my squid.conf(squid3)

acl localnet src
acl localweb src
http_port 3128 transparent
http_access allow localnet
http_access allow localweb

my (server squid that runs a dhcp server also) ip is:

eth0 ip: bcast: netmask:

eth1 ip: bcast: netmask:

The client command I would like to get working is:

curl -x www.google.com

The source IP of the client running curl is:

IP bcast netmask

In addition in the server I also added the following iptables rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 3128

The problem is that the following message is returned to the client when making a request: TCP_DENIED GET www.google.com Err_Access_Denied by squid localhost (squid 3.1.19)

If i do a simple sudo cat /var/log/squid3/access.log, i see:

1 TCP_DENIED/403 3629 GET http://www.google.com

And if i do the curl -L -V i get alot of information but to sum it up:

GET HTTP/1.1 User agent ***** curl
Host: www.google.com Accept: / Proxy-Connection: Keep-Alive HTTP 1.0, assume close after body HTTP/1.0 403 Forbidden Server: squid/3.1.19 X-Cache: Miss from localhost x-Cache-Lookup: NONE from localhost:3128 Via: 1.0 localhost (squid/3.1.19) Closing connection #0

So I assume my client is reaching the host running squid, but Squid is unable to forward the request. I had http_access allow all , but this didn't work either.

  • You have set-up transparent proxy why you are use curl -x? – Navern Aug 25 '14 at 22:44
  • well my attempts run all options the curl www.google.com to curl -x none of them worked – dakuelo amandjadje Aug 25 '14 at 22:48
  • Ok, also not sure if squid works with non-cidr notation. Try to replace acl localweb src with acl localweb src Also make sure that you have restarted squid. Hm...checked documentation it should work the way you have specified ACL. – Navern Aug 25 '14 at 22:52
  • I get on my server the request but they appear denied: TCP_DENIED/403 3629 GET www.google.com – dakuelo amandjadje Aug 25 '14 at 22:57
  • No, it's not port, it's size of the packet. I am still not sure what's wrong here. Stupid question can you do 'curl google.com' from server with squid itself? Also it would be useful to make from client side curl -L -v google.com – Navern Aug 25 '14 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.