<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:10pt;color:#000000;font-family:Consolas,Courier,monospace;" dir="ltr">
<p><br>
</p>
Hello,
<div>With your comments and help I succesfully did the fwmark/routing intercept squid.</div>
<div><br>
</div>
<div>From what i read from the other examples, the only method to use if squid is not on the router is always using routes. Which means my squid MUST always be directly connected to the router.</div>
<div>Am I wrong ?</div>
<div><br>
</div>
<div>The only way that seems to be able to work if not directly connected is the wccp one which seems to use gre.</div>
<div><br>
</div>
<div>Thanks.<br>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> squid-users <squid-users-bounces@lists.squid-cache.org> de la part de Rafael Akchurin <rafael.akchurin@diladele.com><br>
<b>Envoyé :</b> vendredi 1 novembre 2019 07:35<br>
<b>À :</b> Amos Jeffries; squid-users@lists.squid-cache.org<br>
<b>Objet :</b> Re: [squid-users] Unsuccessful at using Squid v4 with intercept</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hello Sebastian, <br>
<br>
If you decide to go policy routing way as Amos suggested - please see the tutorial at
<a href="https://docs.diladele.com/tutorials/policy_based_routing_squid/index.html" id="LPlnk743478" previewremoved="true">
https://docs.diladele.com/tutorials/policy_based_routing_squid/index.html</a>
<div id="LPBorder_GT_15728719436950.3025755557019896" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15728719436930.5912611238606813" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_15728719436940.35358502710064466" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_15728719436940.24906324693178883"></div>
<div id="LPTitle_15728719436940.6461439015158936" style="top: 0px; color: rgb(36, 96, 118); font-weight: 400; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15728719436940.5260029242773925" href="https://docs.diladele.com/tutorials/policy_based_routing_squid/index.html" target="_blank" style="text-decoration: none;">Transparently filtering HTTPS with Squid and Policy Based Routing — Web Filter
for Your Network</a></div>
<div id="LPMetadata_15728719436940.9128842104461881" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
docs.diladele.com</div>
<div id="LPDescription_15728719436940.1206152969870431" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Detailed tutorial for setting up policy based routing intercept-style HTTPS filtering on Ubuntu 16 using Squid, iptables and Web Safety.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
Or <a href="https://docs.diladele.com/tutorials/web_filter_https_squid_cisco_wccp/index.html" id="LPlnk883667" previewremoved="true">
https://docs.diladele.com/tutorials/web_filter_https_squid_cisco_wccp/index.html</a> for WCCP.
<div id="LPBorder_GT_15728719437000.9769966180856129" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15728719436990.18265920753738873" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_15728719437000.07660274960536184" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_15728719437000.5126653604109761"></div>
<div id="LPTitle_15728719437000.8928560559584966" style="top: 0px; color: rgb(36, 96, 118); font-weight: 400; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15728719437000.12795952308437775" href="https://docs.diladele.com/tutorials/web_filter_https_squid_cisco_wccp/index.html" target="_blank" style="text-decoration: none;">Transparent HTTPS Web Filter with Squid, Cisco ASA and ICAP — Web Filter
for Your Network</a></div>
<div id="LPMetadata_15728719437000.7357786260697359" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
docs.diladele.com</div>
<div id="LPDescription_15728719437000.8876168130093225" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Step-by-step tutorial for enabling transparent HTTP and HTTPS filtering with Squid, Cisco ASA and Diladele Web Safety.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
<br>
Best regards,<br>
Rafael Akchurin<br>
Diladele B.V.<br>
<br>
-----Original Message-----<br>
From: squid-users <squid-users-bounces@lists.squid-cache.org> On Behalf Of Amos Jeffries<br>
Sent: Friday, 1 November 2019 07:02<br>
To: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] Unsuccessful at using Squid v4 with intercept<br>
<br>
On 1/11/19 5:53 am, FOUTREL Sébastien wrote:<br>
> ----------------------------------------------------------------------<br>
> --<br>
> *De :* Antony Stone<br>
> *Envoyé :* mercredi 30 octobre 2019 17:39<br>
> <br>
> On Wednesday 30 October 2019 at 17:11:29, FOUTREL Sébastien wrote:<br>
> <br>
>> Hello, I would like to use squid as a transparent proxy for my users.<br>
> <br>
>> "Clients" are behind a Debian "Router" which MASQUERADE them (as they <br>
>> use RFC 1918 ips).<br>
>> <br>
>> I have a Squid 4.6 from Debian Buster packages installed on a "Proxy"<br>
>> server which is outside my network.<br>
>> <br>
>> I read a lot of tutorials and examples from squid site...<br>
> <br>
> Did that include the links I've given below?<br>
> <br>
> Yes I read almost all examples config from wiki.squid-cache.org <br>
> <<a href="https://wiki.squid-cache.org/SquidFaq/InterceptionProxy" id="LPlnk731854" previewremoved="true">https://wiki.squid-cache.org/SquidFaq/InterceptionProxy</a>><br>
> <<a href="https://wiki.squid-cache.org/SquidFaq/InterceptionProxy" id="LPlnk560150" previewremoved="true">https://wiki.squid-cache.org/SquidFaq/InterceptionProxy</a>>And I was
<br>
> mislead by the fact that there is a DNAT config and a REDIRECT config..<br>
> DNAT is completely useless if Squid only support to be on the router.<br>
> Wasn't it possible to dnat to a different server with older versions <br>
> (my memory is faulty) ?<br>
> <a href="http://tldp.org/HOWTO/TransparentProxy-6.html" id="LPlnk127024" previewremoved="true">
http://tldp.org/HOWTO/TransparentProxy-6.html</a> for example.<br>
<br>
<br>
Squid-2 used to ignore all NAT errors and just go where the client HTTP headers were claiming to be going. This proved to be a major security vulnerability with a pile of nasty related issues and side effects.<br>
CVE-2009-0801 for reference.<br>
<br>
DNAT is a tiny amount faster and less CPU cycles on the kernel NAT side of interception, and can be used in config tricks to get more than 64K entries in the NAT tables. So it is kept around for extremely high-traffic proxies.<br>
<br>
REDIRECT is better for zero-conf installations or ones with a dynamic IP address on the proxy machine (eg IPv6 auto-conf and privacy addressing).<br>
<br>
<br>
> <br>
> I read the "fw mark and route policy" method as an alternative not the <br>
> only way to go. My mistake.<br>
> <br>
<br>
Easily made if you are reading *every* example config. Policy Routing _is_ an alternative ... to WCCP.<br>
<br>
There are so many different types of routers with different config requirements, and also numerous NAT systems. Our formal Intercept examples are laid out as separate router config example and NAT config example. Pick one from each category as appropriate to
the software your network uses for each machine.<br>
<br>
<br>
<br>
Cheers<br>
Amos<br>
_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" id="LPlnk815112" previewremoved="true">http://lists.squid-cache.org/listinfo/squid-users</a><br>
_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" id="LPlnk987793" previewremoved="true">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>