Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a gateway (+firewall +proxy) set up on a Squeeze box with 2 NICs. The problem is the client cannot see some of the HTTPS (for example they can go but not But when I try with curl or wget on server it's have no problems.

This is my "route -n" result

Destination             Gateway         Genmask         Flags Metric Ref    Use  Iface
vpn.server.ip.addr    UH    0      0        0      eth0
virtual.vpn.ip.addr    UH    0      0        0      ppp0    U     0      0        0      eth0      U     0      0        0      eth1                U     0      0        0      ppp0

this is my firewall


# Interface connected to Internet
# Interface connected to LAN

# Squid port

# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp

echo 1 > /proc/sys/net/ipv4/ip_forward

# Setting default filter policy
iptables -P INPUT ACCEPT

# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT

# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT

# if it is same system
#iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT

# set this system as a router for Rest of LAN
iptables -A FORWARD -i $LAN_IN -j ACCEPT

# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 10000 -j ACCEPT
iptables -A INPUT -p udp --dport $SIP1 -j ACCEPT
iptables -A INPUT -p udp --dport $SIP2 -j ACCEPT
iptables -A INPUT -p tcp --dport $SIP1 -j ACCEPT
iptables -A INPUT -p tcp --dport $SIP2 -j ACCEPT

and this is my squid.conf

http_port 3128 transparent

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
acl NO-CACHE-SITES dstdomain "/root/not-to-cache-sites.txt"
no_cache deny NO-CACHE-SITES

cache_mem 50 MB

cache_dir ufs /var/spool/squid 50000 16 256 
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
pid_filename /var/run/


refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

acl all src
acl localhost src
acl manager proto cache_object
acl serveur src

acl multipostes src

#acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 20 # ftp-data
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # ssl
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT

acl purge method PURGE
acl SSL method CONNECT

acl SSL_ports port 10000 # webmin
acl Safe_ports port 10000 # webmin
acl Safe_ports port 137 138 139 445
acl Safe_ports port 500
acl Safe_ports port 47
acl Safe_ports port 4569

acl Safe_ports port 995         # pop3 of gmail
acl Safe_ports port 587         # smtp of gmail
acl Safe_ports port 465         # smtp of gmail
acl Safe_ports port 993         # smtp of gmail
acl Safe_ports port 25          # smtp
acl Safe_ports port 110         # pop3
acl Safe_ports port 143         # pop3

http_access allow manager all
http_access deny manager
http_access allow purge localhost
http_access deny purge

http_access deny CONNECT !SSL_ports
http_access allow localhost

http_access allow all

http_reply_access allow all

icp_access allow all

cache_effective_user proxy
cache_effective_group proxy

visible_hostname serveur

always_direct allow all

Note: I've checked it with Wireshark, and there are no errors. I've also tried with direct connection without VPN, and it's work fine.

share|improve this question
Try to use wget, but configure it to go trough the proxy: http_proxy=http://localhost:3128/ wget -S – Mircea Vutcovici Jun 5 '13 at 13:52
Thanks Mircea, I've try your command, wget can get it without problem through proxy. But the client still can't. – jarijira Jun 7 '13 at 4:01
When it is not working, did you check if there is any error in the proxy log? You can also use Fiddler2 with the browser to analyze the traffic. You can also use Wireshark to find our if there is a SSL negotiation error (look for ALERT messages in the trace). – Mircea Vutcovici Jun 7 '13 at 15:30
Yes, Ive checked it with Wireshark, and there are no error. By the way, I've tried with direct connection without VPN, and it's work fine. – jarijira Jun 10 '13 at 6:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.