0

my squid.conf(squid3)

acl localnet src 192.168.1.0/255.255.255.0
acl localweb src 192.168.199.0/255.255.255.0
http_port 3128 transparent
http_access allow localnet
http_access allow localweb

my (server squid that runs a dhcp server also) ip is:

eth0 ip: 192.168.1.10 bcast: 192.168.1.255 netmask: 255.255.255.0

eth1 ip: 192.168.199.1 bcast: 192.168.199.255 netmask: 255.255.255.255

The client command I would like to get working is:

curl -x 192.168.1.10:3128 www.google.com

The source IP of the client running curl is:

IP 192.168.199.10 bcast 192.168.199.255 netmask 255.255.255.0

In addition in the server I also added the following iptables rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 3128

The problem is that the following message is returned to the client when making a request:

192.168.199.10 TCP_DENIED GET www.google.com Err_Access_Denied by squid localhost (squid 3.1.19)

If i do a simple sudo cat /var/log/squid3/access.log, i see:

1 192.168.199.10 TCP_DENIED/403 3629 GET http://www.google.com

And if i do the curl -L -V i get alot of information but to sum it up:

GET HTTP/1.1 User agent ***** curl
Host: www.google.com Accept: / Proxy-Connection: Keep-Alive HTTP 1.0, assume close after body HTTP/1.0 403 Forbidden Server: squid/3.1.19 X-Cache: Miss from localhost x-Cache-Lookup: NONE from localhost:3128 Via: 1.0 localhost (squid/3.1.19) Closing connection #0

So I assume my client is reaching the host running squid, but Squid is unable to forward the request. I had http_access allow all , but this didn't work either.

  • You have set-up transparent proxy why you are use curl -x? – Navern Aug 25 '14 at 22:44
  • well my attempts run all options the curl www.google.com to curl -x none of them worked – dakuelo amandjadje Aug 25 '14 at 22:48
  • Ok, also not sure if squid works with non-cidr notation. Try to replace acl localweb src 192.168.199.0/255.255.255.0 with acl localweb src 192.168.199.0/24. Also make sure that you have restarted squid. Hm...checked documentation it should work the way you have specified ACL. – Navern Aug 25 '14 at 22:52
  • I get on my server the request but they appear denied: 192.168.119.10 TCP_DENIED/403 3629 GET www.google.com – dakuelo amandjadje Aug 25 '14 at 22:57
  • No, it's not port, it's size of the packet. I am still not sure what's wrong here. Stupid question can you do 'curl google.com' from server with squid itself? Also it would be useful to make from client side curl -L -v google.com – Navern Aug 25 '14 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.