Tag Info

New answers tagged

1

You are correct that with the REDIRECT, Squid cannot see the original intended destination IP; instead it will resolve the host provided by the client in the Host: HTTP header, which is mandatory in HTTP 1.1.


0

That is very similar to the gateway. When client host does not know where the destination host reside, it send the packet to the default gateway. And gateway define where that packet should be sent. Transparent proxy do the same. All packets to the xxx.xxx.xxx.xxx:80 are diverted to the port 3128 instead of port mentioned in the packet header. Squid ...


0

The best you could reasonably do would be to work with your internet providers to try and get a topologically close connection to a CDN, such as Akamai. (eg. have a Akamai node at your internet exchange.) Not sure how useful that would be, but considering that the bulk of commodity data is from things like video, it may be worthwhile. You may also get some ...


0

No. The point of using SSL is not just encrypting the data, so that noone could see your password, or validating that you are really logging in to your bank account and not some scammer. It is a privacy tool as well. When using SSL noone is able to see what kind of content you are transfering (although from IP they still may be able to guess which site). ...


0

I couldn't get this to work either, so what I did was setup the FreeRadius package on pfSense and then configured that to be the authentication backend for Squid, then I was able to login with the user I created on FreeRadius. Just set Freeradius up to listen on port 1812 and then set the radius server in the Squid configuration to 127.0.0.1


0

The feature you want (if I read your question correctly) is Tproxy - this effectively makes squid IP transparent - it will look like the client is making the proxied requests. To be honest, it's a bit of a faff to set up (more than a couple of directives), but it does work.


0

Short answer: Based on my research, squid does not support anything like tinyproxy's "BindSame". Details: I have been researching this very topic because I am in precisely the same situation as you: I want to use tinyproxy for the BindSame configuration, but I need authentication, which tinyproxy does not support. Unfortunately, my conclusion is that squid ...


0

I know there is a security issue with allowing DES encrypted passwords longer than 8 chars to authenticate squid as it truncates the password. However since no outsiders can connect to the said proxy server I have figured out that by using the basic_ncsa_auth or ncsa_auth from a squid version with new squid we can allow users to use the old 8+ char long ...


0

Thanks Matt! I figured it would be something easy like this. So I need to use the FORWARD rule, not the OUTPUT! I don't have to worry about IP address changing, since this server also provides DHCP and I assign them to appliances based on MAC address. But I see how your suggestion would work in a different scenario. As to the routing comments...I am a cut ...


0

This won't work. # # (6) OUTPUT rule to allow a client LAN access, but DROP internet access # I use this to prevent various home appliances from accessing the internet # iptables -A OUTPUT -s 192.168.10.110 -j DROP The reason it won't work is the OUTPUT table only filters traffic originating from your router, rather than passing through it. You want the ...


0

Clients was defined, i've downloaded source of squidGuard and compiled them. Fixed !


0

Well this wasn't easy to fix, was done by mostly experimenting: Only the: access_log syslog squid cache_log syslog squid Directives in the config are working and even they will produce the same error at the start of Squid 3: ARNING: Cannot write log file: syslog syslog: Permission denied messages will be sent to 'stderr'. Anything else, ...


0

Maybe you forgotten that in your squidGuard.conf: src clients { ip 10.10.101.0/24 }


1

This command: c:/> ktpass -princ HTTP/vmproxy.mydomain.com@MYDOMAIN.COM -mapuser squid@MYDOMAIN.COM -crypto rc4-hmac-nt -pass P@ssw0rd -ptype KRB5_NT_PRINCIPAL -out krb5.keytab I believe sets HTTP/vmproxy.mydomain.com@MYDOMAIN.COM to be a service principal associated with the squid@MYDOMAIN.COM user in AD. Active Directory does not typically allow you ...


0

Numerators and denominators in the squid pool config have different meaning: Numerator is the volume of the flow buffer (bucket) in bytes Denominator is the max allowed flow rate in bytes per second Think about the pool as a tank with two pipes. One pipe fills the tank while other drains it. Throughput of drain pipe defined by denominator. Numerator is ...


0

This is my answer to use PHP scripts as squid external acl in pfsense: ln -s /usr/local/bin/php /usr/pbi/squid-amd64/local/bin/php ln -s /usr/local/lib/php /usr/pbi/squid-amd64/local/lib/php ln -s /usr/local/etc/php.ini /usr/pbi/squid-amd64/local/etc/php.ini


0

You must created the certificate storage yourself. Type the following commands to do it (these are for Ubuntu but CentOS should be quite similar): $ sudo rm -R -f /var/spool/squid3_ssldb $ sudo /bin/ssl_crtd -c -s /var/spool/squid3_ssldb $ sudo chown -R proxy:proxy /var/spool/squid3_ssldb Finally restart your Squid proxy. $ sudo service squid3 restart ...


1

Longneck is right, but to fully answer your question: No. HAproxy doesn't support that feature and almost certainly never will.


2

Squid and haproxy are two very different products. Those features make no sense to be a part of haproxy.



Top 50 recent answers are included