4

Whenever I try to connect to my Squid3 Proxy server, I get the 'Proxy server is refusing connections' error.

Here's my config:

    #Recommended minimum configuration:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 192.168.100.0/24 192.168.101.0/24
acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http

acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports

http_access deny to_localhost
icp_access deny all
htcp_access deny all

http_port 3128
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid3/access.log squid


#Suggested default:
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .       0   20% 4320
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3

#acl whitelist dstdomain "/etc/squid3/whitelist.txt"

# Allow localnet machines to whitelisted sites
#http_access allow localnet whitelist

# block all other access
#http_access deny all

url_rewrite_program /etc/squid3/webreq.pl
1
  • 1
    Have you tried #1 disabling your firewall? Jul 1, 2015 at 20:56

2 Answers 2

5

I'd verify the following:

  1. Is Squid running? Check /var/log/squid3/cache.log and make sure there aren't any errors in your configuration file.
  2. From a client machine are you able to open a TCP connection to the proxy on port 3128? I'd start by confirming that. The easiest way is by using telnet (you can do this from Windows, Mac and Unix hosts). Something like:

    telnet proxyhost 3128

    where proxy host is your proxy hostname or IP.

    If it works, you should see something like:

    Trying proxyhost...
    Connected to proxyhost.
    Escape character is '^]'.
    

    If that doesn't work (e.g., it times out), you could have a firewall that's blocking access.

Those are the two initial checks I'd make.

4
  • The server provider says there's port triggering, so I don't think it's the firewall, I tested and checked and everything looks okay. telnet didn't give off anything though.
    – Jake Cross
    Jul 1, 2015 at 22:15
  • Port-triggering only works when an outbound connection is made first. This is an inbound connection, and therefore would be blocked.
    – TheCompWiz
    Jul 1, 2015 at 22:21
  • @JakeCross If the telnet doesn't work then something is blocking access to your proxy. Can you temporarily disable any firewalls on your proxy and see if that helps? Also verify that Squid is running correctly. Also, from the proxy host do a telnet localhost 3128 and see if that connects - if so, it's definitely the firewall.
    – mjturner
    Jul 2, 2015 at 8:37
  • Sometimes it's the most obvious thing that trips you up. In my case it was the firewall only allowing local subnet in and I needed clients on my point to site gateway in as well. Aug 25, 2018 at 10:26
1

1 word. ACLs.

You allow manager, and localhost http access... but deny everyone else.

You might have meant to add a line like

http_access allow localnet

or modify the line

http_access allow manager localhost

to say

http_access allow manager localhost localnet

or perhaps something to do with the whitelists... or what-have-you.

1
  • I just saw that, and fixed it. Still not working I'm afraid
    – Jake Cross
    Jul 1, 2015 at 22:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .