[squid-users] Squid 3.4.8 - Forwarding loop detected - Squid doesn't forward request to outside
Keyvan Hedayati
k1.hedayati93 at gmail.com
Wed Apr 15 10:21:28 UTC 2015
Hi
I'm having trouble setting a transparent proxy in our network.
For testing I've asked our net admin to transparently forward all of my
http traffic to squid port but when I try to open a page I get *Access
Denied *error and a warring about Forwarding loop.
As you can see in tcpdump squid sends request to it's machine and not to
outside and I've no idea why this happens.
Can you help my about this? I feel like I'm missing something tiny here.
Squid box: 172.16.1.5
My box: 192.168.10.122
Thanks
-------------------- tcpdump -ntAi any port ! 22
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [S], seq 1494863721, win
29200, options [mss 1460,sackOK,TS val 5421406 ecr 0,nop,wscale 7], length 0
IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [S.], seq 2174214961, ack
1494863722, win 14480, options [mss 1460,sackOK,TS val 733876 ecr
5421406,nop,wscale 4], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 1, win 229,
options [nop,nop,TS val 5421406 ecr 733876], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [P.], seq 1:75, ack 1, win
229, options [nop,nop,TS val 5421406 ecr 733876], length 74
GET / HTTP/1.1
User-Agent: curl/7.38.0
Host: google.com
Accept: */*
IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [.], ack 75, win 905,
options [nop,nop,TS val 733876 ecr 5421406], length 0
IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [S], seq 717864720, win 32792,
options [mss 16396,sackOK,TS val 733876 ecr 0,nop,wscale 4], length 0
IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [S.], seq 2077204582, ack
717864721, win 32768, options [mss 16396,sackOK,TS val 733876 ecr
733876,nop,wscale 4], length 0
IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [.], ack 1, win 2050, options
[nop,nop,TS val 733876 ecr 733876], length 0
*IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [P.], seq 1:198, ack 1, win
2050, options [nop,nop,TS val 733876 ecr 733876], length 197*
E..... at .@.R............8*...{..g....[......
..2...2.GET / HTTP/1.1
User-Agent: curl/7.38.0
Host: google.com
Accept: */*
Via: 1.1 172.16.1.5 (squid/3.4.8)
X-Forwarded-For: 192.168.10.122
Cache-Control: max-age=259200
Connection: keep-alive
IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [.], ack 198, win 2048,
options [nop,nop,TS val 733876 ecr 733876], length 0
E..4.. at .@.M..........8..{..g*.......ZQ.....
..2...2.
IP 172.16.1.5.3128 > 172.16.1.5.59906: Flags [P.], seq 1:3633, ack 198, win
2048, options [nop,nop,TS val 733876 ecr 733876], length 3632
E..d.. at .@.?..........8..{..g*.......h......
..2...2.HTTP/1.1 403 Forbidden
Server: squid/3.4.8
Mime-Version: 1.0
Date: Wed, 15 Apr 2015 10:02:33 GMT
Content-Type: text/html
Content-Length: 3268
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from 172.16.1.5
X-Cache-Lookup: MISS from 172.16.1.5:8080
Via: 1.1 172.16.1.5 (squid/3.4.8)
Connection: keep-alive
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "
http://www.w3.org/TR/html4/strict.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>ERROR: The requested URL could not be retrieved</title>
</head><body id=ERR_ACCESS_DENIED>
<div id="titles">
<h1>ERROR</h1>
<h2>The requested URL could not be retrieved</h2>
</div>
<hr>
<div id="content">
<p>The following error was encountered while trying to retrieve the URL: <a
href="http://google.com/">http://google.com/</a></p>
<blockquote id="error">
<p><b>Access Denied.</b></p>
</blockquote>
</div>
</body></html>
IP 172.16.1.5.59906 > 172.16.1.5.3128: Flags [.], ack 3633, win 2048,
options [nop,nop,TS val 733876 ecr 733876], length 0
IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [P.], seq 1:469, ack 75,
win 905, options [nop,nop,TS val 733876 ecr 5421406], length 468
HTTP/1.1 403 Forbidden
Server: squid/3.4.8
Mime-Version: 1.0
Date: Wed, 15 Apr 2015 10:02:33 GMT
Content-Type: text/html
Content-Length: 3268
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from 172.16.1.5
X-Cache-Lookup: MISS from 172.16.1.5:8080
X-Cache: MISS from 172.16.1.5
X-Cache-Lookup: MISS from 172.16.1.5:8080
Via: 1.1 172.16.1.5 (squid/3.4.8), 1.1 172.16.1.5 (squid/3.4.8)
Connection: keep-alive
IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [.], seq 469:3365, ack 75,
win 905, options [nop,nop,TS val 733876 ecr 5421406], length 2896
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "
http://www.w3.org/TR/html4/strict.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>ERROR: The requested URL could not be retrieved</title>
...
