[squid-users] TCP_DENIED/403 3954 CONNECT www.welt.de:443 - HIER_NONE/- text/html

[Wolfgang Paul Rauchholz]

I run a home server under Centos 7 and squid 3.5.20. The config is still
work in progress as I started only today. Any tipps&tricks are welcomed
The function is as expected when working from my LAN. But when I tested
today from my cell phone from outside I received a few TCP_DENIED for web
pages that are not part of the blacklists and I can access from my LAN.
I also tried a few apps (e.g. Twitter, Linkedin, etc..) and none worked.
Underneath the config as-is.

Any idea why I cannot connect?
I have two more question I fiddled with and has no success:

   - Is there a possibility to re-direct certain MACs from the LAN through
   Squid and others can go direct?
   - Is there a good howto that describes in detail how autdetect proxy
   works with wpad.dat. I want that when users are on LAN they go through
   squid, but when they are travelling they can go direct.

Thanks for your help,

Wolfgang



#acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
#acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
#acl localnet src fc00::/7       # RFC 4193 local private network range
#acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged)
machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
# Add wo-lar LAN IP
acl lan src 10.5.2.0/24

# Basic user auth
#auth_param basic program /usr/lib64/squid/basic_ncsa_auth
/etc/squid/.htpasswd
#auth_param basic children 5
#auth_param basic realm Squid Basic Authentication
#auth_param basic credentialsttl 5 hours
#acl password proxy_auth REQUIRED
#http_access allow password

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
#http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
#http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
acl allowdomains dstdomain "/etc/squid/whitelists/domains"
acl porn         dstdomain "/etc/squid/blacklists/porn/domains"
acl drugs        dstdomain "/etc/squid/blacklists/drugs/domains"
http_access allow allowdomains
http_access deny porn
http_access deny drugs

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localhost
http_access allow lan

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

request_header_access Referer deny all
request_header_access X-Forwarded-For deny all
request_header_access Via deny all
request_header_access Cache-Control deny all

# do not display IP address
forwarded_for off

# Virus check for downloads
icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_header X-Authenticated-User
icap_service service_req reqmod_precache bypass=1 icap://
127.0.0.1:1344/squidclamav
adaptation_access service_req allow all
icap_service service_resp respmod_precache bypass=1 icap://
127.0.0.1:1344/squidclamav
adaptation_access service_resp allow all


Wolfgang Rauchholz
+34 627 994 977
https://www.linkedin.com/in/wolfgangrauchholz/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20210105/19f1b08e/attachment.htm>