Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My system:

uname -a
FreeBSD 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec  4 09:23:10 UTC 2012  amd64

pkg info | grep squid
squid-3.2.7                    HTTP Caching Proxy

I have this configuration in squid.conf:

http_port 3128 accel vhost allow-direct # OK
http_port 3129 intercept                # Does not work
icp_port 0

When I tried with:

http_port 3129 intercept

By switch line on ipnat.rules. In access log appears:

2013/01/09 00:46:03 kid1| IPF (IPFilter) NAT open failed: (13) Permission denied
2013/01/09 00:46:03 kid1| BUG #3329: Orphan Comm::Connection: local= remote= FD 24 flags=33
2013/01/09 00:46:03 kid1| NOTE: 1 Orphans since last started.


2013/02/08 09:02:33 kid1| Squid plugin modules loaded: 0
2013/02/08 09:02:33 kid1| Accepting reverse-proxy HTTP Socket connections at local= remote=[::] FD 33 flags=9
2013/02/08 09:02:33 kid1| Accepting NAT intercepted HTTP Socket connections at local= remote=[::] FD 34 flags=41

My /etc/ipnat.rules:

root@server:/root # cat /etc/ipnat.rules
# em0  = External NIC
# bge0 = Internal NIC

map em0 0/0                     -> 0/32 proxy port ftp ftp/tcp
map em0 0/0                     -> 0/32 portmap tcp/udp auto
map em0 0/0                     -> 0/32

# Redirect direct web traffic to local web server.
rdr em0 port 80 -> port 80 tcp
rdr bge0 port 80 -> port 80 tcp
# Redirect everything else to squid on port 3128 or 3129 intercept
rdr em0 port 80      -> port 3128 tcp
rdr bge0 port 80      -> port 3128 tcp
#rdr em0 port 80     -> port 3129 tcp
#rdr bge0 port 80     -> port 3129 tcp

With 3128 is OK, but with 3129, Does not work, when switch in ipnat.rules.

share|improve this question
Is there a reason you're using the ancient, antiquated, abandoned, and ailing IPFilter instead of IPFW or PF? – Chris S Feb 8 '13 at 14:05
Thank´s @ott and @Chris for answering, I checked wiki and try with PF, IPFW, the problem is http_port xxxx intercept appears to be BUG #3329: Orphan Comm::Connection: – wmoreno3 Feb 15 '13 at 21:23

You really want to be using pf with intercept under Freebsd -

We have successfully got tproxy to work because of a requirement to use ipfw, but it required kernel changes (

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.