<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="auto">Hi Rafael, <br></div><div>First off i'd like to thank you for the link you provided, it was really helpful.<br></div><div>I've successfully installed squid and routed the traffic to the proxy thanks to the diladele link, unfortunately i couldn't install websafety as ubuntu removed squid 4.1-1 from their repo and had 4.3-1, i tried with 4.3 but there were problems with websafety... so installed squid 3.5 from source with ssl enabled, I used the websafety squid.conf as reference, now i have my proxy working, and i have connected greasyspoon to it, but greasyspoon only adapts http content, how do i get it to adapt https traffic? and this is assuming the ssl_bumping works, because i don't know how to confirm if it does, i see https connections in the access.log though.</div><div><br></div><div>please see attached my squid.conf</div><div>cache_effective_user proxy<br>acl localnet src <a href="http://10.0.0.0/24">10.0.0.0/24</a><br>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a><br>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a><br>acl localnet src fc00::/7<br>acl localnet src fe80::/10<br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br>acl CONNECT method CONNECT<br>http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/opt/websafety/etc/myca.pem<br>http_port 3126 intercept<br>https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/opt/websafety/etc/myca.pem<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access allow localhost manager<br>http_access deny manager<br>http_access allow localnet<br>http_access allow localhost<br>http_access deny all<br>sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /var/spool/squid_ssldb -M 4MB<br>acl step1 at_step SslBump1<br>acl step2 at_step SslBump2<br>acl step3 at_step SslBump3<br>ssl_bump peek step1 all<br>ssl_bump bump all<br>ssl_bump bump ssl_force_bump<br>ssl_bump splice localhost<br>acl ssl_error_domains dstdomain "/opt/websafety/etc/squid/ssl/error/domains.conf"<br>acl ssl_error_ips dst "/opt/websafety/etc/squid/ssl/error/ips.conf"<br>acl ssl_error_ips dst "/opt/websafety/etc/squid/ssl/error/subnets.conf"<br>sslproxy_cert_error allow ssl_error_domains<br>sslproxy_cert_error allow ssl_error_ips<br>shutdown_lifetime 10 seconds<br>adaptation_access greasyspoon allow all<br>visible_hostname proxy.example.lan<br>acl cache_exclude_domainname dstdomain "/opt/websafety/etc/squid/cache/exclude/domain_name.conf"<br>acl cache_exclude_domainaddr dst "/opt/websafety/etc/squid/cache/exclude/domain_ip.conf"<br>acl cache_exclude_domainaddr dst "/opt/websafety/etc/squid/cache/exclude/domain_subnet.conf"<br>acl cache_exclude_domainaddr dst "/opt/websafety/etc/squid/cache/exclude/domain_range.conf"<br>acl cache_exclude_useraddr src "/opt/websafety/etc/squid/cache/exclude/user_ip.conf"<br>acl cache_exclude_useraddr src "/opt/websafety/etc/squid/cache/exclude/user_subnet.conf"<br>acl cache_exclude_useraddr src "/opt/websafety/etc/squid/cache/exclude/user_range.conf"<br>acl cache_exclude_useragent browser -i "/opt/websafety/etc/squid/cache/exclude/user_agent.conf"<br>acl cache_exclude_schedule time "/opt/websafety/etc/squid/cache/exclude/schedule.conf"<br>cache deny cache_exclude_domainname<br>cache deny cache_exclude_domainaddr<br>cache deny cache_exclude_useraddr<br>cache deny cache_exclude_useragent<br>cache deny cache_exclude_schedule<br>acl cache_exclude_contenttype rep_mime_type "/opt/websafety/etc/squid/cache/exclude/content_type.conf"<br>send_hit deny cache_exclude_contenttype<br>store_miss deny cache_exclude_contenttype<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br>cache_replacement_policy lru<br>minimum_object_size 0 KB<br>maximum_object_size 4096 KB<br>dns_timeout 30 seconds<br>dns_v4_first on<br>icap_enable on<br>icap_preview_enable off<br>icap_preview_size 2048<br>icap_persistent_connections on<br>adaptation_send_client_ip on<br>adaptation_send_username on<br>icap_service greasyspoon respmod_precache icap://<a href="http://127.0.0.1:1344/response">127.0.0.1:1344/response</a> bypass=0<br>cache_mem 256 MB<br>maximum_object_size_in_memory 512 KB<br>memory_replacement_policy lru<br>forwarded_for on<br>forward_max_tries 25<br></div><div><br></div><div><br></div><div>also part of my access.log</div><div>1540473704.606 1021 10.0.0.250 TAG_NONE/200 0 CONNECT <a href="http://52.97.133.226:443">52.97.133.226:443</a> - HIER_NONE/- -<br>1540473711.552 465997 10.0.0.254 TCP_TUNNEL/200 4350 CONNECT <a href="http://outlook.office365.com:443">outlook.office365.com:443</a> - ORIGINAL_DST/<a href="http://52.97.131.242">52.97.131.242</a> -<br>1540473711.552 163713 10.0.0.254 TCP_TUNNEL/200 4320 CONNECT <a