Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My system:

uname -a
FreeBSD server.local.jmorenov.com.co 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec  4 09:23:10 UTC 2012     root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

pkg info | grep squid
squid-3.2.7                    HTTP Caching Proxy

I have this configuration in squid.conf:

http_port 3128 accel vhost allow-direct # OK
http_port 3129 intercept                # Does not work
icp_port 0

When I tried with:

http_port 3129 intercept

By switch line on ipnat.rules. In access log appears:

2013/01/09 00:46:03 kid1| IPF (IPFilter) NAT open failed: (13) Permission denied
2013/01/09 00:46:03 kid1| BUG #3329: Orphan Comm::Connection: local=127.0.0.1:3129 remote=192.168.1.129:51595 FD 24 flags=33
2013/01/09 00:46:03 kid1| NOTE: 1 Orphans since last started.

/var/log/squid/cache.log

2013/02/08 09:02:33 kid1| Squid plugin modules loaded: 0
2013/02/08 09:02:33 kid1| Accepting reverse-proxy HTTP Socket connections at local=127.0.0.1:3128 remote=[::] FD 33 flags=9
2013/02/08 09:02:33 kid1| Accepting NAT intercepted HTTP Socket connections at local=127.0.0.1:3129 remote=[::] FD 34 flags=41

My /etc/ipnat.rules:

root@server:/root # cat /etc/ipnat.rules
# em0  = External NIC
# bge0 = Internal NIC

map em0 0/0                     -> 0/32 proxy port ftp ftp/tcp
map em0 0/0                     -> 0/32 portmap tcp/udp auto
map em0 0/0                     -> 0/32

# Redirect direct web traffic to local web server.
rdr em0  192.168.0.3/32 port 80 -> 127.0.0.1 port 80 tcp
rdr bge0 192.168.1.3/32 port 80 -> 127.0.0.1 port 80 tcp
# Redirect everything else to squid on port 3128 or 3129 intercept
rdr em0  0.0.0.0/0 port 80      -> 127.0.0.1 port 3128 tcp
rdr bge0 0.0.0.0/0 port 80      -> 127.0.0.1 port 3128 tcp
#rdr em0  0.0.0.0/0 port 80     -> 127.0.0.1 port 3129 tcp
#rdr bge0 0.0.0.0/0 port 80     -> 127.0.0.1 port 3129 tcp

With 3128 is OK, but with 3129, Does not work, when switch in ipnat.rules.

share|improve this question
    
Check wiki.squid-cache.org/ConfigExamples/Intercept –  ott-- Feb 8 '13 at 13:56
    
Is there a reason you're using the ancient, antiquated, abandoned, and ailing IPFilter instead of IPFW or PF? –  Chris S Feb 8 '13 at 14:05
    
Thank´s @ott and @Chris for answering, I checked wiki and try with PF, IPFW, the problem is http_port xxxx intercept appears to be BUG #3329: Orphan Comm::Connection: –  wmoreno3 Feb 15 '13 at 21:23
add comment

1 Answer

You really want to be using pf with intercept under Freebsd - http://wiki.squid-cache.org/ConfigExamples/Intercept/FreeBsdPf.

We have successfully got tproxy to work because of a requirement to use ipfw, but it required kernel changes (http://wiki.squid-cache.org/Features/Tproxy4).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.