0

I have two linux gateway using squid as transparent proxy. When I using them individually, everything is fine. But when I using them in the same network, every request from browser will return 403.

The network topological structure like this:

Client -> | Transparent gateway A -> Transparent gateway B | -> Internet

        A:172.16.0.1       B:10.190.90.1
  1. If gateway A or gateway B not exists, everything is fine.
  2. If they both exist, client browser always get 403.

iptables setting is:

sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 3128

EDIT:

both gateways' squid.conf are:

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network

acl localnet src 172.16.0.0/12 # RFC1918 possible internal network

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

acl localnet src fc00::/7 # RFC 4193 local private network range

acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged)

acl SSL_ports port 443

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 443 # https

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

http_access allow localhost manager

http_access deny manager

http_access allow localnet

http_access allow localhost

http_access deny all

http_port 3128 intercept

http_port 3129

  • What are ACLs on both squid setup ? – Xavier Lucas Nov 22 '14 at 8:59
  • @XavierLucas Please read the edited part. – Loong Nov 22 '14 at 10:38
  • Check the logs to see which proxy actually returns the 403, and try to curl a website from gateway A and see if that works. – user186340 Nov 22 '14 at 12:09
  • @AndréDaniel both proxy return 403, and curl a website from gateway A works normally. – Loong Nov 24 '14 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.