<div dir="ltr"> Thanks Alex,<div><br></div><div>Let me ask this then .... </div><div><br></div><div>I just want squid to redirect any requests (http for instance) to a specific external url so for instance <a href="http://mysuidserver:80">http://mysuidserver:80</a> to <a href="http://externalserver:80">http://externalserver:80</a> ... </div><div><br></div><div>Does that help .... </div><div><br></div><div>I'm just sure what is the minimal conf file I would need to achieve this ... </div><div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Sep 27, 2021 at 9:23 AM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 9/27/21 8:44 AM, Mike Yates wrote:<br>
<br>
> Sorry Alex but if using postman I just post to the internal URL with no<br>
> certificates and everything works fine. All I'm trying to do is post to<br>
> the squid server that will then redirect the post to the external url. <br>
> Its that simple .. <br>
<br>
Unfortunately, since I am not familiar with postman, I cannot convert<br>
the pending questions about protocols the server software uses into<br>
questions about your postman configuration. Hopefully, somebody else on<br>
the list can do that for you. We also need to make sure that what you do<br>
in postman matches what your servers are actually doing (as far as<br>
communication protocols are concerned) -- the API server may support<br>
several protocols, and it is possible, at least in theory, that postman<br>
tests use a different set of communication protocols compared to the<br>
actual servers you need to handle.<br>
<br>
Without answers to those pending (or similar) questions and without<br>
traffic samples, it is very difficult to guess what is actually going on<br>
in your environment. And without that knowledge, it is not clear how to<br>
configure Squid to do what you want.<br>
<br>
I know your environment sounds simple to you, but since you want more<br>
than an "It is simple, just use Squid" answer, we need protocol-level<br>
details to give specific advice.<br>
<br>
Alex.<br>
<br>
> On Sat, Sep 25, 2021 at 11:55 AM Alex Rousskov wrote:<br>
> <br>
> On 9/25/21 5:23 AM, Mike Yates wrote:<br>
> > There are no certificates to worry about, the api is expecting a token<br>
> > to be included in the payload of the call. So all squid needs to<br>
> do is<br>
> > accept the post from the internal server and pass that post to the<br>
> > external servers url including the payload. <br>
> <br>
> > I hope that helps. <br>
> <br>
> Not yet. Forget about payload for a second. Our problems are still at a<br>
> much higher level: In your examples, you used https://... URLs. Do<br>
> internal servers make HTTPS requests (i.e. HTTP requests over SSL/TLS<br>
> connections)? If yes, then why are you saying that there are no<br>
> certificates to worry about? TLS connections normally involve<br>
> certificate validation!..<br>
> <br>
> Perhaps those internal servers make plain HTTP requests, and you used<br>
> "https://..." URLs in your examples by accident?<br>
> <br>
> BTW, if you do not know the answers to some of the questions, please<br>
> just say so -- there is nothing wrong with that. If you can share a<br>
> small packet capture of a single request/response (in libpcap format),<br>
> that may reduce the number of questions we have to ask.<br>
> <br>
> Alex.<br>
> <br>
> <br>
> > On Fri, Sep 24, 2021, 18:01 Alex Rousskov wrote:<br>
> ><br>
> > On 9/24/21 5:26 PM, Mike Yates wrote:<br>
> > > Ok so let's say the new server outside the dmz has a<br>
> different name. I<br>
> > > need a squid server configuration that will just forward the<br>
> api calls<br>
> > > to an external address. So my internal servers will still point<br>
> > to Fred<br>
> > > ( which is now a squid server and has access to the outside<br>
> world) and<br>
> > > will then forward the requests to the new server I have in<br>
> the cloud. <br>
> > > Long story short I just need a pass through squid server. <br>
> ><br>
> > Will those internal servers trust the certificate you<br>
> configure Squid<br>
> > with? In your example, you used "https://...". That usually<br>
> means the<br>
> > internal servers are going to validate the server certificate.<br>
> Can you<br>
> > make them trust the Squid certificate? Or does the API<br>
> communication<br>
> > have to be signed by a <a href="http://fred.mydomain.com" rel="noreferrer" target="_blank">fred.mydomain.com</a><br>
> <<a href="http://fred.mydomain.com" rel="noreferrer" target="_blank">http://fred.mydomain.com</a>> <<a href="http://fred.mydomain.com" rel="noreferrer" target="_blank">http://fred.mydomain.com</a><br>
> <<a href="http://fred.mydomain.com" rel="noreferrer" target="_blank">http://fred.mydomain.com</a>>><br>
> > certificate that you do not<br>
> > control?<br>
> ><br>
> > The other pending question is whether those internal servers are<br>
> > configured to use a proxy (see the previous email on this<br>
> thread) or<br>
> > always talk directly to (what they think is) the API service?<br>
> ><br>
> > Alex.<br>
> ><br>
> ><br>
> > > On Fri, Sep 24, 2021, 17:18 Alex Rousskov wrote:<br>
> > ><br>
> > > On 9/24/21 5:09 PM, Mike Yates wrote:<br>
> > > > I have a bunch of internal machines that do not have<br>
> internet<br>
> > > access and<br>
> > > > any one of them is sending api post requests to another<br>
> > system on prem<br>
> > > > and having no issues ….<br>
> > > ><br>
> > > > <br>
> > > ><br>
> > > > Example would be <a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>><br>
> > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>>><br>
> > > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>><br>
> > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>>>><br>
> > > ><br>
> > > > <br>
> > > ><br>
> > > > Now the problem becomes the fred server is being moved to<br>
> > the cloud so<br>
> > > > the same <a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>><br>
> > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>>><br>
> > > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>><br>
> > <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a><br>
> <<a href="https://fred.mydomain.com/api/event" rel="noreferrer" target="_blank">https://fred.mydomain.com/api/event</a>>>> is still valid but none of my<br>
> > > > internal server can see fred and I don’t have access<br>
> to the<br>
> > backend<br>
> > > > servers to change their api calls.<br>
> > ><br>
> > > AFAICT from your summary, "moved to cloud" here means<br>
> that the API<br>
> > > protocol stays the same, the API server domain name<br>
> stays the<br>
> > same, the<br>
> > > API URL path stays the same, but the IP address of that<br>
> domain<br>
> > name will<br>
> > > change. Please clarify if that conclusion is wrong.<br>
> > ><br>
> > > If it is correct, then it is not clear how the change of<br>
> an IP<br>
> > address<br>
> > > would affect those making API requests using the domain<br>
> name,<br>
> > and what<br>
> > > role Squid is playing here.<br>
> > ><br>
> > > Alex.<br>
> > ><br>
> ><br>
> <br>
<br>
</blockquote></div>