[squid-users] Fwd: squid intercept config

[Monah Baki]

Hi All,

As an addition to my yesterday's issue,

Tail -f cache.log, I am getting the following:

015/03/06 13:54:02| WARNING: Forwarding loop detected for:
GET /Artwork/SN.png HTTP/1.1
Host: www.squid-cache.org
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/40.0.2214.115 Safari/537.36
Referer: http://www.openbsd.org/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,ar;q=0.6
Via: 1.1 ISN-PHC-CACHE (squid/3.5.2)
X-Forwarded-For: 10.0.0.23
Cache-Control: max-age=0
Connection: keep-alive


2015/03/06 13:54:02| WARNING: Forwarding loop detected for:
GET /favicon.ico HTTP/1.1
Host: www.openbsd.org
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/40.0.2214.115 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,ar;q=0.6
Via: 1.1 ISN-PHC-CACHE (squid/3.5.2)
X-Forwarded-For: 10.0.0.23
Cache-Control: max-age=259200
Connection: keep-alive

Any ideas?

---------- Forwarded message ----------
From: Monah Baki <monahbaki at gmail.com>
Date: Thu, Mar 5, 2015 at 7:19 AM
Subject: squid intercept config
To: Squid Users <squid-users at squid-cache.org>


Hi all, can anyone verify if this is correct, need to make ure that users
will be able to access the internet via the squid.

Running FreeBSD with a single interface with Squid-3.5.2

Policy based routing on Cisco with the following:


interface GigabitEthernet0/0/1.1

encapsulation dot1Q 1 native

ip address 10.0.0.9 255.255.255.0

no ip redirects

no ip unreachables

ip nat inside

standby 1 ip 10.0.0.10

standby 1 priority 120

standby 1 preempt

standby 1 name HSRP

ip policy route-map CFLOW



ip access-list extended REDIRECT

deny   tcp host 10.0.0.24 any eq www

permit tcp host 10.0.0.23 any eq www



route-map CFLOW permit 10

match ip address REDIRECT
set ip next-hop 10.0.0.24

In my /etc/pf.conf
rdr pass inet proto tcp from 10.0.0.0/8 to any port 80 -> 10.0.0.24 port
3129

# block in
pass in log quick on bge0
pass out log quick on bge0
pass out keep state

and finally in my squid.conf:
http_port 3128
http_port 3129 intercept



And for testing purposes from the squid server:
 ./squidclient -h 10.0.0.24 -p 3128 http://www.freebsd.org/

If I replace -p 3128 with -p 80, I get a access denied, and if I omit the
-p 3128 completely, I can access the websites.

tcpdump with (-p 3128)

13:15:02.681106 IP ISN-PHC-CACHE.44017 > wfe0.ysv.freebsd.org.http: Flags
[.], ack 17377, win 1018, options [nop,nop,TS val 985588797 ecr
1054387720], length 0
13:15:02.681421 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags
[.], seq 17377:18825, ack 289, win 1040, options [nop,nop,TS val 1054387720
ecr 985588501], length 1448
13:15:02.681575 IP wfe0.ysv.freebsd.org.http > ISN-PHC-CACHE.44017: Flags
[.], seq 18825:20273, ack 289, win 1040, options [nop,nop,TS val 1054387720
ecr 985588501], length 1448



Did I miss anything?

Thanks
Monah
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20150306/b2d8dabf/attachment.html>