[squid-users] SSL Bump Issue

[Ali Jawad]

Hi
Pardon me if I am mistaken but isnt it the case that 1 :

iptables -t nat -A PREROUTING -p tcp  --dport 443 --destination
162.220.xx.xx -j REDIRECT --to-ports 3129
The rule above would only match for the IP of squid and squid should be
heading to the actual IP of the site in question which is not on the same
server

and 2 :

If Squid is intercepting the PREROUTING chain would not apply anymore, as
traffic passing through local daemons goes through OUTPUT and POSTROUTING
chains

As for

iptables -t nat -A PREROUTING -s $SQUIDIP -p tcp --dport 80 -j ACCEPT


All traffic set to ACCEPT ..thanks !

Regards

On Fri, Mar 4, 2016 at 11:11 AM, Amos Jeffries <squid3 at treenet.co.nz> wrote:

> On 4/03/2016 10:01 p.m., Ali Jawad wrote:
> > Actually, now that I am using 3.15 it seems I get the error for port 80
> ->
> > 3128 intercepts again
> >
> > TCP_MISS/503 4274 GET http://www.whereIwantToVisit.net/ - ORIGINAL_DST/
> > 162.220.244.7 text/html
>
> This is the same problem happening for both port 443 and port 80.
> You need to exclude the squid outgoing traffic from the iptables NAT
> REDIRECT.
>
> Compare the tutorial rules with what you have:
> <http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect>
>
> I believe you are missing that first rule with "-s $SQUIDIP -p tcp
> --dport 80 -j ACCEPT".
>
> Amos
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160307/25f9d510/attachment.html>