Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a system which looks like this:

Tomcat Server (has haproxy installed and balances my proxy servers) >> squid proxy server >> outside. This is the connection flow. My tomcat instance stores ssl certificates which are used for https transmission to clients. I'm using a connect method in squid in order to not have to decrypt/encrypt the transmission from tomcat>client.

But some of my clients are not accepting CONNECT requests.

What can I do in this case if I want the squid proxy to be transparent and not have to decrypt/encrypt the transmission but also not send CONNECTs to clients. Thanks

This is my squid config:

    # This file is managed by Chef. Any local modification will be overwritten.

    visible_hostname proxy.demo.com
    cache deny all
    #
    # Recommended minimum configuration:
    #
    acl manager proto cache_object
    acl localhost src 127.0.0.1/32 ::1
    acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

    # Example rule allowing access from your local networks.
    # Adapt to list your (internal) IP networks from where browsing
    # should be allowed
    acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
    acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
    acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
    acl localnet src fc00::/7       # RFC 4193 local private network range
    acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

    acl SSL_ports port 443
    acl Safe_ports port 80      # http
    acl Safe_ports port 21      # ftp
    acl Safe_ports port 443     # https
    acl Safe_ports port 70      # gopher
    acl Safe_ports port 210     # wais
    acl Safe_ports port 1025-65535  # unregistered ports
    acl Safe_ports port 280     # http-mgmt
    acl Safe_ports port 488     # gss-http
    acl Safe_ports port 591     # filemaker
    acl Safe_ports port 777     # multiling http
    acl Safe_ports port 8383         # multiling http
    acl CONNECT method CONNECT

    #
    # Recommended minimum Access Permission configuration:
    #
    # Only allow cachemgr access from localhost
    http_access allow manager localhost
    http_access deny manager

    # Deny requests to certain unsafe ports
    http_access deny !Safe_ports

    # Deny CONNECT to other than secure SSL ports
    http_access allow CONNECT !SSL_ports


    # Adapt localnet in the ACL section to list your (internal) IP networks
    # from where browsing should be allowed
    http_access allow localnet
    http_access allow localhost

    # And finally deny all other access to this proxy
    auth_param basic program /usr/lib64/squid/ncsa_auth /etc/squid/users.squid

    # ACCESS CONTROLS
    # TAG: acl
    acl proxyauth proxy_auth testuser
    http_access allow proxyauth
    http_access deny all

    # Ports to listen on
    http_port 1081 ssl-bump cert=/etc/squid/proxy.demo.com.crt key=/etc/squid/proxy.demo.com.key
    always_direct allow proxyauth
    always_direct deny all

    # We recommend you to use at least the following line.
    hierarchy_stoplist cgi-bin ?

    # Leave coredumps in the first cache dir
    coredump_dir /var/spool/squid

    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:       1440    20% 10080
    refresh_pattern ^gopher:    1440    0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
    refresh_pattern .       0   20% 4320

tomcat args

-Dhttp.proxyHost=localhost -Dhttp.proxyPort=9812 -Dhttps.proxyHost=localhost Dhttps.proxyPort=9812"

haproxy.cfg (running on the tomcat host)

backend squid_servers
balance  roundrobin
mode     http
option     httplog
option     http-server-close
server  dev_proxy02 x.x.x.x:1081 check maxconn 300
reqadd Proxy-Authorization:\ Basic\ CRYPTHERE
option abortonclose
option httpclose
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.