href="http://inbox.google.com:443">inbox.google.com:443</a> - ORIGINAL_DST/<a href="http://216.58.223.197">216.58.223.197</a> -<br>1540473711.552 163689 10.0.0.254 TCP_TUNNEL/200 4231 CONNECT <a href="http://inbox.google.com:443">inbox.google.com:443</a> - ORIGINAL_DST/<a href="http://216.58.223.197">216.58.223.197</a> -<br></div><div><br></div><div>and part of my cache.log</div><div>2018/10/25 11:36:21 kid1| Accepting SSL bumped HTTP Socket connections at local=[::]:3128 remote=[::] FD 22 flags=9<br>2018/10/25 11:36:21 kid1| Accepting NAT intercepted HTTP Socket connections at local=[::]:3126 remote=[::] FD 23 flags=41<br>2018/10/25 11:36:21 kid1| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=[::]:3127 remote=[::] FD 24 flags=41<br>2018/10/25 11:36:22 kid1| storeLateRelease: released 0 objects<br>2018/10/25 11:42:08| Squid is already running! Process ID 3497<br>2018/10/25 11:46:20| Squid is already running! Process ID 3497<br>2018/10/25 11:46:24| Squid is already running! Process ID 3497<br>2018/10/25 11:49:32 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://52.97.133.178:443">52.97.133.178:443</a> remote=<a href="http://10.0.0.250:39627">10.0.0.250:39627</a> FD 39 flags=33 (local IP does not match any domain IP)<br>2018/10/25 11:49:32 kid1| SECURITY ALERT: on URL: <a href="http://outlook.office365.com:443">outlook.office365.com:443</a><br>2018/10/25 11:49:32 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://52.97.133.178:443">52.97.133.178:443</a> remote=<a href="http://10.0.0.250:39628">10.0.0.250:39628</a> FD 39 flags=33 (local IP does not match any domain IP)<br>2018/10/25 11:49:32 kid1| SECURITY ALERT: on URL: <a href="http://outlook.office365.com:443">outlook.office365.com:443</a><br>2018/10/25 11:49:32 kid1| SECURITY ALERT: Host header forgery detected on local=<a href="http://52.97.133.178:443">52.97.133.178:443</a> remote=<a href="http://10.0.0.250:39629">10.0.0.250:39629</a> FD 39 flags=33 (local IP does not match any domain IP)<br></div><div><br></div><div><br></div><div>please how do i get the adaptation to work for https traffic?</div><div>Thanks for everyones help.<br></div><div><br></div><div><br></div><div dir="auto"><div dir="auto"><br></div><div dir="auto"><br><div dir="auto">Uchenna Nebedum</div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Oct 19, 2018, 20:09 Rafael Akchurin <<a href="mailto:rafael.akchurin@diladele.com" target="_blank">rafael.akchurin@diladele.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="en-NL" link="blue" vlink="purple">
<div class="m_2407144791366847126m_-3087360823763071257WordSection1">
<p class="MsoNormal"><span lang="EN-US">Yes you can use any ICAP/eCAP server you like, just adjust the docs as required and that is it.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Uchenna Nebedum <<a href="mailto:nebeduch@gmail.com" rel="noreferrer" target="_blank">nebeduch@gmail.com</a>>
<br>
<b>Sent:</b> Friday, 19 October 2018 20:17<br>
<b>To:</b> Rafael Akchurin <<a href="mailto:rafael.akchurin@diladele.com" rel="noreferrer" target="_blank">rafael.akchurin@diladele.com</a>><br>
<b>Cc:</b> <a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
<b>Subject:</b> Re: [squid-users] ERROR: NAT/TPROXY lookup failed to locate original IPs on local<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Thanks a lot Rafael, I've gone through the documentation it looks to be very promising, one reservation i have is I want to use greasyspoon for icap and i see ecap is implemented already. I intend to install everything as suggested on the
link, then after this change squid.conf to remove ecap connection.<u></u><u></u></p>
<div>
<p class="MsoNormal">Please, I hope this will work? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Thanks a lot again for the link, it really explained everything well enough for a beginner.<u></u><u></u></p>
<div>
<p class="MsoNormal">Uchenna Nebedum<u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Oct 19, 2018, 18:30 Rafael Akchurin <<a href="mailto:rafael.akchurin@diladele.com" rel="noreferrer" target="_blank">rafael.akchurin@diladele.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hello Uchenna,</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">May be this policy based routing with Mikrotik tutorial will be of any use</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">See
<a href="https://docs.diladele.com/tutorials/mikrotik_transparent_squid/index.html" rel="noreferrer" target="_blank">
https://docs.diladele.com/tutorials/mikrotik_transparent_squid/index.html</a></span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Best regards,</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Rafael Akchurin</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Diladele B.V.</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" rel="noreferrer" target="_blank">squid-users-bounces@lists.squid-cache.org</a>>
