Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a system which looks like this:

Tomcat Server (has haproxy installed and balances my proxy servers) >> squid proxy server >> outside. This is the connection flow. My tomcat instance stores ssl certificates which are used for https transmission to clients. I'm using a connect method in squid in order to not have to decrypt/encrypt the transmission from tomcat>client.

But some of my clients are not accepting CONNECT requests.

What can I do in this case if I want the squid proxy to be transparent and not have to decrypt/encrypt the transmission but also not send CONNECTs to clients. Thanks

This is my squid config:

    # This file is managed by Chef. Any local modification will be overwritten.

    visible_hostname proxy.demo.com
    cache deny all
    #
    # Recommended minimum configuration:
    #
    acl manager proto cache_object
    acl localhost src 127.0.0.1/32 ::1
    acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

    # Example rule allowing access from your local networks.
    # Adapt to list your (internal) IP networks from where browsing
    # should be allowed
    acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
    acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
    acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
    acl localnet src fc00::/7       # RFC 4193 local private network range
    acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

    acl SSL_ports port 443
    acl Safe_ports port 80      # http
    acl Safe_ports port 21      # ftp
    acl Safe_ports port 443     # https
    acl Safe_ports port 70      # gopher
    acl Safe_ports port 210     # wais
    acl Safe_ports port 1025-65535  # unregistered ports
    acl Safe_ports port 280     # http-mgmt
    acl Safe_ports port 488     # gss-http
    acl Safe_ports port 591     # filemaker
    acl Safe_ports port 777     # multiling http
    acl Safe_ports port 8383         # multiling http
    acl CONNECT method CONNECT

    #
    # Recommended minimum Access Permission configuration:
    #
    # Only allow cachemgr access from localhost
    http_access allow manager localhost
    http_access deny manager

    # Deny requests to certain unsafe ports
    http_access deny !Safe_ports

    # Deny CONNECT to other than secure SSL ports
    http_access allow CONNECT !SSL_ports


    # Adapt localnet in the ACL section to list your (internal) IP networks
    # from where browsing should be allowed
    http_access allow localnet
    http_access allow localhost

    # And finally deny all other access to this proxy
    auth_param basic program /usr/lib64/squid/ncsa_auth /etc/squid/users.squid

    # ACCESS CONTROLS
    # TAG: acl
    acl proxyauth proxy_auth testuser
    http_access allow proxyauth
    http_access deny all

    # Ports to listen on
    http_port 1081 ssl-bump cert=/etc/squid/proxy.demo.com.crt key=/etc/squid/proxy.demo.com.key
    always_direct allow proxyauth
    always_direct deny all

    # We recommend you to use at least the following line.
    hierarchy_stoplist cgi-bin ?

    # Leave coredumps in the first cache dir
    coredump_dir /var/spool/squid

    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:       1440    20% 10080
    refresh_pattern ^gopher:    1440    0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
    refresh_pattern .       0   20% 4320

tomcat args

-Dhttp.proxyHost=localhost -Dhttp.proxyPort=9812 -Dhttps.proxyHost=localhost Dhttps.proxyPort=9812"

haproxy.cfg (running on the tomcat host)

backend squid_servers
balance  roundrobin
mode     http
option     httplog
option     http-server-close
server  dev_proxy02 x.x.x.x:1081 check maxconn 300
reqadd Proxy-Authorization:\ Basic\ CRYPTHERE
option abortonclose
option httpclose
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.