Re: [squid-users] squid and wccp doesn't work

Hi Tom,

Exactly the same problem I have. Please let me know if you come
across anything.

-Parvinder Bhasin

On Jun 17, 2009, at 11:50 AM, Tom Penndorf wrote:

> Hello,
>
> i'm trying to get squid and wccp on a cisco asa 5510 running. These
> are the steps, i've done to set it up.
> #aptitude install squid3
> #vi /etc/squid3/squid.conf
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localhost
> http_access allow all
> http_access deny all
> icp_access deny all
> htcp_access deny all
> http_port 3128 transparent
> hierarchy_stoplist cgi-bin ?
> cache_dir aufs /var/cache/squid3 30000 32 256
> access_log /var/log/squid3/access.log squid
> cache_log /var/log/squid3/cache.log
> cache_store_log /var/log/squid3/store.log
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern (cgi-bin|\?) 0 0% 0
> refresh_pattern . 0 20% 4320
> wccp2_router 10.1.7.1
> wccp2_forwarding_method 1
> wccp2_return_method 1
> wccp2_service standard 0
> client_persistent_connections off
> icp_port 3130
> coredump_dir /var/spool/squid3
>
> #iptunnel add gre1 mode gre remote $ASA-EXT-IP local 10.1.7.2 dev eth0
>
> #ifconfig gre1 10.1.7.2 netmask 255.255.255.255 up
>
> #echo 0 >/proc/sys/net/ipv4/conf/gre1/rp_filter
>
> #iptables -t nat -A PREROUTING -i gre1 -p tcp --dport 80 -j REDIRECT
> --to-port 3128
> # echo 1 >/proc/sys/ipv4/ip_forward
>
> The asa detects the proxy and redirects the packets. On the squid-
> machine, i can see the syn-packets from the client, but no ack-
> packets.
> The counter for the iptables-rule is also increasing. If i remove
> the iptables-rule, the clients can browse the web, because the squid-
> machine is acting as a router, so the gre-tunnel seems to work
> correctly.
> After some research, i've found out, that the ack-packets are send
> out at eth0. I don't think, it's the correct way.
>
>
> Are there any things, i've forgotten? All howto's i've found, don't
> tell me any other steps.
>
> System is Debian lenny with squid 3.0.STABLE8-3.
>
> Is there anyone, who can give me a hint?
>
> Thanks,
>
> Tom
>
Received on Wed Jun 17 2009 - 19:01:21 MDT