Re: [squid-users] unable to bypass AUP page with local servers

Johnson, S wrote:
> Hello,
>
> I've got a weird issue that I've been finding off an on. I can finally
> duplicate it regularly now. I'm working with a "public" network that
> we've separated from the local network. We have web resources that are
> on the external side of the squid box.
>
> This is what our network looks like:
>
> --------public network 65.80.133.x--------
> | |
> | public network
> firewall---(nat)DMZ (192.168.80.x/23)
> | (192.168.2.0/24)
> | (web servers)
> |
> |
> private network
> (10.x.x.x)
> The squid server here is configured with an AUP page with a click
> through to continue to the site they originally were trying to get to.
> Any page outside of our network altogether works great; they get the AUP
> and the click through it. However, if they try to access the local web
> server which shares the same external subnet as the squid server then I
> cannot click past the AUP.
>
> To make this a little more complex, I'm attempting to do this through
> transparent proxy. I've also got DNS configured to provide a WPAD file.
> If I use the autoproxy config in the browser then it works just fine
> (which is why it was working for me). Once I turn this off in the
> browser I once again cannot get to the local web server but other
> outside sites work just fine. I don't see any hits in the log if I try
> to browse the local web server which makes me believe that the traffic
> isn't even hitting the proxy. However, it should since there are no
> local routes on the workstation that would do otherwise. It's like the
> proxy server isn't picking up the packets at all...
>
> Oh one more weird thing... if I set myweb in the acl below at the top
> of the ACL list then I'm able to get to the local servers but the AUP
> page never shows if their homepage is set to the local web server. I
> guess I would expect this behavior since I've never denied the session.
> I've tried moving the myweb acl around the whole list but I don't get
> any other results...
>
> This is my config:
>
> # TAG: acl
> #Recommended minimum configuration:
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8
> acl to_localbox dst 192.168.80.5/32
> acl myweb dst 64.80.132.1/32
>
>
> follow_x_forwarded_for allow localhost
> acl_uses_indirect_client on
> delay_pool_uses_indirect_client on
> log_uses_indirect_client on
>
>
> external_acl_type session ttl=10 children=1 negative_ttl=0
> concurrency=200 %SRC /usr/lib/squid/squid_session -t 1800
>
> acl session external session
>
> acl localnet src 192.168.80.0/23 # RFC1918 possible internal network
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
>
> # TAG: http_access
> http_access allow to_localbox
> deny_info http://192.168.80.5/index.php?url=%s session

Using the IP address in the URL like that breaks when NAT is involved.
Clients outside the 192.* routable network won't ever be able to open
the page directly.

You need some form of publicly resolvable domain name that resolves to a
the relevant IP for each network.

> #http_access allow myweb #trying different locations for the session to
> be set
> http_access deny !Safe_portshttp_access allow session

I hope that was a typo of the cut-n-paste process?

> http_access allow SSL_ports
> http_access allow CONNECT SSL_ports
> http_access deny !session
> http_access allow myweb
> http_access deny !Safe_ports
>
> http_access deny all
>
> http_port 3128 transparent

Due to CVE-2009-0801 it's no longer safe practice to receive NAT
intercepted traffic on the same port as normal proxy traffic.

Another port should be chosen and secured for the private channel
between Squid and the firewall doing NAT.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.1