<div dir="auto"><div>Access.log brings for <a href="http://www.heise.de">www.heise.de</a> on https</div><div dir="auto"><br></div><div dir="auto"><div dir="auto">NECT <a href="http://192.168.1.222:443">192.168.1.222:443</a> - HIER_NONE/- - </div><div dir="auto">1510489280.731 2 192.168.1.200 NONE/200 0 CO</div><div dir="auto">NNECT <a href="http://192.168.1.222:443">192.168.1.222:443</a> - HIER_NONE/- - </div><div dir="auto">1510489280.836 1 192.168.1.200 TCP_MISS/503 </div><div dir="auto">4691 GET <a href="https://www.heise.de/">https://www.heise.de/</a> - ORIGINAL_DST/192</div><div dir="auto">.168.1.222 text/html </div><div dir="auto">1510489280.892 1 192.168.1.200 TCP_MISS/503 </div><div dir="auto">4703 GET <a href="https://www.heise.de/favicon.ico">https://www.heise.de/favicon.ico</a> - ORIGI</div><div dir="auto">NAL_DST/<a href="http://192.168.1.222">192.168.1.222</a> text/html </div><div dir="auto">1510489283.136 2 192.168.1.200 NONE/200 0 CO</div><div dir="auto">NNECT <a href="http://192.168.1.222:443">192.168.1.222:443</a> - HIER_NONE/- - </div><div dir="auto">1510489283.224 1 192.168.1.200 TCP_MISS/503 </div><div dir="auto"><br></div><div class="gmail_extra" dir="auto"><br><div class="gmail_quote">Am 12.11.2017 12:46 schrieb "snable snable" <<a href="mailto:thesnable@gmail.com">thesnable@gmail.com</a>>:<br type="attribution"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="elided-text"><div dir="auto"><div><div class="gmail_quote"><br><br type="attribution"><blockquote class="m_2623675589516299945quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">hey<div dir="auto"><br></div><div dir="auto">thanks:</div><div dir="auto"><br></div><div dir="auto">i post in detail</div><div dir="auto"><br></div><div dir="auto">i have an openwrt box. clients are attached there to the <a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a> network via nat. i attached the router as a wan device on my <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a> with 192.168.1.254 as my internet gateway.</div><div dir="auto"><br></div><div dir="auto">i have a squidbox with squid 4 running on ports 3128 and 3129 and 3130.</div><div dir="auto"> i forward the traffic from the openwrt via:</div><div dir="auto"><br></div><div dir="auto"><div dir="auto"> </div><div dir="auto">iptables -t mangle -A PREROUTING -j ACCEPT -p tcp</div><div dir="auto"> --dport 80 -s 192.168.1.222 </div><div dir="auto">iptables -t mangle -A PREROUTING -j MARK --set-ma</div><div dir="auto">rk 3 -p tcp --dport 80 </div><div dir="auto">iptables -t mangle -A PREROUTING -j ACCEPT -p tcp</div><div dir="auto"> --dport 443 -s 192.168.1.222 </div><div dir="auto">iptables -t mangle -A PREROUTING -j MARK --set-ma</div><div dir="auto">rk 3 -p tcp --dport 443 </div><div dir="auto">ip rule add fwmark 3 table 2 </div><div dir="auto">ip route add default via 192.168.1.222 dev eth0.2</div><div dir="auto"> table 2</div><div dir="auto"><br></div><div dir="auto">on the squid box redirected it via</div><div dir="auto"><br></div><div dir="auto"><div dir="auto">iptables -A PREROUTING -t nat -i eth0 -p tcp --dp</div><div dir="auto">ort 443 -j REDIRECT --to-port 3129 </div><div dir="auto"> </div><div dir="auto">iptables -A PREROUTING -t nat -i eth0 -p tcp --dp</div><div dir="auto">ort 80 -j REDIRECT --to-port 3128</div></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">http works fine</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">https brings:</div><div dir="auto"><br></div><div dir="auto"><div style="font-family:verdana,sans-serif;margin-left:15px;padding:10px 10px 10px 100px;background-image:initial;background-position:left center;background-size:initial;background-repeat:no-repeat;background-origin:initial;background-clip:initial;color:rgb(30,30,30);font-size:12px" dir="auto"><h1 style="color:rgb(0,0,0)">ERROR</h1><h2 style="color:rgb(0,0,0)">The requested URL could not be retrieved</h2></div><hr style="font-family:verdana,sans-serif;margin:0px;color:rgb(30,30,30);font-size:12px"><div style="font-family:verdana,sans-serif;padding:10px;background:rgb(255,255,255);color:rgb(30,30,30);font-size:12px" dir="auto"><p>The following error was encountered while trying to retrieve the URL: <a href="https://192.168.1.222/*" target="_blank">https://192.168.1.222/*</a></p><blockquote><p><b>Connection to 192.168.1.222 failed.</b></p></blockquote><p>The system returned: <i>(111) Connection refused</i></p><p>The remote host or network may be down. Please try the request again.</p><p>Your cache administrator is <a href="mailto:webmaster?subject=CacheErrorInfo%20-%20ERR_CONNECT_FAIL&body=CacheHost%3A%20raspberrypi%0D%0AErrPage%3A%20ERR_CONNECT_FAIL%0D%0AErr%3A%20%28111%29%20Connection%20refused%0D%0ATimeStamp%3A%20Sun,%2012%20Nov%202017%2011%3A44%3A04%20GMT%0D%0A%0D%0AClientIP%3A%20192.168.1.200%0D%0AServerIP%3A%20192.168.1.222%0D%0A%0D%0AHTTP%20Request%3A%0D%0ACONNECT%20%2F%20HTTP%2F1.1%0AHost%3A%20192.168.1.222%0D%0A%0D%0A%0D%0A" target="_blank">webmaster</a>.</p><p><br></p><p><br></p><p><br></p><p>i had this working a while ago but i forget how.</p></div></div><div dir="auto"><br></div></div></div><div class="m_2623675589516299945elided-text"><div class="gmail_extra"><br><div class="gmail_quote">Am 08.11.2017 05:32 schrieb "Amos Jeffries" <<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 08/11/17 04:52, snable snable wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello<br>
<br>
i forward from.my openwrt router the traffic for 443 and 80 to my squid box to port 3129 and 3128<br>
<br>
</blockquote>
<br>
What do you mean by "forward" ?<br>
<br>
Any dst-IP:port NAT operation *MUST* only happen on the Squid device itself or _later_ down the traffic path. Traffic must be *routed* to that Squid device.<br>
<br>
<br>
Amos<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/l<wbr>istinfo/squid-users</a><br>
</blockquote></div></div>
</div></blockquote></div><br></div></div>
</div></blockquote></div><br></div></div></div>