via, request-x-forward and that fixed the issue but I was trying to create the anonymous proxy paranoid setup initially, and Amos suggestion won't achieve that.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Dec 18, 2016 at 2:25 PM, Eliezer Croitoru <span dir="ltr"><<a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Robert,<br>
<br>
Can you be more specific?<br>
“Not working” can depend on couple things and on the nature of the<br>
streaming system.<br>
I know that many streaming sites do work under transparent squid so it’s<br>
not really well understood what is not working from the spectrum of options.<br>
Can you give examples for streaming sites that do work and others that do<br>
not?<br>
The first that pops in my mind to test it would be:<br>
<a href="https://www.youtube.com/" rel="noreferrer" target="_blank">https://www.youtube.com/</a><br>
<a href="https://www.crunchyroll.com/" rel="noreferrer" target="_blank">https://www.crunchyroll.com/</a><br>
<a href="https://rutube.ru/" rel="noreferrer" target="_blank">https://rutube.ru/</a><br>
And many others that are mentioned at:<br>
<a href="http://www.unveiltech.com/indexsquidvideobooster.php" rel="noreferrer" target="_blank">http://www.unveiltech.com/inde<wbr>xsquidvideobooster.php</a> (under Smart Cache)<br>
<br>
And take Amos suggestion about restricting the headers more selectively.<br>
Depends on your system policy you would be able to find that for most sites<br>
you won’t have any issues letting any headers pass but for selective sites<br>
you would want to take another policy that would be to block in general and<br>
leaving aside the specific headers “allowed” approach.<br>
<br>
Also, have you tried to disable the virus scan to verify if it’s the<br>
culprit for the streaming issue?<br>
<br>
Please give one example so I and maybe others would be able to grasp the<br>
issue in some way.<br>
<br>
Thanks,<br>
Eliezer<br>
<br>
----<br>
Eliezer Croitoru <<a href="http://ngtech.co.il/lmgtfy/" rel="noreferrer" target="_blank">http://ngtech.co.il/lmgtfy/</a>><br>
Linux System Administrator<br>
Mobile: <a href="tel:%2B972-5-28704261" value="+972528704261" target="_blank">+972-5-28704261</a><br>
Email: <a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a><br>
<br>
<br>
From: squid-users [mailto:<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@li<wbr>sts.squid-cache.org</a>] On<br>
Behalf Of Robert Watson<br>
Sent: Saturday, December 17, 2016 7:00 AM<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br>
Subject: [squid-users] squid.conf blocking live video stream<br>
<span><br>
Sorry if this shows up twice on the mailing list...<br>
I've setup a transparent proxy squid v3.5.22 on a x86_64 Arch Linux server.<br>
The transparent proxy is working fine for web page caching but live video<br>
isn't getting through. I thought it was a netfilter issue but bypassing the<br>
proxy fixes this issue.<br>
<br>
</span>acl localnet src <a href="http://10.20.0.0/16" rel="noreferrer" target="_blank">10.20.0.0/16</a> <<a href="http://10.20.0.0/16" rel="noreferrer" target="_blank">http://10.20.0.0/16</a>> # RFC1918 possible<br>
<span>internal network<br>
acl SSL_ports port 443 # https<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 554 # rtsp<br>
acl Safe_ports port 1935 # rtmp<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl CONNECT method CONNECT<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access allow localhost manager<br>
http_access deny manager<br>
http_access deny to_localhost<br>
http_access allow localnet<br>
http_access allow localhost<br>
http_access deny all<br>
</span>visible_hostname <a href="http://server.ourhome.net" rel="noreferrer" target="_blank">server.ourhome.net</a> <<a href="http://server.ourhome.net" rel="noreferrer" target="_blank">http://server.ourhome.net</a>><br>
http_port <a href="http://10.20.30.1:3128" rel="noreferrer" target="_blank">10.20.30.1:3128</a> <<a href="http://10.20.30.1:3128" rel="noreferrer" target="_blank">http://10.20.30.1:3128</a>> intercept<br>
disable-pmtu-discovery=transpa<wbr>rent<br>
http_port <a href="http://127.0.0.0:8181" rel="noreferrer" target="_blank">127.0.0.0:8181</a> <<a href="http://127.0.0.0:8181" rel="noreferrer" target="_blank">http://127.0.0.0:8181</a>><br>
<div class="m_9169695551380365953HOEnZb"><div class="m_9169695551380365953h5">coredump_dir /var/cache/squid<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
#<br>
# Anonymous Proxy settings<br>
include /etc/squid/extra/anonymous.con<wbr>f<br>
#<br>
# Virus scanning via C-ICAP<br>
#<br>
include /etc/squid/extra/c-icap.conf<br>
#<br>
<br>
By the process of elimination I've narrowed it down to the anonymous proxy<br>
settings...<br>
anonymous.conf<br>
<br>
forwarded_for off<br>
request_header_access Allow allow all<br>
request_header_access Authorization allow all<br>
request_header_access WWW-Authenticate allow all<br>
request_header_access Proxy-Authorization allow all<br>
request_header_access Proxy-Authenticate allow all<br>
request_header_access Cache-Control allow all<br>
request_header_access Content-Encoding allow all<br>
request_header_access Content-Length allow all<br>
request_header_access Content-Type allow all<br>
request_header_access Date allow all<br>
request_header_access Expires allow all<br>
request_header_access Host allow all<br>
request_header_access If-Modified-Since allow all<br>
request_header_access Last-Modified allow all<br>
request_header_access Location allow all<br>
request_header_access Pragma allow all<br>
request_header_access Accept allow all<br>
request_header_access Accept-Charset allow all<br>
request_header_access Accept-Encoding allow all<br>
request_header_access Accept-Language allow all<br>
request_header_access Content-Language allow all<br>
request_header_access Mime-Version allow all<br>
request_header_access Retry-After allow all<br>
request_header_access Title allow all<br>
request_header_access Connection allow all<br>
request_header_access Proxy-Connection allow all<br>
request_header_access User-Agent allow all<br>
request_header_access Cookie allow all<br>
request_header_access All deny all<br>
<br>
could someone please tell me what request_header_access I need to all, or<br>
how to further trouble shoot this configuration?<br>
<br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>