<div dir="ltr"><div>Dear Eliezer</div><div><br></div><div>i had created new iptables configuration and it works fine for an hour (attached)</div><div><br></div><div>both transparent proxy and with setting proxy clients accessing internet through squid <br></div><div><br></div><div>but after every hour the service gets crash or unstable. and need to restart squid and iptables services to work</div><div><br></div><div>i found the following error in access.log when service gets disturb. I don't know the reason and such traffic what it is about and how to resolve it. when we restart server, the services again start fine and internet works.<br></div><div><br></div><div>1502858587.658 114260 192.168.2.162 TAG_NONE/503 0 CONNECT <a href="http://dc.services.visualstudio.com:443">dc.services.visualstudio.com:443</a> - HIER_NONE/- -<br>1502858587.658 114260 192.168.2.162 TAG_NONE/503 0 CONNECT <a href="http://dc.services.visualstudio.com:443">dc.services.visualstudio.com:443</a> - HIER_NONE/- -<br>1502858587.658 114258 192.168.5.1 TAG_NONE/503 0 CONNECT <a href="http://update.googleapis.com:443">update.googleapis.com:443</a> - HIER_NONE/- -<br>1502858587.658 114252 192.168.2.125 TAG_NONE/503 0 CONNECT <a href="http://update.googleapis.com:443">update.googleapis.com:443</a> - HIER_NONE/- -<br>1502858587.658 114256 192.168.2.188 TAG_NONE/503 0 CONNECT <a href="http://en.wikibooks.org:443">en.wikibooks.org:443</a> - HIER_NONE/- -<br>1502858587.658 114256 192.168.2.188 TAG_NONE/503 0 CONNECT <a href="http://en.wikibooks.org:443">en.wikibooks.org:443</a> - HIER_NONE/- -<br>1502858587.658 114256 192.168.2.188 TAG_NONE/503 0 CONNECT <a href="http://en.wikibooks.org:443">en.wikibooks.org:443</a> - HIER_NONE/- -<br>1502858587.658 114256 192.168.2.188 TAG_NONE/503 0 CONNECT <a href="http://en.wikibooks.org:443">en.wikibooks.org:443</a> - HIER_NONE/- <br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 1, 2017 at 5:17 PM, Eliezer Croitoru <span dir="ltr"><<a href="mailto:eliezer@ngtech.co.il" target="_blank">eliezer@ngtech.co.il</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey,<br>
<br>
The iptables rules doesn't make any sense:<br>
IPTABLES SETTING<br>
<br>
# Generated by iptables-save v1.4.7 on Mon Jul 31 05:43:29 2017<br>
*filter<br>
:INPUT ACCEPT [0:0]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [8330155:414444635]<br>
-A INPUT -i eth1 -j ACCEPT<br>
-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT<br>
-A INPUT -i lo -j ACCEPT<br>
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT<br>
<span class="">-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129<br>
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130<br>
</span>-A INPUT -j DROP<br>
COMMIT<br>
# Completed on Mon Jul 31 05:43:29 2017<br>
<br>
There is no PREROUTING in the filter table...<br>
Take a peek at:<br>
<a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect#iptables_configuration" rel="noreferrer" target="_blank">http://wiki.squid-cache.org/<wbr>ConfigExamples/Intercept/<wbr>LinuxRedirect#iptables_<wbr>configuration</a><br>
<br>
and also I suggest you to use intercept ports such as:<br>
13128 (for http, port 80)<br>
13129 ( for https, port 443)<br>
<br>
And not port 3130.<br>
<br>
Let me know if it helps with something.<br>
<br>
Eliezer<br>
<br>
----<br>
<a href="http://ngtech.co.il/lmgtfy/" rel="noreferrer" target="_blank">http://ngtech.co.il/lmgtfy/</a><br>
Linux System Administrator<br>
Mobile: +972-5-28704261<br>
Email: <a href="mailto:eliezer@ngtech.co.il">eliezer@ngtech.co.il</a><br>
<br>
<br>
From: squid-users [mailto:<a href="mailto:squid-users-bounces@lists.squid-cache.org">squid-users-bounces@<wbr>lists.squid-cache.org</a>] On Behalf Of Arsalan Hussain<br>
Sent: Tuesday, August 1, 2017 12:45<br>
To: <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
Subject: [squid-users] Need help to solve problem with Squid 3.5.26 SSL Bump setting & iptables rules<br>
<div class="HOEnZb"><div class="h5"><br>
Dear all,<br>
i have configured squid 3.5.26 SSL bump on CENTOS 6.2 to share internet and delay pools to control bandwidth (my configuration files attached)<br>
<br>
Problem what i facing and not understanding the issue.<br>
<br>
1- clients who send request- proxy setting working fine with this directive http_port 3128<br>
- Delay pools working fine, internet browsing to all clients using proxy is working.<br>
<br>
2- When transparent proxy clients sent http request via iptables ... REDIRECT.<br>
http_port 3129 intercept<br>
OR<br>
When transparent proxy clients sent https request via iptables ... REDIRECT.<br>
https_port 3130 intercept ssl-bump generate-host-certificates=on<br>
dynamic_cert_mem_cache_size=<wbr>4MB cert=/etc/squid/ssl_certs/<wbr>squid.pem<br>
I observed the problem in both cases when client sent request through IPTABLES Squid service got failed. When i stop iptables and start squid then it start working.<br>
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129<br>
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130<br>
<br>
3- my objective to setup squid.<br>
* Internet sharing to Proxy setting configured clients.<br>
* Internet sharing to Proxy Transparent clients (Those request directed to server from ip route 0.0.0.0 0.0.0.0 Proxy-IP from CISCO Network for HTTP and HTTPS Requests without configuring proxy setting (coming from wireless).<br>
* delay pools for HTTP and HTTPS both browsing for proxy & transparent clients.<br>
<br>
<br>
Kindly if somebody help me to fix my problems and if share any setting which works. I had added ssl bump certificate because the service was crashing again and again without any reason after a few days or sometime on same day.<br>
<br>
<br>
<br>
--<br>
With Regards,<br>
<br>
Arsalan Hussain<br>
If you don't fight for what you want, don't cry for what you lose.<br>
<br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">With Regards,<br>
<p><br><b style="font-size:12.8px"><span style="color:rgb(23,54,93);background-image:initial;background-position:initial;background-repeat:initial">Arsalan Hussain</span></b><br><b style="font-size:12.8px"><span style="color:#c0504d">Assistant Director, Networks & Information System</span></b></p><p><span><b style="font-size:12.8px"><span style="font-size:14.0pt;font-family:"Baskerville Old Face",serif;color:#4f81bd">PRESTON UNIVERSITY</span></b><br><span style="color:rgb(31,73,125);font-size:12.8px">Add: Plot: 85, Street No: 3, Sector H-8/1, Islamabad, Pakistan</span><br><span style="color:rgb(31,73,125);font-size:12.8px">Cell: +92-322-5018611</span><br><span style="color:rgb(31,73,125);font-size:12.8px">UAN: (51) 111-707-808 (Ext: 443)</span></span></p><div><b><font size="2">Don't expect to see a change if you don't make one.</font></b><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>