Re: [squid-users] squid transparent proxy + parent proxy

On 28/05/11 04:16, Phillip Evans wrote:
>> You just said this was for "for external users.". Did you mean internal/LAN
>> users? The requirements and limits are very different.
>>
> My apologies, these are internal lan users but external to the
> organisations users i.e. visitors.
>
> We want to allow them to just plug in their machines without
> configuring anything to access the internet
>
>> Also, it is unsafe to set the flags on port 3128. There are at least two
>> popular softwares around which scan port 80 and 3128 for transparent proxies
>> to abuse. Pick a random port for Squid and consider it a secret for use only
>> between squid and iptables. The main 3128 can stay open for management or
>> normal proxy traffic if you like.
>
>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat
>> OR
>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect
>
> Thanks. I'll change the proxy port once we've got it working.
>
> I tried both of the solutions in your links but neither worked.

There is something strange happening on your network.

  One of those two configs are how thousands of other networks around
the world do it and have done for most of the decade.

>
> Some more info: We have access to a normal broadband line (but can
> only use this for testing) so in the mean time i hooked up the squid
> box to this and the client could access the internet fine. I could see
> the requests in the squid access.log so I guess the port redirection
> and transparency must have been working.
>
> But when I put it back on our network and add the parent cache again
> it stops working (but still works if the client puts the squid proxy
> details in)

K. "something strange" is the bit between the wire plugged into Squid
box and the client PC.

>
> Just found out the external proxy is websense if that helps?

As I understand the situation you have now:
  * tested the link to the parent successfully.
  * tested the NAT interception on the Squid box
  * verified that client to port 3128 on the squid box is fine.
  * verified that client to random web IP port 80 does not get to the
Squid box.

Its pretty clear you have some device between Squid and the client which
is guarding port 80. Or failing to route global port 80 traffic to the
Squid box.

What is the network topology from the client all the way to Squid?

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.12
   Beta testers wanted for 3.2.0.7 and 3.1.12.1