Re: [squid-users] FW: WCCP and Fedora 3 not working

 Hii there,
                u mean that i cant make wccp work with kernel 2.6.9 , as u
backed down to 2.6.8 to make it work.

----- Original Message -----
From: "Damian-Grint Philip" <pdamian-grint@collierscre.co.uk>
To: "Nigel Oakley" <nigel@oakley.vnworks.net>; <squid-users@squid-cache.org>
Sent: Friday, May 20, 2005 7:15 PM
Subject: RE: [squid-users] FW: WCCP and Fedora 3 not working

Hi Nigel,

I have just upgraded all my Redhat 7.2 Squid servers to Fedora FC3, and
I have WCCP working fine.

It sounds like you have the squid wccp bit done ok - that's what does
the hello stuff. - check your output from debug ip icmp on your router -
if you're getting protocol unreachable, the problem is your wccp
interception at the kernel on your squid box.

I backed the kernel down to 2.6.8, only because that is what the wccp
module had been supposedly written for. You shouldn't need to play
around with sysctl settings, although you might need to switch off ECN
if on and your testing indicates a need.

I've never used ip_gre, only the ip_wccp module:

Download the ip_wccp.c module from the Squid FAQ into /var/tmp

echo 'obj-m := ip_wccp.o' > Makefile
make -C /usr/src/linux M=$PWD V=1 modules
cp ip_wccp.ko /lib/modules/2.6.8/kernel/net/ipv4
edit modules dep file (vi /lib/modules/2.6.8/modules.dep) and add the
following line:
/lib/modules/2.6.8/kernel/net/ipv4/ip_wccp.ko:

modprobe ip_wccp

Squid config fragment:

wccp_version 4
wccp_router 10.129.110.251
snmp_port 3401
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

Cisco config:

ip wccp web-cache redirect-list 100
ip wccp version 1
ip cef

interface fa0/0
! facing the firewall
ip wccp web-cache redirect out
no ip redirects
ip route-cache same-interface

interface fa0/1
! facing the internal network

! don't classify internal traffic
access-list 100 deny ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
! classify internet bound traffic
access-list 100 permit 10.0.0.0 0.255.255.255 any
access-list 100 deny ip any

IPtables config:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT \
--to-port 3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT \
--to 127.0.0.1:3128

Hope that something in the above sorts your problem, otherwise let me
know and I will send you my (tediously long) build log which I wrote for
the non-linux guys here.

Regards

Philip Damian-Grint
CCNP
Infrastructure Team
Business Systems & IT
Colliers CRE
Tel. +44(0)20 7487 1928
Fax. +44(0)20 7487 1671

Confidentiality Notice
This communication and the information it contains:
(a) is intended for the person(s) or Organisation(s) named above and for no
other persons or organisations and,
(b) may be confidential, legally privileged and protected by law.
Unauthorised use, copying or disclosure of any of it may be unlawful.
When addressed to our clients any opinions or advice contained in this
e-mail are subject to CCRE's terms and conditions of business notified to
the client or expressed in the governing client engagement letter.
If you receive this communication in error, please notify us immediately,
destroy any copies and delete it from your computer system.
Received on Sun May 22 2005 - 03:40:32 MDT