<html><head></head><body>Hi,<br>
<br>
Can you confirm that squid is able to resolve these hostnames? If not try browsing to them without https and check if squid gives you an error message.<br>
<br>
Did you check the cache.log as well?<br>
<br>
Br Enrico<br><br><div class="gmail_quote">Am 6. Dezember 2017 17:38:24 MEZ schrieb Hugo Saavedra <hugo.saavedra.oteiza@gmail.com>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi All,<br /><br />We have the following setup of a transparent squid box:<br />OS: CentOS release 6.9 (Final)<br />Squid Cache: Version 3.5.26-20170625-r14174<br />Compile options:<br /> '--with-included-ltdl' '--enable-icap-client'<br />'--enable-delay-pools' '--with-openssl' '--enable-ssl-crtd'<br />'--enable-icmp' '--enable-snmp' '--prefix=/usr'<br />'--includedir=/usr/include' '--datadir=/usr/share'<br />'--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid'<br />'--localstatedir=/var' '--sysconfdir=/etc/squid'<br />--enable-ltdl-convenience<br /><br />Endpoints are redirected to the Squid box using a policy route for<br />TCP80/443 on a Fortigate firewall. All http/80 traffic works well. We<br />are using ssl bump for ssl, but there is an strange behavior, some<br />websites opens well, but some ones breaks and getting TAG_NONE/503<br />errors in the access log:<br /><br />1512561423.930 1 <a href="http://192.168.1.108">192.168.1.108</a> TAG_NONE/503 31435 POST<br /><a href="https://api.chatlio.com/v1/p/visitor/session/new">https://api.chatlio.com/v1/p/visitor/session/new</a> - HIER_NONE/-<br />text/html<br />1512562220.870 1 <a href="http://192.168.1.158">192.168.1.158</a> TAG_NONE/503 12386 GET<br /><a href="https://tile-service.weather.microsoft.com/es-CL/livetile/front/-33.44,-70.65">https://tile-service.weather.microsoft.com/es-CL/livetile/front/-33.44,-70.65</a>?<br />- HIER_NONE/- text/html<br />1512562220.870 1 <a href="http://192.168.1.158">192.168.1.158</a> TAG_NONE/503 12386 GET<br /><a href="https://service.weather.microsoft.com/appex/DesktopTile/Badge">https://service.weather.microsoft.com/appex/DesktopTile/Badge</a>? -<br />HIER_NONE/- text/html<br />1512566858.355 186 <a href="http://192.168.1.104">192.168.1.104</a> TAG_NONE/503 31436 GET<br /><a href="https://www.mercantil.com/empresa/reac-importadora-spa/estaci%C3%B3n-central/300469639/esp">https://www.mercantil.com/empresa/reac-importadora-spa/estaci%C3%B3n-central/300469639/esp</a><br />- HIER_NONE/- text/html<br /><br />In the same time-range, other websites loads well<br /><br />1512561134.548 306 <a href="http://192.168.1.112">192.168.1.112</a> TCP_MISS/302 572 GET<br /><a href="https://loadm.exelator.com/load">https://loadm.exelator.com/load</a>/? - ORIGINAL_DST/<a href="http://63.251.252.12">63.251.252.12</a><br />image/gif<br />1512561139.701 216 <a href="http://192.168.1.148">192.168.1.148</a> TCP_MISS/200 386 POST<br /><a href="https://cloud-ecs.gravityzone.bitdefender.com/hydra">https://cloud-ecs.gravityzone.bitdefender.com/hydra</a>-<br />ORIGINAL_DST/<a href="http://107.20.215.8">107.20.215.8</a> application/json<br />1512561142.180 13 <a href="http://192.168.1.112">192.168.1.112</a> TCP_MISS/200 419 GET<br /><a href="https://www.facebook.com/tr">https://www.facebook.com/tr</a>/? - ORIGINAL_DST/<a href="http://179.60.193.35">179.60.193.35</a> image/gif<br />1512561142.410 243 <a href="http://192.168.1.112">192.168.1.112</a> TCP_MISS/200 286 GET<br /><a href="https://bam.nr-data.net/1/ef1706da28">https://bam.nr-data.net/1/ef1706da28</a>? - ORIGINAL_DST/<a href="http://162.247.242.21">162.247.242.21</a><br />text/javascript<br /><br /><br />IPTABLES CONFIGURATION<br />=======================<br /># PREROUTING INTERCEPT PBR<br /><br />*nat<br />:PREROUTING ACCEPT [0:0]<br />:POSTROUTING ACCEPT [0:0]<br />:OUTPUT ACCEPT [0:0]<br />-A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 3128<br />-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128<br />-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129<br />COMMIT<br /><br />*filter<br />:INPUT ACCEPT [0:0]<br />:FORWARD ACCEPT [0:0]<br />:OUTPUT ACCEPT [0:0]<br /><br />#WEB<br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 80 -j