Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm learning how to use Squid as a reverse proxy. Right now it's not sending any web traffic to the backend web server. I'm taking http traffic into the reverse proxy and sending it to my web server at 8080. My setup:

Internet--Firewall--Squid--WebServer

I set up squid with 2 nics. One with a DMZ IP that NATs to a public IP. The other nic is internal on the same subnet as the web server. Here is the squid.conf file:

http_port 80 accel defaultsite=rcdlab.net vhost
forwarded_for on

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320

cache_peer 192.168.3.59 parent 8080 0 no-query no-digest originserver name=web01
acl sites_iis dstdomain www.rcdlab.net rcdlab.net 192.168.222.198
acl our_sites dstdomain www.rcdlab.net rcdlab.net 192.168.222.198
cache_peer_access web01 allow sites_iis

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 192.168.3.0/24
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_access allow our_sites

http_access allow manager all
http_access allow manager
http_access allow localnet
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all

visible_hostname rp.rcdlab.local
access_log /var/log/squid/access.log

Update 6/29/2012

Traffic from my pc externally is reaching the reverse proxy but I am seeing this in tcpdump:

172.16.3.254 > 192.168.222.213: ICMP host 172.16.3.254 unreachable - admin prohibited, length 60
        IP (tos 0x0, ttl 128, id 4230, offset 0, flags [DF], proto TCP (6), length 52)

172.16.3.254 = reverse proxy 192.168.222.213 = my IP

share|improve this question
    
So if it isn't sending traffic to the backend what error are you getting from Squid instead? What shows up in the access log? –  Zoredache Jun 28 '12 at 23:44
    
When I view the access log it's empty. –  Rowell Jun 29 '12 at 4:38
    
What evidence do you have that the proxy server is even reviving the request then? What makes you think that the problem isn't related to the firewall or some other network setting? –  Zoredache Jun 29 '12 at 5:01
    
That's what I'd like to learn. Squid is installed on CentOS and I'm still kind of new to linux. I was hoping my config was okay. I'm able to ping internally and externally. On the firewall, I can see logs of my PC hitting the outside IP and reaching the DMZ IP of the reverse proxy. That's where it dies. I have wireshark on the webserver and no traffic is coming from the reverse proxy. –  Rowell Jun 29 '12 at 5:58
    
run tcpdump/wireshark on the proxy. Are packets reaching it? –  Zoredache Jun 29 '12 at 6:17
show 1 more comment

1 Answer

up vote 0 down vote accepted

Update

Edited /etc/sysconfig/iptables and added the following rule:

-A INPUT -p tcp --dport 80 -j ACCEPT

This gets appended to the INPUT chain (packets destined to the local server), tcp protocol, destination port 80 and jumping to the target action for packets matching the rule, ACCEPT.

This allowed external traffic to hit the reverse proxy and get forwarded to the backend webserver which was verified by looking at the IIS logs.

/Update

My NAT and Firewall rules were good.

The problem lies on CentOS and iptables in /etc/sysconfig/iptables

This line:

-A INPUT -j REJECT --reject-with icmp-host-prohibited

was blocking traffic from reaching my web server. I commented it out for now but I'll need to research more about iptables and how it works. I don't want to open up any holes on the reverse proxy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.