1

I'm trying to set up a squid proxy server on a red hat machine, based in a normal data center to send all my traffic through this proxy.

I already configured squid to allow every request (just for testing of course :) ), here is my little config:

debug_options ALL,1 33,2 28,9

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl CONNECT method CONNECT

http_access allow all

icp_access allow all

http_port 3128

hierarchy_stoplist cgi-bin ?
access_log /var/log/squid/access.log squid

acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320

acl apache rep_header Server ^Apache
broken_vary_encoding allow apache

The problem is, when I enter the server's IP and the squid port 3128 into firefox, I'm getting a timeout...

As you can see I'm running squid in debug mode, but the cache.log and the access.log files are both not even showing up ANY requests. I thought the acl is the problem, but if so there should be an entry for an restricted access, right?

I also tried the squidclient, which works like a charme. So I'm guessing the problem is, I'm not able to connect to the server for some reason...

10
  • Are file permissions for logs OK? Did you initalizy your cache (squid -z)? Or you don't use one?
    – HUB
    Apr 18, 2011 at 11:39
  • Yeah, file permissions are okay, access.log shows entries when I'm calling squid through squidclient, but not from the outside. Cache.log also has some entries from starting squid like "Completed Validation Procedure" and so on. Regarding to my debug settings, all requests (allowed or not) should be visible in those logs, but there is simply nothing (when using the proxy from the outside, as mentioned before)
    – Tom Jinks
    Apr 18, 2011 at 11:43
  • But there IS a TCP connect to server's port, right?
    – HUB
    Apr 18, 2011 at 11:45
  • What do you mean exactly? How can I check this?
    – Tom Jinks
    Apr 18, 2011 at 11:48
  • Try to telnet or netcat to your proxy and its port. ex. telnet the.proxy.ip.address 3128 Then enter GET / HTTP/1.1 and see if there is any ouput.
    – HUB
    Apr 18, 2011 at 11:50

1 Answer 1

1

After some additional checks it became clear that you iptables firewall was blocking connections from hosts. Add rules to permit SQUID traffic according to RedHat docs: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-Firewalls-Basic_Firewall_Configuration.html

The rules itself should look like this:

-A INPUT -s <your.internal.network>/<netmask> -p tcp -m tcp --dport 3128 -j ACCEPT
-A OUTPUT -d <your.internal.network>/<netmask> -p tcp -m tcp --sport 3128 -j ACCEPT

The last rule is needed only if output traffic is also filtered (I don't have a RHEL box to check the default setting). Setting access only from you internal network is also very important for security. Or you may configure your squid to listen only on the internal interface

http_port your.internal.ip.address:3128

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .