<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 19, 2016, at 11:55 PM, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" class="">squid3@treenet.co.nz</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 20/12/2016 9:52 a.m., Sameh Onaissi wrote:<br class="">
<blockquote type="cite" class=""><br class="">
<blockquote type="cite" class="">On Dec 19, 2016, at 1:31 PM, Antony Stone wrote:<br class="">
<br class="">
On Monday 19 December 2016 at 17:44:11, Sameh Onaissi wrote:<br class="">
<br class="">
<blockquote type="cite" class="">Hello,<br class="">
<br class="">
I was using squid client to get cache stats, however this morning it<br class="">
completely stopped working.<br class="">
</blockquote>
<br class="">
<blockquote type="cite" class=""><center><img src="<a href="http://mydomainname.com/squid/access_denied.jpg" class="">http://mydomainname.com/squid/access_denied.jpg</a>"<br class="">
alt="Acceso Denegado" style="width:704px;height:428px;"></center><br class="">
</blockquote>
<br class="">
<blockquote type="cite" class="">the html code is the code of my redirect page whenever a client tries to<br class="">
access a blacklisted website.<br class="">
</blockquote>
<br class="">
How big is your blacklist? Could you show us what's in it?<br class="">
<br class="">
Have you added the proxy itself to the whitelist?<br class="">
</blockquote>
<br class="">
The blacklist consistes of the ads, porn, socialnet and spyware lists of the BL list.
<br class="">
<br class="">
I added both LAN and WAN IPs of the server to the whitelist but didn’t help.<br class="">
<br class="">
</blockquote>
<br class="">
What URL was being requested that got the above access denied response?<br class="">
<br class="">
Use -vv parameter to squidclient and "debug_options 11,2" in squid.conf<br class="">
to have the requests header logged and find that out.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>This is what shows now:</div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">verbosity level set to 2</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Request:</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">GET cache_object://localhost/info HTTP/1.0</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Host: localhost</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">User-Agent: squidclient/3.5.22</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Accept: */*</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Connection: close</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">.</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Transport detected: IPv4-mapped and IPv6</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Resolving localhost ...</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Connecting... localhost ([::1]:3128)</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Connected to: localhost ([::1]:3128)</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Sending HTTP request ... </span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">done.</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">HTTP/1.1 200 OK</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Date: Tue, 20 Dec 2016 14:03:46 GMT</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Server: Apache/2.4.7 (Ubuntu)</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Last-Modified: Fri, 25 Nov 2016 16:55:22 GMT</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">ETag: "bd-54222fce80317"</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Accept-Ranges: bytes</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Content-Length: 189</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Vary: Accept-Encoding</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Content-Type: text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Age: 103</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">X-Cache: HIT from
<a href="http://squidpxy.domain.com" class="">squidpxy.domain.com</a></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">X-Cache-Lookup: HIT from
<a href="http://squidpxy.domain.com" class="">squidpxy.domain.com</a>:3128</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Via: 1.1 <a href="http://squidpxy.domain.com" class="">
squidpxy.domain.com</a> (squid/3.5.22)</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Connection: close</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><!DOCTYPE html></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><html></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><body></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><center><img src="<a href="http://www.domain.com/squid/access_denied.jpg" class="">http://www.domain.com/squid/access_denied.jpg</a>" alt="Acceso Denegado" style="width:704px;height:428px;"></center></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0); min-height: 14px;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class="">
</div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></body></span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""></html></span></div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
</div>
<div>And in the access log:</div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482242596.513
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">0 ::1</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TCP_MEM_HIT/200 598 GET cache_object://localhost/info - HIER_NONE/- text/html</span></div>
