PF and Squid 4.6 in intercept mode on OpenBSD 6.5

--0000000000000fad8c0589124560
Content-Type: text/plain; charset="UTF-8"

I'm trying to run Squid 4.6 in the intercept mode on OpenBSD 6.5. I've
installed Squid with pkg_add(1), so it is complied
with --disable-pf-transparent and --enable-ipfw-transparent (which seems to
be OK according to various sources).

I've these lines in /etc/squid/squid.conf

http_port 192.168.1.100:3128
http_port 192.168.1.100:3127 intercept

and /var/squid/log/cache.log reports:

Accepting NAT intercepted HTTP Socket connections at local=
192.168.1.100:3127 remote=[::] FD 14 flags=41

I've two network interfaces, both of them are in the same subnet, the first
is assigned an IP address of 192.168.1.105, and the second one is
assigned 192.168.1.100 (on which squid listens to the requests).

I want to divert all my own web traffics to the squid (my goal is just to
have a simple and local web caching mechanism on my laptop). This is
/etc/pf.conf:

srcaddr = "192.168.1.105"
squid = "192.168.1.100"

block return    # block stateless traffic
block return in on ! lo0 proto tcp to port 6000:6010
block return out log proto {tcp udp} user _pbuild

block all

pass inet proto {tcp, udp} to port domain
pass inet proto icmp

pass inet proto tcp from {127.0.0.1, $srcaddr} to port {80 443} \
        divert-to $squid port 3127

pass inet proto tcp from 192.168.1.100 to port 80

However, it doesn't work. Actually no traffic is diverted to squid and
packets are sent out unchanged to the network through $srcaddr, as reported
by pflog. Web pages are fully accessible, however, they are not passed
through squid (access.log doesn't report anything).

Could you please tell me what's wrong with this configuration?

--0000000000000fad8c0589124560
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"lt=
r"><div dir=3D"ltr">I&#39;m trying to run Squid 4.6 in the intercept mode o=
n OpenBSD 6.5. I&#39;ve installed Squid with pkg_add(1), so it is complied =
with=C2=A0--disable-pf-transparent and=C2=A0--enable-ipfw-transparent (whic=
h seems to be OK according to various sources).</div><div dir=3D"ltr"><br><=
/div><div dir=3D"ltr">I&#39;ve these lines in /etc/squid/squid.conf<div><br=
></div><div><div>http_port <a href=3D"http://192.168.1.100:3128">192.168.1.=
100:3128</a></div><div>http_port <a href=3D"http://192.168.1.100:3127">192.=
168.1.100:3127</a> intercept</div></div><div><br></div><div>and /var/squid/=
log/cache.log reports:</div><div><br></div><div>Accepting NAT intercepted H=
TTP Socket connections at local=3D<a href=3D"http://192.168.1.100:3127">192=
.168.1.100:3127</a> remote=3D[::] FD 14 flags=3D41<br></div><div><br></div>=
<div>I&#39;ve two network interfaces, both of them are in the same subnet, =
the first is assigned an IP address of=C2=A0192.168.1.105, and the second o=
ne is assigned=C2=A0192.168.1.100 (on which squid listens to the requests).=
</div><div><br></div><div>I want to divert all my own web traffics to the s=
quid (my goal is just to have a simple and local web caching mechanism on m=
y laptop). This is /etc/pf.conf:</div><div><br></div><div>srcaddr =3D &quot=
;192.168.1.105&quot;</div><div>squid =3D &quot;192.168.1.100&quot;</div><di=
v><br></div><div><div>block return=C2=A0 =C2=A0 # block stateless traffic</=
div><div>block return in on ! lo0 proto tcp to port 6000:6010</div><div>blo=
ck return out log proto {tcp udp} user _pbuild</div><div><br></div><div>blo=
ck all</div><div><br></div><div>pass inet proto {tcp, udp} to port domain</=
div><div>pass inet proto icmp</div><div><br></div><div>pass inet proto tcp =
from {127.0.0.1, $srcaddr} to port {80 443} \</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 divert-to $squid port 3127</div><div><br></div><div>pass inet pr=
oto tcp from 192.168.1.100 to port 80</div></div><div><br></div><div>Howeve=
r, it doesn&#39;t work. Actually no traffic is diverted to squid and packet=
s are sent out unchanged to the network through=C2=A0$srcaddr, as reported =
by pflog. Web pages are fully accessible, however, they are not passed thro=
ugh squid (access.log doesn&#39;t report anything).</div><div><br></div><di=
v>Could you please tell me what&#39;s wrong with this configuration?</div><=
/div></div></div></div></div></div></div></div></div></div>

--0000000000000fad8c0589124560--