<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>Thank you Amos Jeffries and Antony Stone. It seems the
configuration I have provides the functionality of filtering I am
looking for.</p>
<p>There is a strange behavior I can see when accessing some
legitimate sites which I see traces of in cache.log :</p>
<blockquote>
<p>2021/01/02 10:55:48 kid1| helperOpenServers: Starting 1/20
'squidGuard' processes<br>
2021/01/02 10:57:31 kid1| ERROR: negotiating TLS on FD 39:
error:1407743E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert
inappropriate fallback (1/-1/0)<br>
2021/01/02 10:57:31 kid1| Error negotiating SSL connection on FD
38: error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
2021/01/02 10:57:32 kid1| ERROR: negotiating TLS on FD 38:
error:1407743E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert
inappropriate fallback (1/-1/0)<br>
2021/01/02 10:57:32 kid1| Error negotiating SSL connection on FD
35: error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
2021/01/02 10:57:40 kid1| Starting new redirector helpers...<br>
2021/01/02 10:57:40 kid1| helperOpenServers: Starting 1/20
'squidGuard' processes<br>
2021/01/02 10:58:09 kid1| ERROR: negotiating TLS on FD 51:
error:1407743E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert
inappropriate fallback (1/-1/0)<br>
2021/01/02 10:58:09 kid1| Error negotiating SSL connection on FD
40: error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
2021/01/02 10:58:10 kid1| ERROR: negotiating TLS on FD 51:
error:1407743E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert
inappropriate fallback (1/-1/0)<br>
2021/01/02 10:58:10 kid1| Error negotiating SSL connection on FD
40: error:00000001:lib(0):func(0):reason(1) (1/-1)<br>
</p>
</blockquote>
<p>I noticed other users of squid encountered similar issues but I
did not find a clear answer to the issue. Is there a problem with
my setup ? I am not sure to be able to solve it on my own ! Any
help would be appreciated.</p>
<p>Best regards,</p>
<p>JF Hasson<br>
</p>
<div class="moz-cite-prefix">Le 31/12/2020 à 10:14, Antony Stone a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:202012311014.45914.Antony.Stone@squid.open.source.it">
<pre class="moz-quote-pre" wrap="">On Thursday 31 December 2020 at 10:10:11, jean francois hasson wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">If I set up on a device connected to the access point a proxy manually
ie 10.3.141.1 on port 8080, I can access the internet. If I put the
following rules for iptables to use in files rules.v4 :
*nat
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination
10.3.141.1:3128
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination
10.3.141.1:3129
-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129
-A POSTROUTING -s 10.3.141.0/24 -o eth0 -j MASQUERADE
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Try removing the DNAT rules above. You should be using REDIRECT for intercept
mode to work correctly.
Antony.
</pre>
</blockquote>
</body>
</html>