Re: [squid-users] squid and wccp doesn't work

On Wed, 17 Jun 2009 20:50:40 +0200, Tom Penndorf
<tpenndorf_at_seibert-media.net> wrote:
> Hello,
>
> i'm trying to get squid and wccp on a cisco asa 5510 running. These are
> the steps, i've done to set it up.
> #aptitude install squid3
> #vi /etc/squid3/squid.conf
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localhost
> http_access allow all
> http_access deny all
> icp_access deny all
> htcp_access deny all
> http_port 3128 transparent
> hierarchy_stoplist cgi-bin ?
> cache_dir aufs /var/cache/squid3 30000 32 256
> access_log /var/log/squid3/access.log squid
> cache_log /var/log/squid3/cache.log
> cache_store_log /var/log/squid3/store.log
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern (cgi-bin|\?) 0 0% 0
> refresh_pattern . 0 20% 4320
> wccp2_router 10.1.7.1
> wccp2_forwarding_method 1
> wccp2_return_method 1
> wccp2_service standard 0
> client_persistent_connections off
> icp_port 3130
> coredump_dir /var/spool/squid3
>
> #iptunnel add gre1 mode gre remote $ASA-EXT-IP local 10.1.7.2 dev eth0
>
> #ifconfig gre1 10.1.7.2 netmask 255.255.255.255 up
>
> #echo 0 >/proc/sys/net/ipv4/conf/gre1/rp_filter
>
> #iptables -t nat -A PREROUTING -i gre1 -p tcp --dport 80 -j REDIRECT
> --to-port 3128
> # echo 1 >/proc/sys/ipv4/ip_forward
>
> The asa detects the proxy and redirects the packets. On the
> squid-machine, i can see the syn-packets from the client, but no
> ack-packets.
> The counter for the iptables-rule is also increasing. If i remove the
> iptables-rule, the clients can browse the web, because the squid-machine
> is acting as a router, so the gre-tunnel seems to work correctly.
> After some research, i've found out, that the ack-packets are send out
> at eth0. I don't think, it's the correct way.
>
>
> Are there any things, i've forgotten? All howto's i've found, don't tell
> me any other steps.

Ack is probably between squidIP and clientIP. You may need to SNAT it back
towards the client.

http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect

Amos
Received on Thu Jun 18 2009 - 04:02:36 MDT