</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class=""><br class="">
<br class="">
<blockquote type="cite" class="">So, I changed my default acl setting in squid guard config file to pass all for now (I know it is not ideal), just to monitor the cache as I am trying to get the HIT ratio up. (currently only at 7.8%)<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span><br class="">
squid guard config: <a href="http://pastebin.com/bbe8CWLE" class="">pastebin.com/bbe8CWLE</a><br class="">
<br class="">
</blockquote>
<br class="">
So your SG config just does basic IP, URL and time based allow or<br class="">
redirect decisions.<br class="">
<br class="">
I suggest you drop SG entirely and move that config into your squid.conf:<br class="">
<br class="">
<br class="">
# Time rules<br class="">
# abbrev for weekdays:<br class="">
# s = sun, m = mon, t =tue, w = wed, h = thu, f = fri, a = sat<br class="">
acl non-working-hours time MTWHF 18:00-24:00 00:00-08:00<br class="">
acl non-working-hours time MTWHF 18:00-24:00 00:00-08:00<br class="">
acl non-working-hours time SA 00:00-24:00<br class="">
<br class="">
# Source addresses<br class="">
acl exempt src 10.0.0.90 10.0.0.167<br class="">
acl youtubers src 10.0.0.1-10.0.0.4<br class="">
acl localnet src 10.0.0.0/24<br class="">
<br class="">
# Destination classes<br class="">
acl blah_domains dstdomain "adv/domains"<br class="">
acl blah_domains dstdomain "deny/domains"<br class="">
acl blah_domains dstdomain "porn/domains"<br class="">
acl blah_domains dstdomain "spyware/domains"<br class="">
acl blah_domains dstdomain "socialnet/domains"<br class="">
<br class="">
acl blah_urls dstdom_regex "adv/urls"<br class="">
acl blah_urls dstdom_regex "deny/urls"<br class="">
acl blah_urls dstdom_regex "porn/urls"<br class="">
acl blah_urls dstdom_regex "spyware/urls"<br class="">
acl blah_urls dstdom_regex "socialnet/urls"<br class="">
<br class="">
acl stuff_always_blocked anyof blah_domains blah_urls<br class="">
<br class="">
acl whitelist_domains dstdomain "whitelist/domains"<br class="">
acl whitelist_urls dstdom_regex "whitelist/urls"<br class="">
acl whitelist anyof whitelist_domains whitelist_urls<br class="">
deny_info 302:<a href="http://example.com/squid/denegado.html" class="">http://example.com/squid/denegado.html</a> whitelist<br class="">
<br class="">
acl youtubers_domains dstdomain "socialnet/domains"<br class="">
acl youtubers_urls dstdom_regex "adv/urls"<br class="">
acl youtubers anyof youtubers_domains youtubers_urls<br class="">
deny_info 302:<a href="http://example.com/squid/denegado.html" class="">http://example.com/squid/denegado.html</a> youtubers<br class="">
<br class="">
# Policies<br class="">
http_access deny !localnet<br class="">
deny_info 302:<a href="http://example.com/squid/denegado.html" class="">http://example.com/squid/denegado.html</a> localnet<br class="">
<br class="">
http_access allow exempt<br class="">
http_access allow youtubers !stuff_always_blocked<br class="">
http_access deny youtubers<br class="">
http_access allow non-working-hours<br class="">
http_access allow whitelist !stuff_always_blocked<br class="">
http_access deny whitelist<br class="">
http_access allow localnet<br class="">
<br class="">
deny_info 302:<a href="http://example.com/squid/denegado.html" class="">http://example.com/squid/denegado.html</a> all<br class="">
http_access deny all<br class="">
<br class="">
<br class="">
<blockquote type="cite" class=""><br class="">
<blockquote type="cite" class=""><br class="">
<blockquote type="cite" class="">squid.conf: <a href="http://pastebin.com/TQ8H6bRp" class="">
http://pastebin.com/TQ8H6bRp</a><br class="">
</blockquote>
<br class="">
Quote from your config:<br class="">
<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>acl Safe_ports port 587 #SMTP<br class="">
<br class="">
Did you read Amos' reply "SMTP is the #1 worst protocol to let anywhere near <br class="">
an HTTP proxy. Preventing what you have allowed to happen is one of the <br class="">
primary reasons Safe_ports exists in the first place!”<br class="">
</blockquote>
<br class="">
</blockquote>
<br class="">
<blockquote type="cite" class="">The reason I allow 587 is because the Squid Proxy lives on the same<br class="">
</blockquote>
server as a mail server which needs this port, and several clients have<br class="">
their mail clientes (Outlook..etc) already configured to use this port.<br class="">
<br class="">
Bogus. You should know it is possible that two pieces of software can<br class="">
run on one machine without interferring with each other.<br class="">
<br class="">
Whether or not a mailserver exists on the same machine has nothing to do<br class="">
with Squid.<br class="">
<br class="">
Your mailserver itself should be using that port and controlling what<br class="">
traffic can use it. *HTTP* traffic should never be allowed to flow from<br class="">
the proxy software through to the mailserver software.<br class="">
<br class="">
Amos<br class="">
<br class="">
_______________________________________________<br class="">
squid-users mailing list<br class="">
<a href="mailto:squid-users@lists.squid-cache.org" class="">squid-users@lists.squid-cache.org</a><br class="">
http://lists.squid-cache.org/listinfo/squid-users<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>