<div dir="ltr">Dear Amos,<div>Sorry for concluded hurriedly.</div><div>When i do a test with 1 user, it's seem ok, no more Aler from cache.log. But when i test with more users, the Alert log from cache.log happen again. And so i can't access some https page as <a href="http://chatwork.com">chatwork.com</a> , <a href="http://facebook.com">facebook.com</a></div><div><br></div><div><div>2017/11/29 18:06:41 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://54.238.137.130:443">54.238.137.130:443</a> remote=<a href="http://172.16.255.10:61831">172.16.255.10:61831</a> FD 131 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:06:41 kid1| SECURITY ALERT: on URL: <a href="http://www.chatwork.com:443">www.chatwork.com:443</a></div><div>2017/11/29 18:06:48 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://31.13.95.8:443">31.13.95.8:443</a> remote=<a href="http://172.16.255.51:54984">172.16.255.51:54984</a> FD 173 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:06:48 kid1| SECURITY ALERT: on URL: <a href="http://api.facebook.com:443">api.facebook.com:443</a></div><div>2017/11/29 18:08:07 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://31.13.95.12:443">31.13.95.12:443</a> remote=<a href="http://172.16.255.51:54990">172.16.255.51:54990</a> FD 51 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:08:07 kid1| SECURITY ALERT: on URL: <a href="http://static.xx.fbcdn.net:443">static.xx.fbcdn.net:443</a></div><div>2017/11/29 18:08:50 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://172.217.24.197:443">172.217.24.197:443</a> remote=<a href="http://172.16.255.10:61866">172.16.255.10:61866</a> FD 34 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:08:50 kid1| SECURITY ALERT: on URL: <a href="http://mail.google.com:443">mail.google.com:443</a></div><div>2017/11/29 18:09:43 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://13.113.80.172:443">13.113.80.172:443</a> remote=<a href="http://172.16.255.10:61890">172.16.255.10:61890</a> FD 124 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:09:43 kid1| SECURITY ALERT: on URL: <a href="http://ws-chatwork.pusher.com:443">ws-chatwork.pusher.com:443</a></div><div>2017/11/29 18:10:59 kid1| WARNING: 1 swapin MD5 mismatches</div><div>2017/11/29 18:11:00 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://157.240.15.22:443">157.240.15.22:443</a> remote=<a href="http://172.16.255.51:55032">172.16.255.51:55032</a> FD 93 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:11:00 kid1| SECURITY ALERT: on URL: <a href="http://connect.facebook.net:443">connect.facebook.net:443</a></div><div>2017/11/29 18:13:15 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://31.13.95.36:443">31.13.95.36:443</a> remote=<a href="http://172.16.255.12:33158">172.16.255.12:33158</a> FD 25 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:13:15 kid1| SECURITY ALERT: on URL: <a href="http://www.facebook.com:443">www.facebook.com:443</a></div><div>2017/11/29 18:14:00 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://31.13.95.34:443">31.13.95.34:443</a> remote=<a href="http://172.16.255.59:39526">172.16.255.59:39526</a> FD 74 flags=33 (local IP does not match any domain IP)</div><div>2017/11/29 18:14:00 kid1| SECURITY ALERT: on URL: <a href="http://mqtt-mini.facebook.com:443">mqtt-mini.facebook.com:443</a></div></div><div><br></div><div><br></div><div>I have a Mikrotik router (172.16.1.1), and some Lan Local. With every Lan, my DHCP allocates DNS, gateway to my LAN. Ext : <a href="http://172.16.255.0/24">172.16.255.0/24</a> with gateway : 172.16.255.254 and DNS 172.16.255.254</div><div>- Mikrotik config with Cache DNS from 8.8.8.8</div><div>- Squid use DNS 172.16.1.1 ( Mikrotik DNS)</div><div>- Squid config DNS to 172.16.1.1</div><div>- Client use DNS allocated by DHCP (but there is still Mikrotik router)<br><div class="gmail_extra"><br></div><div class="gmail_extra">Here is my full squid.conf :</div><div class="gmail_extra"><div class="gmail_extra"><br></div><div class="gmail_extra">#Allollow LAN Network</div><div class="gmail_extra"><br></div><div class="gmail_extra"># Allow Network ACL Allow/Deny Section#</div><div class="gmail_extra">acl SSL_ports port 443</div><div class="gmail_extra">acl Safe_ports port 80</div><div class="gmail_extra">acl Safe_ports port 443</div><div class="gmail_extra">acl Safe_ports port 1025-65535</div><div class="gmail_extra"><br></div><div class="gmail_extra">acl CONNECT method CONNECT</div><div class="gmail_extra">acl fb dstdomain .