[squid-users] Transparent squid configuration problem.

Thu Aug 23 13:22:21 UTC 2018

Hi! I have some problems with configuration of squid.

What I need:
http/https transparent proxy server based on Debian Stretch with some blacklisted and whitelisted domains

I've used many tutorials and squid.wiki through installation process and it almost work! But I have the last problem.

When I tried to connect to some websites like a https://habr.com I have  got HTTP ERROR 503. Ive tried to find solution at forums but no one helped me. I know the answer is simple and its here but cannt find it by myself.

Here is my squid.conf, cache.log, access.log and iptables script.

Please help! :)

Squid.conf:

dns_v4_first on

acl network src 10.84.0.0/16

acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl blacklist dstdomain "/etc/squid/acls/social_networks.txt" # list of blocked websites here
acl CONNECT method CONNECT

http_access deny blacklist
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow all

http_port 3130

http_port 3128 intercept
https_port 3129 intercept ssl-bump cert=/etc/squid/ssl_cert/vproxy2.pem key=/etc/squid/ssl_cert/vproxy2.pem

#always_direct allow all
ssl_bump server-first all
#sslproxy_cert_error deny all
#sslproxy_flags DONT_VERIFY_PEER

sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB
sslcrtd_children 8 startup=1 idle=1

coredump_dir /var/spool/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
refresh_pattern .        0    20%    4320

shutdown_lifetime 1 second

cache.log:

Maximum Resident Size: 123312 KB
Page faults with physical i/o: 7
2018/08/23 16:19:27 kid1| Logfile: closing log daemon:/var/log/squid/access.log
2018/08/23 16:19:27 kid1| Logfile Daemon: closing log daemon:/var/log/squid/access.log
2018/08/23 16:19:27 kid1| Open FD UNSTARTED     6 DNS Socket IPv6
2018/08/23 16:19:27 kid1| Open FD READ/WRITE    7 DNS Socket IPv4
2018/08/23 16:19:27 kid1| Open FD UNSTARTED    10 IPC UNIX STREAM Parent
2018/08/23 16:19:27 kid1| Squid Cache (Version 3.5.23): Exiting normally.
2018/08/23 16:19:32 kid1| Set Current Directory to /var/spool/squid
2018/08/23 16:19:32 kid1| Starting Squid Cache version 3.5.23 for x86_64-pc-linux-gnu...
2018/08/23 16:19:32 kid1| Service Name: squid
2018/08/23 16:19:32 kid1| Process ID 1209
2018/08/23 16:19:32 kid1| Process Roles: worker
2018/08/23 16:19:32 kid1| With 65535 file descriptors available
2018/08/23 16:19:32 kid1| Initializing IP Cache...
2018/08/23 16:19:32 kid1| DNS Socket created at [::], FD 6
2018/08/23 16:19:32 kid1| DNS Socket created at 0.0.0.0, FD 7
2018/08/23 16:19:32 kid1| Adding domain generium.corp from /etc/resolv.conf
2018/08/23 16:19:32 kid1| Adding nameserver 10.84.10.110 from /etc/resolv.conf
2018/08/23 16:19:32 kid1| Adding nameserver 10.83.10.120 from /etc/resolv.conf
2018/08/23 16:19:32 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2018/08/23 16:19:32 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2018/08/23 16:19:32 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2018/08/23 16:19:32 kid1| Store logging disabled
2018/08/23 16:19:32 kid1| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2018/08/23 16:19:32 kid1| Target number of buckets: 1008
2018/08/23 16:19:32 kid1| Using 8192 Store buckets
2018/08/23 16:19:32 kid1| Max Mem  size: 262144 KB
2018/08/23 16:19:32 kid1| Max Swap size: 0 KB
2018/08/23 16:19:32 kid1| Using Least Load store dir selection
2018/08/23 16:19:32 kid1| Set Current Directory to /var/spool/squid
2018/08/23 16:19:32 kid1| Finished loading MIME types and icons.
2018/08/23 16:19:32 kid1| HTCP Disabled.
2018/08/23 16:19:32 kid1| Pinger socket opened on FD 16
2018/08/23 16:19:32 kid1| Squid plugin modules loaded: 0
2018/08/23 16:19:32 kid1| Adaptation support is off.
2018/08/23 16:19:32 kid1| Accepting HTTP Socket connections at local=[::]:3130 remote=[::] FD 12 flags=9
2018/08/23 16:19:32 kid1| Accepting NAT intercepted HTTP Socket connections at local=[::]:3128 remote=[::] FD 13 flags=41
2018/08/23 16:19:32 kid1| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=[::]:3129 remote=[::] FD 14 flags=41
2018/08/23 16:19:32| pinger: Initialising ICMP pinger ...
2018/08/23 16:19:32| pinger: ICMP socket opened.
2018/08/23 16:19:32| pinger: ICMPv6 socket opened
2018/08/23 16:19:32| Pinger exiting.
2018/08/23 16:19:33 kid1| storeLateRelease: released 0 objects

Accesslog:

1535030545.214      0 10.84.77.52 TAG_NONE/503 382 GET https://habr.com/ - ORIGINAL_DST/178.248.237.68 text/html
1535030545.442    608 10.84.77.52 TAG_NONE/200 0 CONNECT 52.4.157.193:443 - ORIGINAL_DST/52.4.157.193 -
1535030545.442    617 10.84.77.52 TAG_NONE/200 0 CONNECT 52.204.140.44:443 - ORIGINAL_DST/52.204.140.44 -
1535030545.717    422 10.84.77.52 TAG_NONE/200 0 CONNECT 52.204.140.44:443 - ORIGINAL_DST/52.204.140.44 -
1535030545.879     36 10.84.77.52 TCP_MISS/204 415 POST https://www.google.ru/gen_204? - ORIGINAL_DST/64.233.162.94 text/html
1535030546.522     77 10.84.77.52 TAG_NONE/200 0 CONNECT 178.248.237.68:443 - ORIGINAL_DST/178.248.237.68 -
1535030546.623     95 10.84.77.52 TAG_NONE/200 0 CONNECT 178.248.237.68:443 - ORIGINAL_DST/178.248.237.68 -
1535030546.625      0 10.84.77.52 TAG_NONE/503 382 GET https://habr.com/ - ORIGINAL_DST/178.248.237.68 text/html

Уведомление о конфиденциальности: это электронное сообщение и любые документы, приложенные к нему, могут содержать конфиденциальную информацию. Настоящим уведомляем Вас о том, что если это сообщение не предназначено Вам, использование, копирование или распространение информации, содержащейся в настоящем сообщении, а также осуществление любых действий на основе этой информации строго запрещено. Если Вы получили это сообщение по ошибке, пожалуйста, сообщите об этом отправителю по электронной почте и удалите это сообщение. Confidentiality notice: This e-mail transmission and any attachments included may contain confidential information. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or reliance upon the content of this e-mail is strictly prohibited. If you have received this e-mail transmission in error, please notify sender by e-mail and then delete this message from your inbox.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20180823/e6c087d7/attachment.html>