<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi Paul and thank you for your reply.
<div class=""><br class="">
</div>
<div class="">I did try the extension and Squid blocked it right away.</div>
<div class=""><br class="">
</div>
<div class="">The user has hotspot shield installed on his PC, which I believe is a similar extension to the one you mentioned. </div>
<div class="">My squid.conf blocks domains, I have a bypass list of IPs for local company servers and Skype For Business.</div>
<div class=""><br class="">
</div>
<div class="">The user has hotspot shield installed, both the chrome extension and the desktop software, although the chrome extension is always Off from what I have seen (red icon when off, green when on).</div>
<div class=""><br class="">
</div>
<div class="">He is getting by squid with some sort of VPN, I thought squid can be configured against such things? </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 22, 2016, at 4:34 PM, Paul Freeman <<a href="mailto:paul.freeman@emlchem.com.au" class="">paul.freeman@emlchem.com.au</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Sam,<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I haven’t followed your thread closely so what I am about to mentio may already have been discussed. Apologies if this is the case.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">As Alex says, the connections to youtube receive a 503 but then there are successful connects on port 443 to numerous site by IP address rather than hostname.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Doing a reverse lookup on the IP addresses shows some are in the<span class="Apple-converted-space"> </span><a href="http://northghost.com/" style="color: purple; text-decoration: underline;" class="">northghost.com</a><span class="Apple-converted-space"> </span>dns
domain name.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I looked up<span class="Apple-converted-space"> </span><a href="http://northghost.com/" style="color: purple; text-decoration: underline;" class="">northghost.com</a><span class="Apple-converted-space"> </span>and
they offer an app for mobiles or an add-on for Chrome called Touch VPN. Perhaps this might be being used by your user although I don’t really know how it works and whether it really is how the user appears to be pypassing the proxy.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">In your squid.conf or other access control systems, do you allow urls specified by IP as well as hostnames?<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Paul<o:p class=""></o:p></span></div>
</div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">NOTE: This email contains my personal opinions and comments which do not necessarily represent those of my employer.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div>
<div style="border-style: none none none solid; border-left-color: blue; border-left-width: 1.5pt; padding: 0cm 0cm 0cm 4pt;" class="">
<div class="">
<div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<b class=""><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif;" class="">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif;" class=""><span class="Apple-converted-space"> </span>squid-users [<a href="mailto:squid-users-bounces@lists.squid-cache.org" class="">mailto:squid-users-bounces@lists.squid-cache.org</a>]<span class="Apple-converted-space"> </span><b class="">On
Behalf Of<span class="Apple-converted-space"> </span></b>Sameh Onaissi<br class="">
<b class="">Sent:</b><span class="Apple-converted-space"> </span>Friday, 23 December 2016 8:03 AM<br class="">
<b class="">To:</b><span class="Apple-converted-space"> </span><a href="mailto:squid-users@lists.squid-cache.org" class="">squid-users@lists.squid-cache.org</a><br class="">
<b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [squid-users] Bypassed Proxy<o:p class=""></o:p></span></div>
</div>
</div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Hello,<span class="Apple-converted-space"> </span><o:p class=""></o:p></div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Eliezer’s recommended fix did not work.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
The user was on YouTube watching UFC all day today.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Here’s a copy of the log at the time.<o:p class=""></o:p></div>
</div>
<div class="">
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.285 353<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 167.114.159.186:443 - ORIGINAL_DST/167.114.159.186 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.303 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4462 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.318 4756<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.340 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.567 839<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 188.166.70.138:443 - ORIGINAL_DST/188.166.70.138 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.585 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4459 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.650 373<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 85.203.7.35:443 - ORIGINAL_DST/85.203.7.35 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.669 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4450 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.682 1969<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.706 386<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 188.166.73.9:443 - ORIGINAL_DST/188.166.73.9 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.740 6540<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 85.203.18.254:443 - ORIGINAL_DST/85.203.18.254 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.784 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.784 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4453 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.784 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.909 469<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 138.68.93.229:443 - ORIGINAL_DST/138.68.93.229 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.927 