<a href="http://facebook.com">facebook.com</a></div><div class="gmail_extra"><br></div><div class="gmail_extra">#http_access deny CONNECT fb</div><div class="gmail_extra"><br></div><div class="gmail_extra">http_access allow localhost</div><div class="gmail_extra">http_access allow all</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"># Transparent Proxy Parameters</div><div class="gmail_extra">http_port 3130</div><div class="gmail_extra">http_port 3128 intercept</div><div class="gmail_extra">https_port 3129 intercept ssl-bump generate-host-certificates=off cert=/etc/squid/ssl_cert/squid-3.5.27.pem</div><div class="gmail_extra"><br></div><div class="gmail_extra">### SSL config ###</div><div class="gmail_extra">#-Start-#</div><div class="gmail_extra">#ssl_bump none all</div><div class="gmail_extra"> acl step1 at_step SslBump1</div><div class="gmail_extra"> ssl_bump peek step1</div><div class="gmail_extra"> ssl_bump splice all</div><div class="gmail_extra">#-End-#</div><div class="gmail_extra"><br></div><div class="gmail_extra"># --------- Add X-Forwarded-for in headers [0]? </div><div class="gmail_extra">#-Start-#</div><div class="gmail_extra">forwarded_for transparent</div><div class="gmail_extra">#-End-#</div><div class="gmail_extra"><br></div><div class="gmail_extra">debug_options ALL,1</div><div class="gmail_extra"><br></div><div class="gmail_extra">log_fqdn on</div><div class="gmail_extra">emulate_httpd_log on</div><div class="gmail_extra">icap_enable on</div><div class="gmail_extra"><br></div><div class="gmail_extra">global_internal_static on</div><div class="gmail_extra">short_icon_urls on</div><div class="gmail_extra">log_uses_indirect_client on</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"># --------- DNS AND IP CACHES [4341]</div><div class="gmail_extra"><br></div><div class="gmail_extra">dns_nameservers 172.16.1.1</div><div class="gmail_extra">dns_v4_first on</div><div class="gmail_extra">host_verify_strict off</div><div class="gmail_extra">ignore_unknown_nameservers off</div><div class="gmail_extra">dns_timeout 120 seconds</div><div class="gmail_extra">ipcache_size 1024</div><div class="gmail_extra">ipcache_low 90</div><div class="gmail_extra">ipcache_high 95</div><div class="gmail_extra">fqdncache_size 1024</div><div class="gmail_extra">positive_dns_ttl 6 hours</div><div class="gmail_extra">negative_dns_ttl 300 seconds</div><div>---------------------------------------------------------</div><div><br></div><div>Could you please help me . Thanks & Best Regards,</div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-11-28 17:32 GMT+07:00 minh hưng đỗ hoàng <span dir="ltr"><<a href="mailto:hoangminhung@gmail.com" target="_blank">hoangminhung@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail-m_-1972446421718366689gmail_signature"><div dir="ltr"><div><div dir="ltr"><div class="gmail_extra">Dear Amos,</div><div class="gmail_extra">I solved my problem by following this :</div><div class="gmail_extra">1 - I used my Mikrotik router as a cache DNS</div><div class="gmail_extra">2 - Both Squid proxy and my client use Mikrotik' DNS</div><div class="gmail_extra"><br></div><div class="gmail_extra">=> It no more take alert from cache.log</div><div class="gmail_extra"><br></div><div class="gmail_extra">Thanks alot :)</div><span class="gmail-">-- <br><div class="gmail-m_-1972446421718366689gmail_signature"><div dir="ltr"><div dir="ltr"><div><div><div>Thanks & Best Regards,<br>--------------<br></div>Đỗ Hoàng Minh Hưng<br></div>Gmail : <a href="mailto:hoangminhung@gmail.com" target="_blank">hoangminhung@gmail.com</a><br></div>SĐT : 01234454115</div></div></div></span></div></div></div></div>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div><div>Thanks & Best Regards,<br>--------------<br></div>Đỗ Hoàng Minh Hưng<br></div>Gmail : <a href="mailto:hoangminhung@gmail.com" target="_blank">hoangminhung@gmail.com</a><br></div>SĐT : 01234454115<br></div></div></div></div>
</div></div></div>