<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello all,
<div class=""><br class="">
</div>
<div class="">I got a transparent squid installed on Ubuntu 16.04</div>
<div class=""><br class="">
</div>
<div class="">Using squid guard, I am blocking certain websites, including youtube.</div>
<div class=""><br class="">
</div>
<div class="">Anytime a user tries accessing it, he/she is redirected to an access denied page.</div>
<div class=""><br class="">
</div>
<div class="">Except for ONE user!</div>
<div class=""><br class="">
</div>
<div class="">One user is somehow, able to access you tube through squid!</div>
<div class="">That IP is not on the exempt list, and has no special configurations.</div>
<div class=""><br class="">
</div>
<div class="">access.log:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.228 0 10.0.0.162 TAG_NONE/503 4459 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.324 0 10.0.0.162 TAG_NONE/503 4450 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.331 0 10.0.0.162 TAG_NONE/503 4459 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.422 0 10.0.0.162 TAG_NONE/503 4459 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.436 0 10.0.0.162 TAG_NONE/503 4450 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339083.517 0 10.0.0.162 TAG_NONE/503 4459 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339086.251 0 10.0.0.162 TAG_NONE/503 4450 CONNECT s.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com:443
- HIER_NONE/- text/html</span></div>
</div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div class="">Any other user tries and gets:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482339588.002 350 10.0.0.40 TCP_MISS/200 611 GET
<a href="https://www" class="">https://www</a>.</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">youtube</span><span style="font-variant-ligatures: no-common-ligatures" class="">.com/ - HIER_DIRECT/190.xxx.xxx.xxx text/html</span></div>
</div>
<div class=""><br class="">
</div>
<div class="">That is the redirect html page.</div>
<div class=""><br class="">
</div>
<div class="">My deny list where youtube is:</div>
<div class=""><br class="">
</div>
<div class="">var/lib/squidguard/db/deny/urls has <a href="http://www.youtube.com" class="">
www.youtube.com</a></div>
<div class="">var/lib/squidguard/db/deny/domains has <a href="http://youtube.com" class="">
youtube.com</a></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Any idea to how he is doing it?</div>
<div class=""><br class="">
</div>
<div class="">I can add a rule to specifically deny 10.0.0.162, but I want to know how he is doing it to prevent it for others. Also this is a dynamic IP.</div>
<div class=""><br class="">
</div>
<div class="">Thank you,</div>
<div class="">Sam</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</body>
</html>