<b>On Behalf Of </b>Uchenna Nebedum<br>
<b>Sent:</b> Friday, 19 October 2018 18:42<br>
<b>To:</b> <a href="mailto:squid-users@lists.squid-cache.org" rel="noreferrer" target="_blank">squid-users@lists.squid-cache.org</a><br>
<b>Subject:</b> [squid-users] ERROR: NAT/TPROXY lookup failed to locate original IPs on local</span><span lang="en-NL"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="en-NL"> <u></u><u></u></span></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="en-NL">Good Day All,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">i'm new to squid and i have configured squid as an http transparent proxy with a mikrotik.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">the squid server has only a single NIC, so i followed a tutorial and set up a dst-nat to squid proxy for traffic on port 80,
<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">Chain:dstnat.
<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">Protocol:tcp<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">Dst-port:80
<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">Action:dst-nat<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">To Addresses:192.168.2.2 (squid proxy)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">To ports:8080<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">but after setup, only https traffic works correctly,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">http traffic client error is "This page isn't working ERR_EMPTY_RESPONSE"<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">squid access.log is empty then in squid cache.log these are the errors<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">```<u></u><u></u></span></p>
</div>
<div>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span lang="en-NL">2018/10/19 17:08:54 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=<a href="http://192.168.2.2:8080" rel="noreferrer" target="_blank">192.168.2.2:8080</a> remote=<a href="http://192.168.1.254:41248" rel="noreferrer" target="_blank">192.168.1.254:41248</a>
FD 10 flags=33: (92) Protocol not available<br>
2018/10/19 17:08:54 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=<a href="http://192.168.2.2:8080" rel="noreferrer" target="_blank">192.168.2.2:8080</a> remote=<a href="http://192.168.1.254:41248" rel="noreferrer" target="_blank">192.168.1.254:41248</a> FD 10 flags=33<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="en-NL">```<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">please find below my squid.conf contents<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">```<u></u><u></u></span></p>
</div>
<div>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span lang="en-NL">acl localnet src
<a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a> <br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 <br>
acl Safe_ports port 21 <br>
acl Safe_ports port 443 <br>
acl Safe_ports port 70 <br>
acl Safe_ports port 210 <br>
acl Safe_ports port 1025-65535 <br>
acl Safe_ports port 280 <br>
acl Safe_ports port 488 <br>
acl Safe_ports port 591 <br>
acl Safe_ports port 777 <br>
acl CONNECT method CONNECT<br>
icap_enable off<br>
icap_service service_req reqmod_precache 1 icap://<a href="http://127.0.0.1:1344/REQMOD" rel="noreferrer" target="_blank">127.0.0.1:1344/REQMOD</a><br>
adaptation_service_set class_req service_req<br>
adaptation_access class_req allow all<br>
icap_service service_resp respmod_precache 0 icap://<a href="http://127.0.0.1:1344/RESPMOD" rel="noreferrer" target="_blank">127.0.0.1:1344/RESPMOD</a><br>
adaptation_service_set class_resp service_resp<br>
adaptation_access class_resp allow all<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access allow localhost manager<br>
http_access deny manager<br>
http_access deny to_localhost<br>
http_access allow localnet<br>
http_access allow localhost<br>
http_access allow all<br>
http_port 3128<br>
http_port 8080 transparent<br>
access_log daemon:/var/log/squid/access.log squid<br>
coredump_dir /var/spool/squid<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880<br>
refresh_pattern . 0 20% 4320<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="en-NL">```<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="en-NL">please any help or correction would be highly appreciated, i am not even sure if the approach is correct.<u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="en-NL"><br>
-- <u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="en-NL">Nebedum Uchenna<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>