1882<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 208.123.223.254:443 - ORIGINAL_DST/208.123.223.254 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.940 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436450.955 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4462 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.063 197<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 208.123.223.254:443 - ORIGINAL_DST/208.123.223.254 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.080 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4462 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.217 434<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 138.68.97.9:443 - ORIGINAL_DST/138.68.97.9 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.236 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4450 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.322 271<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 65.52.108.76:443 - ORIGINAL_DST/65.52.108.76 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.345 479<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 138.68.93.229:443 - ORIGINAL_DST/138.68.93.229 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.361 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.498 4240<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.530 0<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/503
4456 CONNECT<a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></span></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: black;" class="">
<span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class="">1482436451.909 817<span class="Apple-converted-space"> </span></span><span style="font-family: 'Andale Mono', serif; color: rgb(195, 55, 32);" class="">10.0.0.105</span><span style="font-family: 'Andale Mono', serif; color: rgb(41, 249, 20);" class=""><span class="Apple-converted-space"> </span>TAG_NONE/200
0 CONNECT 188.166.70.138:443 - ORIGINAL_DST/188.166.70.138 -<o:p class=""></o:p></span></div>
</div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
I know 503 is an error, but the user was using youtube without any hassles.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Those IPs are for Digital Ocean and Alentus Corporation.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Squid is being “fooled” somehow. <o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
I did notice the 503, which made it more confusing to me.<o:p class=""></o:p></div>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
The reason I investigated the issue was because I saw youtube working on the client’s PC with a blue shield-like icon along with some words on top of the youtube page (was not close enough to see the exact logo/words). The video was working fine, but that blue
shield extension seems to be the reason behind “fooling” squid.<o:p class=""></o:p></div>
</blockquote>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Both the chrome extension and the Desktop client are installed on the machine.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
I tried replicating that, but I couldn’t even connect the client.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
What should I be looking for in cache.log?<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Thanks again!<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Sam<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div class="">
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="">
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
On Dec 21, 2016, at 6:59 PM, Sameh Onaissi <<a href="mailto:sameh.onaissi@solcv.com" style="color: purple; text-decoration: underline;" class="">sameh.onaissi@solcv.com</a>> wrote:<o:p class=""></o:p></div>
</div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div class="">
<div class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
On Dec 21, 2016, at 6:51 PM, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com" style="color: purple; text-decoration: underline;" class="">rousskov@measurement-factory.com</a>> wrote:<br class="">
<br class="">
On 12/21/2016 10:14 AM, Sameh Onaissi wrote:<br class="">
<br class="">
<br class="">
<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
One user is somehow, able to access you tube through squid!<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
<br class="">
<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
1482339083.228 0 10.0.0.162 TAG_NONE/503 4459 CONNECT<span class="Apple-converted-space"> </span><a href="http://s.youtube.com/" style="color: purple; text-decoration: underline;" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
What makes you think this user was able to access youtube? AFAICT, Squid<br class="">
responded with an error (TAG_NONE/503) and did not contact the origin<br class="">
server (HIER_NONE/-).<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
I did notice the 503, which made it more confusing to me.<br class="">
The reason I investigated the issue was because I saw youtube working on the client’s PC with a blue shield-like icon along with some words on top of the youtube page (was not close enough to see the exact logo/words). The video was working fine, but that blue
shield extension seems to be the reason behind “fooling” squid.<br class="">
<br class="">
In any case, I applied the ACL’s to the squid.conf as Eliezer recommended, now I’ll wait till the user comes back in tomorrow to see if it worked.<br class="">
<br class="">
<br class="">
<o:p class=""></o:p></div>
<p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br class="">
I understand that you want Squid to redirect users instead of responding<br class="">
with an error. This 503 response could be due to Squid being unable to<br class="">
bump the user connection for some reason. Successful bumping is required<br class="">
to redirect users.<br class="">
<br class="">
You may see more details inside that error response itself. Others on<br class="">
the list may be able to help you to get to that response in Squid logs<br class="">
or packet captures.<br class="">
<br class="">
<br class="">
HTH,<br class="">
<br class="">
Alex.</p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>