Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a programmer but have now a role looking after a linux based network so this question may be a little silly. All P.C.s go through squid as the proxy server, squid is not set to block the normal "trusted" ports e.g. 80 (http) and I have also changed it to allow higher ports e.g. 4040. but when I try to open a URL containing this port number squid blocks it, e.g.

any thoughts as to why it is doing this.

The clients are windows XP, squid is running on debian (afaik) on a VMware image.

share|improve this question
Which OS are you using? – Iain Mar 25 '11 at 23:05
up vote 1 down vote accepted

Allowed ports are usually configured by the Safe_ports acl. The configuration file should have an ACL configuring a ports list. This is used in an http_access rule. My configuration has the rule http_access deny !Safe_ports.

The Debian system may be running an iptables firewall which prevents outgoing access to port 4040.

EDIT: It may be easier to read the configuration if you strip comments and blank lines from it. This should reduce the number lines you are looking at to under 50 or so. Commands to strip down the file and extract the acl data are:

 sudo grep -v -e '^#' -e '^$' /etc/squid3/squid.conf > ~/squid.txt
 grep grep -i -e acl -e allow  -e deny squid.txt

Significant lines for your problem are:

acl localnet src  # RFC1918 possible internal network
acl Safe_ports port 1025-65535  # unregistered ports
http_access deny !Safe_ports
http_access allow localnet

Problem would most likely occur if unregistered ports are missing. Connection will likely fail if HTTPS is being used on the port.

share|improve this answer
That is how the ACL is configured, I'll look into the iptables rules. – Tim the Enchanter Mar 26 '11 at 8:24
@Tim: Try using telnet to the port from the Debian server to the destination. If the port is blocked, you know it is not squid. – BillThor Mar 26 '11 at 17:12
O.K. I have tried to telnet it doesn't let me, I have checked the IPtables configuration on the squid server, there are no rules. Could it be the default gateway blocking the port? – Tim the Enchanter Mar 28 '11 at 8:51
@BillThor I think it must be squid because firefox tells me that the proxy server is refusing connections, when I don't use the proxy, I can connect to the port. – Tim the Enchanter Mar 28 '11 at 9:30
@Tim: Updated. Can you telnet to the site from the squid server? If not it is likely a firewall issue. – BillThor Mar 28 '11 at 13:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.