ACCEPT<br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 443 -j ACCEPT<br /><br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 3128 -j ACCEPT<br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 3129 -j ACCEPT<br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 3130 -j ACCEPT<br />-A INPUT -m state --state NEW,RELATED,ESTABLISHED -m tcp -p tcp<br />--dport 3131 -j ACCEPT<br /><br />#default<br />-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br />-A INPUT -p icmp -j ACCEPT<br />-A INPUT -i lo -j ACCEPT<br />-A INPUT -j REJECT --reject-with icmp-host-prohibited<br />-A FORWARD -j REJECT --reject-with icmp-host-prohibited<br />COMMIT<br /><br /><br />SQUID CONFIGURATION<br />====================<br /><br />#WHITE LIST<br />acl exclWL url_regex "/etc/squid/white_url.squid"<br />acl neoWL url_regex "/etc/squid/neowl.squid"<br />http_access allow exclWL<br />http_access allow neoWL<br />cache deny exclWL<br />cache deny neoWL<br />always_direct allow exclWL<br />always_direct allow neoWL<br /><br />#Malicious URLs<br />acl dom url_regex "/etc/squid/dom.squid"<br />acl cc url_regex "/etc/squid/cc.squid"<br />http_access deny dom<br />http_access deny cc<br /><br />#BLACK LIST<br />acl exclBL url_regex "/etc/squid/black_url.squid"<br />acl neoBL url_regex "/etc/squid/neobl.squid"<br />http_access deny exclBL<br />http_access deny neoBL<br /><br />#ACLS BASE<br />acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br />acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network<br />acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network<br />acl localnet src fc00::/7 # RFC 4193 local private network range<br />acl localnet src fe80::/10 # RFC 4291 link-local (directly<br />plugged) machines<br />acl SSL_ports port 443<br />acl SSL_ports port 3129<br />acl Safe_ports port 80 # http<br />acl Safe_ports port 21 # ftp<br />acl Safe_ports port 443 # https<br />acl Safe_ports port 70 # gopher<br />acl Safe_ports port 210 # wais<br />acl Safe_ports port 1025-65535 # unregistered ports<br />acl Safe_ports port 280 # http-mgmt<br />acl Safe_ports port 488 # gss-http<br />acl Safe_ports port 591 # filemaker<br />acl Safe_ports port 777 # multiling http<br />acl CONNECT method CONNECT<br />acl HTTPS proto HTTPS<br /><br />include /etc/squid/acls_whitelist.conf<br />acl useragent browser "/etc/squid/useragent.squid"<br />range_offset_limit 0 !useragent<br />minimum_object_size 0 bytes<br />maximum_object_size 3 GB<br />quick_abort_min -1<br />delay_pools 1<br />delay_class 1 1<br />delay_parameters 1 128000/128000<br />delay_access 1 deny SSL_ports<br />delay_access 1 allow !useragent<br />delay_access 1 deny all<br /><br />#cache conf<br />max_filedescriptors 24576<br />memory_cache_mode disk<br />cache_mem 0 MB<br />cache allow all<br />minimum_object_size 0 bytes<br />maximum_object_size 20 MB<br />sslproxy_flags DONT_VERIFY_PEER<br />connect_timeout 8 seconds<br /><br />http_access deny !Safe_ports<br />http_access deny CONNECT !SSL_ports<br />http_access allow localhost manager<br />http_access deny manager<br />http_access allow localnet<br />http_access allow localhost<br />http_access deny all<br />reply_header_access Alternate-Protocol deny all<br /><br />http_port 3130<br />http_port 3131 ssl-bump cert=/etc/squid/ssl_cert/SIC.pem<br />generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br />http_port 3128 intercept<br />https_port 3129 intercept ssl-bump generate-host-certificates=on<br />dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl_cert/SIC.pem<br /><br />cache_dir ufs /var/cache/squid 9000 16 256<br />cache_store_log /var/log/squid/store.log<br />cache_effective_user squid<br />visible_hostname Proxy<br /><br />refresh_pattern ^ftp: 1440 20% 10080<br />refresh_pattern ^gopher: 1440 0% 1440<br />refresh_pattern -i (/cgi-bin/|\?) 2 20% 10<br />refresh_pattern . 2 20% 10 ignore-reload<br />override-expire ignore-no-cache ignore-no-store store-stale<br />ignore-private ignore-must-revalidate ignore-auth<br />refresh_pattern -i<br />\.