[prev in list] [next in list] [prev in thread] [next in thread]
List: squid-users
Subject: Re: [squid-users] NetfilterInterception: NF > getsockopt(SO_ORIGINAL_DST) errors
From: kAja Ziegler <ziegleka () gmail ! com>
Date: 2018-05-22 12:30:10
Message-ID: CAMuNeAs6-mcXgNpU=KoJhsEMx-Pqm_U9x3UL0UyKf3r=XF+cMg () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
On Tue, May 22, 2018 at 12:24 PM, Amos Jeffries <squid3@treenet.co.nz>
wrote:
> On 22/05/18 22:06, kAja Ziegler wrote:
> > This is strange because I don't use any NAT iptables/netfilter rules on
> > this server:
> >
> > [root@...]# iptables -n -L -v -t nat
> > Chain PREROUTING (policy ACCEPT 26964 packets, 1870K bytes)
> > pkts bytes target prot opt in out source
> > destination
> >
> > Chain POSTROUTING (policy ACCEPT 11013 packets, 817K bytes)
> > pkts bytes target prot opt in out source
> > destination
> >
> > Chain OUTPUT (policy ACCEPT 11015 packets, 817K bytes)
> > pkts bytes target prot opt in out source
> > destination-
>
> That lack of NAT rules would be why Squid cannot find any entries for
> the traffic in the kernels NAT state table.
>
>
> >
> >
> > Only one weird thing I found in my Squid configuration - I had defined
> > only one http_port (http_port 3128 intercept) and this port was used to
> > access proxy via explicit definitions in systems or applications -
> > without any REDIRECT or marking in iptables/netfilter rules
>
> There is the problem. That "intercept" mode/flag means NAT intercepted
> traffic is the only type you are going to receive there.
>
> Explicit / forward proxy is the "normal" traffic case for proxies. A
> port to receive that traffic is configured without any special mode
> flag. Just:
> http_port 3128
>
>
> Amos
> _______________________________________________
> squid-users mailing list
> squid-users@lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users
>
Hi Amos,
It's silly that I did not notice these errors earlier. I found them in the
log just recently.
Communication via proxy in this configuration (with http_port 3128
intercept) has worked well for years.
I've removed the intercept from the configuration, so I'll see.
Thank you and with best regqards
--
Karel Ziegler
[Attachment #5 (text/html)]
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, May 22, 2018 \
at 12:24 PM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" \
target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid \
rgb(204,204,204);padding-left:1ex">On 22/05/18 22:06, kAja Ziegler wrote:<br> > \
This is strange because I don't use any NAT iptables/netfilter rules on<br> > \
this server:<br> > <br>
> [root@...]# iptables -n -L -v -t nat<br>
> Chain PREROUTING (policy ACCEPT 26964 packets, 1870K bytes)<br>
> pkts bytes target prot opt in out source \
<br> > destination<br>
> <br>
> Chain POSTROUTING (policy ACCEPT 11013 packets, 817K bytes)<br>
> pkts bytes target prot opt in out source \
<br> > destination<br>
> <br>
> Chain OUTPUT (policy ACCEPT 11015 packets, 817K bytes)<br>
> pkts bytes target prot opt in out source \
<br> > destination-<br>
<br>
That lack of NAT rules would be why Squid cannot find any entries for<br>
the traffic in the kernels NAT state table.<br>
<br>
<br>
> <br>
> <br>
> Only one weird thing I found in my Squid configuration - I had defined<br>
> only one http_port (http_port 3128 intercept) and this port was used to<br>
> access proxy via explicit definitions in systems or applications -<br>
> without any REDIRECT or marking in iptables/netfilter rules<br>
<br>
There is the problem. That "intercept" mode/flag means NAT intercepted<br>
traffic is the only type you are going to receive there.<br>
<br>
Explicit / forward proxy is the "normal" traffic case for proxies. A<br>
port to receive that traffic is configured without any special mode<br>
flag. Just:<br>
http_port 3128<br>
<br>
<br>
Amos<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" \
target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br> <a \
href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" \
target="_blank">http://lists.squid-cache.org/l<wbr>istinfo/squid-users</a><br> \
</blockquote></div></div><div class="gmail_extra"><br></div><div \
class="gmail_extra">Hi Amos,<br></div><div class="gmail_extra"><br></div><div \
class="gmail_extra"><span id="gmail-result_box" class="gmail-" lang="en"><span \
class="gmail-">It's silly that I did not notice these errors earlier.</span> \
<span class="gmail-">I found them in the log just recently.</span></span></div><div \
class="gmail_extra"><br></div><div class="gmail_extra"><span id="gmail-result_box" \
class="gmail-" lang="en"><span class="gmail-">Communication via proxy in this \
configuration (with http_port 3128 intercept) has worked well for \
years.</span></span><br></div><div class="gmail_extra"><br></div><div \
class="gmail_extra">I've removed the intercept from the configuration, so \
I'll see.<br></div><div class="gmail_extra"><br></div><div \
class="gmail_extra"><br><div class="gmail_extra">Thank you and with best regqards<br \
clear="all"></div><div class="gmail_extra"><div><div \
class="gmail-m_2435912431202475170gmail_signature">-- <br>Karel \
Ziegler<br><br></div></div></div><br></div></div>
[Attachment #6 (text/plain)]
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic