<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FR link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText><span lang=EN-US>Hello !<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>We have encountered what we think is a strange behavior of Squid when in interception. We know that it's not a bug but made on purpose, but we question ourself on the why of this choice.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>We have a firewall that we have configured to redirect all TCP packets with the destination port set to 80 to the squid box. This redirection is made by changing the destination IP to the address of the Squid box and destination port to 8080. On the box, we set up Squid to listen to port 9090 in interception mode. Moreover, we use some DNAT rules to redirect the traffic from port 8080 to port 9090. Yes, we know that we shouldn't do that, but "we" includes some third parties.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>This does not work because Squid takes the destination IP address and try to connect to it. In our case, it tries to connect to itself port 8080 to join the destination HTTP host, where nothing is listening, rejecting the connection and aborting the transaction. There is no process listening on port 8080 on the Squid box.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>In detail :<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- the box receives the TCP packets and translates traffic from port 8080 to port 9090 in either directions (it works well).<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Squid receives an HTTP request<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Squid does a DNS request on the domain included in the HTTP request (the destination HTTP host)<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Squid tries to connect to the destination IP address of the first packet, in our case the address of the box, instead of the IP got from the DNS request (this is the unexpected behavior)<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- The kernel rejects the connection (as expected)<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Squid answers back a connection failure.<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>My questions are :<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- why Squid uses the destination IP instead of the IP of the requested domain included in the HTTP request ?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- why Squid performs a DNS request if it doesn't plan to use its result ?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Is there a way to configure Squid to use the IP of the domain included in the request instead of the original IP address (in interception mode) ?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Is there a way to enable a Squid port to react as in interception mode, but without looking for the original IP address ?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US>- Does translating addresses and ports are inherently a bad practice to avoid when doing interception, or is it just a limitation of Squid ?<o:p></o:p></span></p><p class=MsoPlainText><span lang=EN-US><o:p> </o:p></span></p><p class=MsoPlainText><span lang=EN-US>Thanks for all your answers :-)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></body></html>