<html><head></head><body style="zoom: 0%;"><div dir="auto">I believe I have solved the forwarding loop issue by adding a preceding rule to -j ACCEPT all traffic originating from the docker network. Now I still have the SSL_ERROR_RX_RECORD_TOO_LONG issue, which seems to be unrelated. I will set logging to debug and do a wireshark session to see what might be going on.<br><br></div>
<div dir="auto"><!-- tmjah_g_1299s -->Get <!-- tmjah_g_1299e --><a href="http://www.bluemail.me/r?b=16470"><!-- tmjah_g_1299s -->BlueMail for Android<!-- tmjah_g_1299e --></a><!-- tmjah_g_1299s --> <!-- tmjah_g_1299e --></div>
<div class="gmail_quote" >On Feb 23, 2021, at 8:14 PM, Justin Michael Schwartzbeck <<a href="mailto:justinmschw@gmail.com" target="_blank">justinmschw@gmail.com</a>> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><div>Hi all,</div><div><br></div><div>For some years I have used squid 3.5 with SSL bump and transparent proxy locally on my laptop. I have been using the following in my squid.conf:<br><br><br>ssl_bump server-first all<br>http_port 3128<br>http_port 3129 intercept<br>http_port 3130 ssl-bump intercept generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl/bluestar.crt key=/etc/squid/ssl/bluestar.pem<br><br><br></div><div>So if I want to manually set the proxy on the client side, I use port 3128, but by default all http/https traffic is redirected to port 3129 and 3130, respectively. Here are my iptables rules:<br><br><br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner root -j RETURN<br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner dockeruser -j RETURN<br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129<br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -m owner --uid-owner root -j RETURN<br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -m owner --uid-owner dockeruser -j RETURN<br>iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130<br><br><br></div><div>dockeruser is the user that starts the docker container, and proxy is the actual squid user. I didn't know which one I needed a rule for, so I just chose both.<br><br></div><div>As I said before, this worked great when I was running squid 3.5 on bare metal. Now I am running squid 4 in a docker container. I am seeing the following error many times in the squid logs when I try to use the transparent proxy:<br><br><br>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">2021/02/24 01:45:17| WARNING: Forwarding loop detected for:</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">GET /success.txt HTTP/1.1</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Accept: */*</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Accept-Language: en-US,en;q=0.5</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Accept-Encoding: identity,gzip,deflate</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Pragma: no-cache</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Via: 1.1 19deb96addda (squid/4.11)</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">X-Forwarded-For: 172.18.0.1</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Cache-Control: no-cache</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">Host: <a href="http://detectportal.firefox.com">detectportal.firefox.com</a><br><br><br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">And from firefox I see this:<br>
</p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">WARNING: Forwarding loop detected for</p>
<p style="margin:0px;text-indent:0px;white-space:pre-wrap">SSL_ERROR_RX_RECORD_TOO_LONG<br><br><br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">I feel like I am very close, but I'm not sure what I am missing. Does someone else know of a better way to do this? I had assumed that since I publish the ports, I should be able to redirect to them the same way I would if squid were running locally.<br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap"><br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">I would appreciate any help in figuring this out.<br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">Thanks,</p><p style="margin:0px;text-indent:0px;white-space:pre-wrap">-Justin<br></p><p style="margin:0px;text-indent:0px;white-space:pre-wrap"><br></p></div></div>
</blockquote></div></body></html>