</head><body id=ERR_ACCESS_DENIED>
<div id="titles">
<h1>ERROR</h1>
<h2>The requested URL could not be retrieved</h2>
</div>
<hr>
<div id="content">
<p>The following error was encountered while trying to retrieve the URL: <a
href="http://google.com/">http://google.com/</a></p>
<blockquote id="error">
<p><b>Access Denied.</b></p>
</blockquote>
</div>
</body></html>
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 469, win 237,
options [nop,nop,TS val 5421408 ecr 733876], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 1917, win 260,
options [nop,nop,TS val 5421408 ecr 733876], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3365, win 282,
options [nop,nop,TS val 5421408 ecr 733876], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3737, win 305,
options [nop,nop,TS val 5421408 ecr 733876], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [F.], seq 75, ack 3737,
win 305, options [nop,nop,TS val 5421408 ecr 733876], length 0
IP 172.16.1.5.3128 > 192.168.10.122.59550: Flags [F.], seq 3737, ack 76,
win 905, options [nop,nop,TS val 733878 ecr 5421408], length 0
IP 192.168.10.122.59550 > 172.16.1.5.3128: Flags [.], ack 3738, win 305,
options [nop,nop,TS val 5421411 ecr 733878], length 0
-------------------------- Squid config
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
acl localhet src 169.254.0.0/16 # RFC 3927 link-local (directly
plugged) machines
acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly
plugged) machines
acl SSL_ports port 443
acl Safe_ports port 53 # http
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#external_acl_type AclHelper %SRC %DST /usr/bin/python
/etc/squid3/external_acl.py
#acl Acl external AclHelper
http_access deny !Safe_ports # Deny requests to certain unsafe ports
http_access deny CONNECT !SSL_ports # Deny CONNECT to other than secure SSL
ports
http_access allow localhost manager # Only allow cachemgr access from
localhost
http_access deny manager # Only allow cachemgr access from
localhost
http_access deny to_localhost
http_access allow localnet
http_access allow localhost
http_access deny all
#ssl_bump server-first all
#always_direct allow all
http_port 3128 intercept
http_port 8080 # avoid ERROR: No forward-proxy ports
configured.
#https_port 3129 intercept ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/custom_csr.pem
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
sslcrtd_program /usr/lib/squid3/ssl_crtd -ds /var/spool/squid3_ssldb -M 4MB
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_adapt setCommonName
shutdown_lifetime 3 seconds
visible_hostname squid
debug_options ALL,1 33,2
------------------- iptables
root at proxy:~# iptables -L -t filter
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root at proxy:~# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
root at proxy:~# iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
-------------------- Squid info
root at proxy:~/squid# squid3 -v
Squid Cache: Version 3.4.8
Debian linux
configure options: '--build=x86_64-linux-gnu' '--prefix=/usr'
'--includedir=${prefix}/include' '--mandir=${prefix}/share/man'
'--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var'
'--libexecdir=${prefix}/lib/squid3' '--srcdir=.'
'--disable-maintainer-mode' '--disable-dependency-tracking'
'--disable-silent-rules' '--datadir=/usr/share/squid3'
'--sysconfdir=/etc/squid3' '--mandir=/usr/share/man' '--enable-inline'
'--disable-arch-native' '--enable-async-io=8'
'--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap'
'--enable-delay-pools' '--enable-cache-digests'
'--enable-follow-x-forwarded-for' '--enable-icap-client'
'--enable-auth-basic=DB,fake,getpwnam,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB'
'--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper'
'--enable-auth-ntlm=fake,smb_lm'
'--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group'
'--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi'
'--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation'
'--with-swapdir=/var/spool/squid3' '--with-logdir=/var/log/squid3'
'--with-pidfile=/var/run/squid3.pid' '--with-filedescriptors=65536'
'--with-large-files' '--with-default-user=proxy' '--enable-ssl'
'--enable-ssl-crtd' '--with-openssl' '--enable-build-info=Debian linux'
'--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2
-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat
-Werror=format-security -Wall' 'LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now'
'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector
--param=ssp-buffer-size=4 -Wformat -Werror=format-security'
-------------------------- Router config
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; This rule is being used for testing url-redirector service
chain=prerouting action=mark-routing
new-routing-mark=url-redirector-test-443 passthrough=yes protocol=tcp
src-address=192.168.10.122 dst-address=!172.30.30.1 dst-port=443
1 ;;; This rule is being used for testing url-redirector service
chain=prerouting action=mark-routing
new-routing-mark=url-redirector-test-80 passthrough=yes protocol=tcp
src-address=192.168.10.122 dst-address=!172.30.30.1 dst-port=80
Flags: X - disabled, I - invalid, D - dynamic
2 ;;; url-test
chain=dstnat action=dst-nat to-addresses=172.16.1.5 to-ports=3128
protocol=tcp routing-mark=url-redirector-test-80
3 ;;; Url-test
chain=dstnat action=dst-nat to-addresses=172.16.1.5 to-ports=3129
protocol=tcp routing-mark=url-redirector-test-443
--
Live long and prosper,
K1.H <http://k1h.ir/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150415/ab5f4677/attachment-0001.html>
More information about the squid-users
mailing list