[squid-users] strange thing in the squid logs ...

[Walter H.]

Hello,

in iptables I have this:

*nat
...
-A PREROUTING -i br0 -p tcp -s 192.168.1.100 --dport 80 -j DNAT 
--to-destination 192.168.1.1:3129



192.168.1.100 is my PC and 192.168.1.1 is my NAT-Router, that has squid, 
... running

here the log

192.168.1.100 - - [05/Feb/2019:20:57:09 +0100] "CONNECT 77.74.177.233:80 
HTTP/1.1" 403 1516 "-" "-" TCP_DENIED:HIER_NONE
192.168.1.100 - - [05/Feb/2019:20:58:41 +0100] "CONNECT 
130.117.190.168:80 HTTP/1.1" 403 1520 "-" "-" TCP_DENIED:HIER_NONE
192.168.1.100 - - [05/Feb/2019:21:06:12 +0100] "CONNECT 
207.123.56.252:80 HTTP/1.1" 403 1518 "-" "-" TCP_DENIED:HIER_NONE
this are only examples in real there are many of these with exakt these 
IP addresses

what is causing such strange?


here the squid.conf

acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) 
machines

acl localnet src 192.168.1.0/24

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 3128        # squid (ftp-icons, /squid-internal) [me]
acl CONNECT method CONNECT

http_access allow localhost manager
http_access deny manager

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports    # i guess this rule is causing 
DENIED in the log, but why port 80 there???

http_access deny to_localhost

http_access allow localnet
http_access allow localhost

http_access deny all

http_reply_access allow all

http_port 127.0.0.1:3128
http_port [::1]:3128
http_port 192.168.1.1:3128
http_port 192.168.1.1:3129 intercept

cache_dir ufs /var/spool/squid 16400 16 256
coredump_dir /var/spool/squid

always_direct allow all

acl crl-mime rep_mime_type application/x-pkcs7-crl
no_cache deny crl-mime

cache_mem 2560 MB

icon_directory /usr/share/squid/icons
error_directory /etc/squid/errors

as_whois_server whois.ra.net

logformat combined %>A %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st 
"%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
access_log /var/log/squid/access.log combined

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3491 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20190205/1d5e4723/attachment.bin>