<div dir="ltr"><div>I would certainly be willing to give it a shot, yes!</div><div><br></div><div>Thank you!</div><div><br></div><div>Jason<br></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 13, 2024 at 4:38 AM <<a href="mailto:ngtech1ltd@gmail.com">ngtech1ltd@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hey Jason,<br>
<br>
I can try to build Squid 6.8 for RHEL 9, would this help you to test it as a solution?<br>
<br>
Eliezer<br>
<br>
From: squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> On Behalf Of Jason Marshall<br>
Sent: Wednesday, March 6, 2024 4:49 PM<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: [squid-users] Recommended squid settings when using IPS-based domain blocking<br>
<br>
Good morning,<br>
<br>
We have been using squid (version squid-5.5-6.el9_3.5) under RHEL9 as a simple pass-through proxy without issue for the past month or so. Recently our security team implemented an IPS product that intercepts domain names known to be associated with malware and ransomware command and control. Once this was in place, we started having issues with the behavior of squid.<br>
<br>
Through some troubleshooting, it appears that what is happening is that that when a user's machine make a request through squid for one of these bad domains, the request is dropped by the IPS, squid waits for the DNS timeout, and then all requests made to squid after that result in NONE_NONE/500 errors, and it never seems to recover until we do a restart or reload of the service.<br>
<br>
Initially the dns_timeout was set for 30 seconds. I reduced this, thinking that perhaps requests were building up or something along those lines. I set it to 5 seconds, but that just got us to a failure state faster.<br>
<br>
I also found the negative_dns_ttl setting and thought it might be having an effect, but setting this to 0 seconds resulted in no change to the behavior.<br>
<br>
Are there any configuration tips that anyone can provide that might work better with dropped/intercepted DNS requests? My current configuration is included here:<br>
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)<br>
acl localnet src <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a> # RFC 1918 local private network (LAN)<br>
acl localnet src <a href="http://100.64.0.0/10" rel="noreferrer" target="_blank">http://100.64.0.0/10</a> # RFC 6598 shared address space (CGN)<br>
acl localnet src <a href="http://169.254.0.0/16" rel="noreferrer" target="_blank">http://169.254.0.0/16</a> # RFC 3927 link-local (directly plugged) machines<br>
acl localnet src <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a> # RFC 1918 local private network (LAN)<br>
acl localnet src <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a> # RFC 1918 local private network (LAN)<br>
<br>
acl localnet src fc00::/7 # RFC 4193 local private network range<br>
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br>
<br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 9191 # papercut<br>
http_access deny !Safe_ports<br>
http_access allow localhost manager<br>
http_access deny manager<br>
<br>
http_access allow localnet<br>
http_access allow localhost<br>
http_access deny all<br>
http_port <a href="http://0.0.0.0:3128" rel="noreferrer" target="_blank">http://0.0.0.0:3128</a><br>
http_port <a href="http://0.0.0.0:3129" rel="noreferrer" target="_blank">http://0.0.0.0:3129</a><br>
cache deny all<br>
coredump_dir /var/spool/squid<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
debug_options rotate=1 ALL,2<br>
negative_dns_ttl 0 seconds<br>
dns_timeout 5 seconds<br>
<br>
Thank you for any help that you can provide.<br>
<br>
Jason Marshall<br>
<br>
</blockquote></div>