<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<b>squid.conf:<br>
</b>acl manager proto cache_object<br>
acl localhost src 127.0.0.1/32<br>
acl to_localhost dst 127.0.0.0/8<br>
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network<br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl CONNECT method CONNECT<br>
http_access allow manager localhost<br>
http_access deny manager<br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
http_access allow localnet<br>
http_access allow localhost<br>
http_access deny all<br>
icp_access deny all<br>
htcp_access deny all<br>
http_port 3128 <br>
http_port 3129 tproxy<br>
hierarchy_stoplist cgi-bin ?<br>
cache_mem 100 MB<br>
cache_dir ufs /var/spool/squid 100 16 256<br>
access_log /var/log/access.log squid<br>
cache_log /var/log/cache.log<br>
refresh_pattern ^ftp: 1440 20% 10080<br>
refresh_pattern ^gopher: 1440 0% 1440<br>
refresh_pattern (cgi-bin|\?) 0 0% 0<br>
refresh_pattern . 0 20% 4320<br>
icp_port 3130<br>
coredump_dir /var/spool/squid<br>
<br>
<b>iptables configuration:</b><br>
iptables -t mangle -N DIVERT<br>
iptables -t mangle -A DIVERT -j MARK --set-mark 1<br>
iptables -t mangle -A DIVERT -j DROP<br>
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT<br>
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY
--tproxy-mark 0x1/0x1 --on-port 3129<br>
ip rule add fwmark 1 lookup 100<br>
ip route add local 0.0.0.0/0 dev lo table 100<br>
<br>
<b>squid -v:</b><br>
Squid Cache: Version 3.1.0.13<br>
configure options: '--prefix=/usr' '--localstatedir=/var'
'--libexecdir=/usr/lib/squid' '--srcdir=.' '--datadir=/usr/share/squid'
'--sysconfdir=/etc/squid' '--with-default-user=proxy'
'--with-logdir=/var/log' '--with-pidfile=/var/run/squid.pid'
'--enable-linux-netfilter' --with-squid=/usr/src/squid-3.1.0.13
--enable-ltdl-convenience<br>
<br>
<b>network cenario:</b><br>
pc => proxy/squid/tproxy => router<br>
<br>
<br>
<div class="moz-signature">
<meta http-equiv="CONTENT-TYPE" content="text/html; ">
<title></title>
<font style="font-size: 8pt;" color="#000080"
face="Bitstream Vera Sans, sans-serif" size="2"><b>José
Oliveira de Almeida Filho</b></font><br>
<font style="font-size: 8pt;" color="#666666"
face="Bitstream Vera Sans, sans-serif" size="2">Analista
de Redes</font><br>
<font style="font-size: 8pt;" color="#666666"
face="Bitstream Vera Sans, sans-serif" size="2">SERPRO/SUPRE/REPRO/RERCE</font><br>
<font face="Bitstream Vera Sans, sans-serif"><font
style="font-size: 8pt;" size="2"><font color="#ff9900"><b>(</b></font><b>
</b><font color="#000080">+55 0XX 81 2126 4016</font></font></font><br>
<font face="Bitstream Vera Sans, sans-serif"><font
style="font-size: 8pt;" size="2"><font color="#ff9900"><b>*</b></font>
<font color="#000080"><u><a class="moz-txt-link-abbreviated" href="mailto:jose.almeida-filho@serpro.gov.br">jose.almeida-filho@serpro.gov.br</a></u></font></font></font>
</div>
<br>
<br>
Asif Bakali escreveu:
<blockquote
cite="mid:22a908520908140751ib1fb500u96e0fbf63a39e3ca@mail.gmail.com"
type="cite">
<div>Gday </div>
<div>post your squid conf , iptables configuraion , squid -v compile
options and network senario </div>
<div><br>
<br>
</div>
<div class="gmail_quote">On Fri, Aug 14, 2009 at 12:40 AM, Jose
Oliveira de Almeida Filho <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:jose.almeida-filho@serpro.gov.br">jose.almeida-filho@serpro.gov.br</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0px 0px 0px 0.8ex; padding-left: 1ex;">
<div text="#000000" bgcolor="#ffffff">Hi,<br>
<br>
I'm problems for caching squid.<br>
<br>
My situation is:<br>
<br>
The squid isn't writing in access.log, but the traffic is arriving to
destination with origin ip. <br>
The squid isn't doing caching too.<br>
<br>
The cards are in mode bridge e the permissons are for user proxy
normally (+w).<br>
When stop squid, the traffic stop too, indicanting that the iptables
transfer packets to squid (http_port 3129 tproxy)<br>
<br>
Att.,<br>
<br>
<div>-- <br>
<font style="font-size: 8pt;" color="#000080"
face="Bitstream Vera Sans, sans-serif" size="2"><b>José Oliveira de
Almeida Filho</b></font><br>
<font style="font-size: 8pt;" color="#666666"
face="Bitstream Vera Sans, sans-serif" size="2">Analista de Redes</font><br>
<font style="font-size: 8pt;" color="#666666"
face="Bitstream Vera Sans, sans-serif" size="2">SERPRO/SUPRE/REPRO/RERCE</font><br>
<font face="Bitstream Vera Sans, sans-serif"><font
style="font-size: 8pt;" size="2"><font color="#ff9900"><b>(</b></font><b>
</b><font color="#000080">+55 0XX 81 2126 4016</font></font></font><br>
<font face="Bitstream Vera Sans, sans-serif"><font
style="font-size: 8pt;" size="2"><font color="#ff9900"><b>*</b></font>
<font color="#000080"><u><a moz-do-not-send="true"
href="mailto:jose.almeida-filho@serpro.gov.br" target="_blank">jose.almeida-filho@serpro.gov.br</a></u></font></font></font>
</div>
</div>
<table>
<tbody>
<tr>
<td bgcolor="#ffffff"><font color="#000000">
<pre>"Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco."
"This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."</pre>
</font></td>
</tr>
</tbody>
</table>
<br>
_______________________________________________<br>
tproxy mailing list<br>
<a moz-do-not-send="true" href="mailto:tproxy@lists.balabit.hu">tproxy@lists.balabit.hu</a><br>
<a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/tproxy" target="_blank">https://lists.balabit.hu/mailman/listinfo/tproxy</a><br>
<br>
</blockquote>
</div>
<br>
</blockquote>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre>"Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco."
"This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."</pre></font></td></tr></table>