[squid-users] Re: Cannont Access SSL sites

We still have problems with SOME computers in the LAN eventhough we opened port 443 in the whole network directly to internet.
When we access ssl sites it says "connection restarted"

----- Mensaje original -----
De: "Jorge Perez" <jorge.perez_at_via.cl>
Para: "squid-users" <squid-users_at_squid-cache.org>
Enviados: Martes, 22 de Junio 2010 14:48:29 (GMT-0400) Auto-Detected
Asunto: Cannont Access SSL sites

Hello we are using transparent squid, but we cant access sites that use ssl like gmail, banks etc.

But if we set the proxy on the web browser it works fine.

heres is my squid.conf
---------------------------------------------------

http_port 192.168.169.3:3128 transparent
cache_dir ufs /usr/local/squid/var/cache 250 16 256
cache_effective_user squid
cache_effective_group squid
access_log /usr/local/squid/var/logs/access.log squid
################################
acl localnet src 192.168.169.0/255.255.255.0
acl localhost src 127.0.0.1/255.255.255.255
acl all src 0.0.0.0/0.0.0.0
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#### SITIOS BLOKEADOS #####
acl restobb src 192.168.169.1-192.168.169.129
acl sucky_urls dstdomain .facebook.com .twitter.com .doubleclick.com .fotolog.com .warez-bb.org .fotolog.cl .chilewarez.org .rapidshare.com .megaupload.com .rapidshare.de .medi$
deny_info http://www.trabajoweb.cl/error.html sucky_urls
http_access deny restobb sucky_urls
######################## NO DESCARGAS #####
acl resto src 192.168.169.1-192.168.169.29/32
acl descargas_negadas url_regex -i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov .torrent
deny_info http://www.trabajoweb.cl/error.html descargas_negadas
http_access deny resto descargas_negadas
######################## SITIOS CASI BLOKEADOS ###############
acl restobb2 src 192.168.169.130-192.168.169.149
acl sucky_urls2 dstdomain .doubleclick.com .fotolog.com .warez-bb.org .fotolog.cl .chilewarez.org .rapidshare.com .megaupload.com .rapidshare.de .mediafire.com .depositfiles.co$
deny_info http://www.trabajoweb.cl/error.html sucky_urls2
http_access deny restobb2 sucky_urls2
########################
http_access allow CONNECT SSL_ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
########################
http_access allow localnet
http_access allow localhost
http_access deny all
##############################
http_reply_access allow localnet
http_reply_access deny all
#############################
#REGLAS DESCARGAS
acl normales src 192.168.169.30-192.168.169.129/32
acl tecnicos src 192.168.169.130-192.168.169.149/32
acl administrador src 192.168.169.150-192.168.169.189/32
acl estudio src 192.168.169.190-192.168.169.219/32
acl gerencia src 192.168.169.220-192.168.169.252/32
acl descargas url_regex -i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov

delay_pools 5

delay_class 1 1
delay_parameters 1 10240/10485760 10240/10485760
delay_access 1 allow normales descargas
delay_access 1 deny all

delay_class 2 1
delay_parameters 2 30720/104857600 30720/104857600
delay_access 2 allow tecnicos descargas
delay_access 2 deny all

delay_class 3 1
delay_parameters 3 30720/104857600 30720/104857600
delay_access 3 allow administrador descargas
delay_access 3 deny all

delay_class 4 1
delay_parameters 4 -1/-1 -1/-1
delay_access 4 allow gerencia descargas
delay_access 4 deny all

delay_class 5 1
delay_parameters 5 10240/10240 10240/10240
delay_access 5 allow estudio descargas
delay_access 5 deny all
------------------------------------------------------

My Iptables rules:

echo "Aplicando reglas iptables..."
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -F
iptables -X
iptables -Z

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -i eth2 -s 192.168.169.0/24 -d ! 192.168.169.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth2 -s 192.168.169.0/24 -d ! 192.168.169.0/24 -p tcp --dport 80 -j DNAT --to 192.168.169.3:3128
iptables -A INPUT -i eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

--------------------------------------------------------------------------

I hope that u guys can help me out

-- 
Atte
Jorge Perez V.
Departamento de informática
Anexo: 359
-- 
Atte
Jorge Perez V.
Departamento de informática
Anexo: 359