Re: PF and Squid 4.6 in intercept mode on OpenBSD 6.5
evaldas <[email protected]> Fri, 17 May 2019 14:42:42 +0200
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_BDA1C10C-276F-4A22-BF6C-1DF41D361229 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, maybe tell squid to listen on localhost and then your browser to use = proxy on localhost:3128, simpler ? As for PF divert-to, it worked for me with =E2=80=9Cdivert-to = localhost=E2=80=9D. Best regards, Evaldas > On 17 May 2019, at 15:46, Mazandar Wiki <[email protected]> = wrote: >=20 > I'm trying to run Squid 4.6 in the intercept mode on OpenBSD 6.5. I've = installed Squid with pkg_add(1), so it is complied with = --disable-pf-transparent and --enable-ipfw-transparent (which seems to = be OK according to various sources). >=20 > I've these lines in /etc/squid/squid.conf >=20 > http_port 192.168.1.100:3128 <http://192.168.1.100:3128/> > http_port 192.168.1.100:3127 <http://192.168.1.100:3127/> intercept >=20 > and /var/squid/log/cache.log reports: >=20 > Accepting NAT intercepted HTTP Socket connections at = local=3D192.168.1.100:3127 <http://192.168.1.100:3127/> remote=3D[::] FD = 14 flags=3D41 >=20 > I've two network interfaces, both of them are in the same subnet, the = first is assigned an IP address of 192.168.1.105, and the second one is = assigned 192.168.1.100 (on which squid listens to the requests). >=20 > I want to divert all my own web traffics to the squid (my goal is just = to have a simple and local web caching mechanism on my laptop). This is = /etc/pf.conf: >=20 > srcaddr =3D "192.168.1.105" > squid =3D "192.168.1.100" >=20 > block return # block stateless traffic > block return in on ! lo0 proto tcp to port 6000:6010 > block return out log proto {tcp udp} user _pbuild >=20 > block all >=20 > pass inet proto {tcp, udp} to port domain > pass inet proto icmp >=20 > pass inet proto tcp from {127.0.0.1, $srcaddr} to port {80 443} \ > divert-to $squid port 3127 >=20 > pass inet proto tcp from 192.168.1.100 to port 80 >=20 > However, it doesn't work. Actually no traffic is diverted to squid and = packets are sent out unchanged to the network through $srcaddr, as = reported by pflog. Web pages are fully accessible, however, they are not = passed through squid (access.log doesn't report anything). >=20 > Could you please tell me what's wrong with this configuration? --Apple-Mail=_BDA1C10C-276F-4A22-BF6C-1DF41D361229 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi, = maybe tell squid to listen on localhost and then your browser to use = proxy on localhost:3128, simpler ?<div class=3D""><br = class=3D""></div><div class=3D"">As for PF divert-to, it worked for me = with =E2=80=9Cdivert-to localhost=E2=80=9D.</div><div class=3D""><br = class=3D""></div><div class=3D"">Best regards,</div><div = class=3D"">Evaldas</div><div class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 17 May 2019, at 15:46, = Mazandar Wiki <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><meta = http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" = class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div = dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" = class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div = dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" = class=3D"">I'm trying to run Squid 4.6 in the intercept mode on OpenBSD = 6.5. I've installed Squid with pkg_add(1), so it is complied = with --disable-pf-transparent and --enable-ipfw-transparent = (which seems to be OK according to various sources).</div><div dir=3D"ltr"= class=3D""><br class=3D""></div><div dir=3D"ltr" class=3D"">I've these = lines in /etc/squid/squid.conf<div class=3D""><br class=3D""></div><div = class=3D""><div class=3D"">http_port <a = href=3D"http://192.168.1.100:3128/" = class=3D"">192.168.1.100:3128</a></div><div class=3D"">http_port <a = href=3D"http://192.168.1.100:3127/" class=3D"">192.168.1.100:3127</a> = intercept</div></div><div class=3D""><br class=3D""></div><div = class=3D"">and /var/squid/log/cache.log reports:</div><div class=3D""><br = class=3D""></div><div class=3D"">Accepting NAT intercepted HTTP Socket = connections at local=3D<a href=3D"http://192.168.1.100:3127/" = class=3D"">192.168.1.100:3127</a> remote=3D[::] FD 14 flags=3D41<br = class=3D""></div><div class=3D""><br class=3D""></div><div class=3D"">I've= two network interfaces, both of them are in the same subnet, the first = is assigned an IP address of 192.168.1.105, and the second one is = assigned 192.168.1.100 (on which squid listens to the = requests).</div><div class=3D""><br class=3D""></div><div class=3D"">I = want to divert all my own web traffics to the squid (my goal is just to = have a simple and local web caching mechanism on my laptop). This is = /etc/pf.conf:</div><div class=3D""><br class=3D""></div><div = class=3D"">srcaddr =3D "192.168.1.105"</div><div class=3D"">squid =3D = "192.168.1.100"</div><div class=3D""><br class=3D""></div><div = class=3D""><div class=3D"">block return # block stateless = traffic</div><div class=3D"">block return in on ! lo0 proto tcp to port = 6000:6010</div><div class=3D"">block return out log proto {tcp udp} user = _pbuild</div><div class=3D""><br class=3D""></div><div class=3D"">block = all</div><div class=3D""><br class=3D""></div><div class=3D"">pass inet = proto {tcp, udp} to port domain</div><div class=3D"">pass inet proto = icmp</div><div class=3D""><br class=3D""></div><div class=3D"">pass inet = proto tcp from {127.0.0.1, $srcaddr} to port {80 443} \</div><div = class=3D""> divert-to $squid port = 3127</div><div class=3D""><br class=3D""></div><div class=3D"">pass inet = proto tcp from 192.168.1.100 to port 80</div></div><div class=3D""><br = class=3D""></div><div class=3D"">However, it doesn't work. Actually no = traffic is diverted to squid and packets are sent out unchanged to the = network through $srcaddr, as reported by pflog. Web pages are fully = accessible, however, they are not passed through squid (access.log = doesn't report anything).</div><div class=3D""><br class=3D""></div><div = class=3D"">Could you please tell me what's wrong with this = configuration?</div></div></div></div></div></div></div></div></div></div>= </div> </div></blockquote></div><br class=3D""></div></body></html>= --Apple-Mail=_BDA1C10C-276F-4A22-BF6C-1DF41D361229--