| Newsgroups |
gmane.comp.security.ipcop.user |
| Message-ID |
<[email protected]> |
I am using squid and squidguard on an v2.1.4 install.
I have added in two extra interfaces so that I can have different wifi
ssid. kids/adults/ other etc.
All of that works. squid works on blue and green fine.
But I can't get squid proxy to work on eth0/1, what am I missing? What
do you need?
eth0/1 are the extra nics, wlan-1 is bog standard ipcop.
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.10.254 netmask 255.255.255.0 broadcast 0.0.0.0
ether 00:15:17:19:0a:e8 txqueuelen 1000 (Ethernet)
RX packets 5886036 bytes 947748671 (903.8 MiB)
RX errors 0 dropped 814 overruns 0 frame 0
TX packets 13385005 bytes 18647178679 (17.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16 memory 0xd0020000-d0040000
eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 10.20.10.254 netmask 255.255.255.0 broadcast 0.0.0.0
ether 00:15:17:19:0a:e9 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 17 memory 0xd0060000-d0080000
wlan-1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.1.0.254 netmask 255.255.255.0 broadcast 0.0.0.0
ether 00:10:13:50:a3:43 txqueuelen 1000 (Ethernet)
RX packets 30866841 bytes 1329130996 (1.2 GiB)
RX errors 4229 dropped 16878 overruns 983 frame 5320
TX packets 36454958 bytes 2019605958 (1.8 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
iptables output, grepped
root@wr-fw:~ # iptables -nt nat -L>a;iptables -nt filter -L>>a;iptables
-n -L>>a;egrep "80|81|82|83" a
REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
redir ports 82
RETURN tcp -- 0.0.0.0/0 81.142.230.0/28 tcp dpt:80
REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
redir ports 82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8022
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol none tcp dpt:8022
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8022
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:81
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol ipsec proto 50 tcp dpt:82
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 policy match dir in
pol none tcp dpt:8022
I don't see anything in there that is blue/green specific.
How can I tell if squid is processing requests, maybe it is all working
and my config is wrong?
root@wr-fw:~ # netstat -anp|grep squid
tcp 0 0 10.10.10.254:8080 0.0.0.0:*
LISTEN 25134/(squid-1)
tcp 0 0 10.1.0.254:8080 0.0.0.0:* LISTEN
25134/(squid-1)
tcp 0 0 192.158.202.130:8080 0.0.0.0:*
LISTEN 25134/(squid-1)
tcp 0 0 10.10.10.254:82 0.0.0.0:* LISTEN
25134/(squid-1)
tcp 0 0 10.1.0.254:82 0.0.0.0:* LISTEN
25134/(squid-1)
tcp 0 0 192.158.202.130:82 0.0.0.0:*
LISTEN 25134/(squid-1)
tcp 0 0 127.0.0.1:82 0.0.0.0:* LISTEN
25134/(squid-1)
<snip>
unix 2 [ ] DGRAM 102969564
25164/(squidGuard)
unix 3 [ ] STREAM CONNECTED 102969011
25164/(squidGuard)
unix 3 [ ] STREAM CONNECTED 102969010 25134/(squid-1)
unix 2 [ ] DGRAM 102969401 25134/(squid-1)
unix 2 [ ] DGRAM 102969359 25131/squid
eth0 is the one of interest, eth1 does not yet have a cable in it.
root@wr-fw:/var/ipcop/proxy # grep 10.10.10 *
squid.conf:http_port 10.10.10.254:8080
squid.conf:http_port 10.10.10.254:82 intercept
squid.conf:acl quokka src 10.10.10.0/24
root@wr-fw:/var/ipcop/proxy # grep 10.1.0 *
squid.conf:http_port 10.1.0.254:8080
squid.conf:http_port 10.1.0.254:82 intercept
squid.conf:acl IPCop_blue_network src 10.1.0.0/24
squid.conf:acl IPCop_blue_servers dst 10.1.0.0/24
squid.conf:acl wlan src 10.1.0.0/24
It looks like squid is listening and doing stuff
grep Accepting squid/cache.log|grep local=
<snip>
2016/06/29 15:39:45 kid1| Accepting NAT intercepted HTTP Socket
connections at local=10.10.10.254:82 remote=[::] FD 18 flags=41
2016/06/29 15:48:02 kid1| Accepting HTTP Socket connections at
local=127.0.0.1:82 remote=[::] FD 12 flags=9
2016/06/29 15:48:02 kid1| Accepting HTTP Socket connections at
local=127.0.0.1:82 remote=[::] FD 12 flags=9
2016/06/29 15:48:02 kid1| Accepting HTTP Socket connections at
local=192.158.202.130:8080 remote=[::] FD 13 flags=9
2016/06/29 15:48:02 kid1| Accepting NAT intercepted HTTP Socket
connections at local=192.158.202.130:82 remote=[::] FD 14 flags=41
2016/06/29 15:48:02 kid1| Accepting HTTP Socket connections at
local=10.1.0.254:8080 remote=[::] FD 15 flags=9
2016/06/29 15:48:02 kid1| Accepting NAT intercepted HTTP Socket
connections at local=10.1.0.254:82 remote=[::] FD 16 flags=41
2016/06/29 15:48:02 kid1| Accepting HTTP Socket connections at
local=10.10.10.254:8080 remote=[::] FD 17 flags=9
2016/06/29 15:48:02 kid1| Accepting NAT intercepted HTTP Socket
connections at local=10.10.10.254:82 remote=[::] FD 18 flags=41
I would like to get it to work, but I can think of a different solution
that is not a good but will work.
PS:
I did notice this
root@wr-fw:/var/log # iptables -tnat -L SQUID
Chain SQUID (1 references)
target prot opt source destination
RETURN tcp -- anywhere
host81-142-230-0.in-addr.btopenworld.com/28 tcp dpt:http
REDIRECT tcp -- anywhere anywhere tcp
dpt:http redir ports 82
RETURN tcp -- anywhere
host81-142-230-0.in-addr.btopenworld.com/28 tcp dpt:http
REDIRECT tcp -- anywhere anywhere tcp
dpt:http redir ports 82
and suspect that this is from blue/green transparent redirect check box,
I think the source address of blue/green network should be in there.
But I think is unrelated to my problem.
--
'ooroo
Stinga...(:)-)
---------------------------------------------------
Email: [email protected] o
You need only two tools. o /////
A hammer and duct tape. If it /@ `\ /) ~
doesn't move and it should use > (O) X< ~ Fish!!
the hammer. If it moves and `\___/' \) ~
shouldn't, use the tape. \\\
---------------------------------------------------
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user