(dmg|msi|deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff|pdf)$ 1<br />20% 4 override-expire ignore-no-cache ignore-no-store ignore-private<br />reload-into-ims<br /><br /><br />#SSL BUMP<br />include /etc/squid/ssl.conf<br /><br />#LOGGING<br />access_log /var/log/squid/access.log<br />access_log /var/log/squid/access_c2.log cc<br />access_log /var/log/squid/access_c2.log dom<br />access_log /var/log/squid/splc.log excludeSSL<br />cache_log /dev/null<br />coredump_dir /var/cache/squid<br /><br />#ICAP<br />icap_enable on<br />icap_send_client_ip on<br />icap_send_client_username on<br />icap_client_username_header X-Authenticated-User<br />icap_service service_req reqmod_precache bypass=1<br />icap://<a href="127.0.0.1:1344/squidclamav">127.0.0.1:1344/squidclamav</a><br />adaptation_access service_req allow useragent<br />icap_service service_resp respmod_precache bypass=1<br />icap://<a href="127.0.0.1:1344/squidclamav">127.0.0.1:1344/squidclamav</a><br />adaptation_access service_resp allow useragent<br /><br />#X FORWARDED FOR<br />forwarded_for on<br /><br />SSL.conf<br />=======<br /><br />sslproxy_foreign_intermediate_certs /etc/squid/intermediate_ca.pem<br />sslproxy_cafile /etc/squid/intermediate_ca.pem<br />sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 16MB<br />sslcrtd_children 16 startup=5 idle=1<br /><br />acl FakeCert ssl::server_name .<a href="http://apple.com">apple.com</a><br />acl FakeCert ssl::server_name .<a href="http://icloud.com">icloud.com</a><br />acl FakeCert ssl::server_name .<a href="http://mzstatic.com">mzstatic.com</a><br />acl FakeCert ssl::server_name .<a href="http://dropbox.com">dropbox.com</a><br />acl ssl_step1 at_step SslBump1<br />acl ssl_step2 at_step SslBump2<br />acl ssl_step3 at_step SslBump3<br /><br />ssl_bump peek ssl_step1<br />ssl_bump splice GlobalWhitelistDSTNet<br />ssl_bump splice GlobalWhitelistDomainsRx<br />ssl_bump splice GlobalWhitelistDomains<br />ssl_bump splice FakeCert<br />ssl_bump bump ssl_step2 all<br />ssl_bump splice all<br />sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression<br />sslproxy_cipher<br />ALL:!SSLv2:!SSLv3:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL<br />sslproxy_flags DONT_VERIFY_PEER<br />sslproxy_cert_error allow all<br />sslproxy_cert_error deny all<br /><br />acls_whitelist.conf<br />=============<br /><br />acl WindowsUpdates dstdomain <a href="http://officecdn.microsoft.com">officecdn.microsoft.com</a><br />acl WindowsUpdates dstdomain <a href="http://windowsupdate.microsoft.com">windowsupdate.microsoft.com</a><br />acl WindowsUpdates dstdomain <a href="http://ntservicepack.microsoft.com">ntservicepack.microsoft.com</a><br />acl WindowsUpdates dstdomain <a href="http://download.microsoft.com">download.microsoft.com</a><br />acl WindowsUpdates dstdomain .<a href="http://windowsupdate.com">windowsupdate.com</a><br />acl WindowsUpdates dstdomain .<a href="http://windowsupdate.net">windowsupdate.net</a><br />acl WindowsUpdates dstdomain .<a href="http://update.microsoft.com">update.microsoft.com</a><br />acl WindowsUpdates dstdomain .<a href="http://mp.microsoft.com">mp.microsoft.com</a><br />acl WindowsUpdates dstdomain .<a href="http://ws.microsoft.com">ws.microsoft.com</a><br />acl GlobalWhitelistDomains dstdomain "/etc/squid/acls_whitelist.dstdomain.conf"<br />acl GlobalWhitelistDSTNet dst "/etc/squid/acls_whitelist.dst.conf"<br />acl GlobalWhitelistDomainsRx dstdom_regex -i<br />"/etc/squid/acls_whitelist.dstdom_regex.conf"<br />acl GlobalWhitelistBrowsers browser -i "/etc/squid/acls_whitelist.browser.conf"<br />http_access allow GlobalWhitelistDomains<br />url_rewrite_access deny GlobalWhitelistDomains<br />http_access allow GlobalWhitelistDSTNet<br />url_rewrite_access deny GlobalWhitelistDSTNet<br />http_access allow GlobalWhitelistDomainsRx<br />url_rewrite_access deny GlobalWhitelistDomainsRx<br />http_access allow GlobalWhitelistBrowsers<br /><br /><br />Any one with the same TAG_NONE/503 error, please help!?<br /><br />Regards,<br />Hugo<br /><hr /><br />squid-users mailing list<br />squid-users@lists.squid-cache.org<br /><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br /></pre></blockquote></div><br>
-- <br>
Diese Nachricht wurde von meinem Android-Gerät mit K-9 Mail gesendet.</body></html>