0

I have the following config file.Comments and blank lines removed. Lines starting #> are the ones I removed to get normal http to work. But it is still blocked.

acl localnet src 172.16.0.0/12 #docker
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
#>http_access deny !Safe_ports
#>http_access deny CONNECT !SSL_ports
http_access allow localhost manager
#>http_access deny manager
http_access allow localnet
http_access allow localhost
#>http_access deny all
http_port 3128
cache_dir aufs  /media/richard/extra2/squid-cache 20000 16 256
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

https works if I connect to 127.0.0.1; https even works when disabled.

https does not work when connecting to 172.16.0.1, the same machine on the docker interface.

How do I get squid to proxy plain http?

1 Answer 1

0

I added debug_options ALL,1 33,2 to the top of the config file, then found this in the logs:

local=172.17.0.1:3128 remote=192.168.43.64

It looks like it is detecting the remote as my IP address on the external interface. I then added

acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

to the config and it works. Note this is a security problem, as now we allow connections from this network.

I have no idea why the remote IP is not from the same network. I have no idea why https worked. I will use my local firewall, but I would still like a fix (in case the fire wall gets miss-configured).

1
  • I will not accept my own answer, as it does not explain or fully fix the problem. Oct 27, 2017 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .