How can I solve http_port 3129 intercept with squid?
Posted
by
wmoreno3
on Server Fault
See other posts from Server Fault
or by wmoreno3
Published on 2013-01-22T04:57:49Z
Indexed on
2013/11/10
15:59 UTC
Read the original article
Hit count: 1847
My system:
uname -a
FreeBSD server.local.jmorenov.com.co 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec 4 09:23:10 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
pkg info | grep squid
squid-3.2.7 HTTP Caching Proxy
I have this configuration in squid.conf:
http_port 3128 accel vhost allow-direct # OK
http_port 3129 intercept # Does not work
icp_port 0
When I tried with:
http_port 3129 intercept
By switch line on ipnat.rules. In access log appears:
2013/01/09 00:46:03 kid1| IPF (IPFilter) NAT open failed: (13) Permission denied
2013/01/09 00:46:03 kid1| BUG #3329: Orphan Comm::Connection: local=127.0.0.1:3129 remote=192.168.1.129:51595 FD 24 flags=33
2013/01/09 00:46:03 kid1| NOTE: 1 Orphans since last started.
/var/log/squid/cache.log
2013/02/08 09:02:33 kid1| Squid plugin modules loaded: 0
2013/02/08 09:02:33 kid1| Accepting reverse-proxy HTTP Socket connections at local=127.0.0.1:3128 remote=[::] FD 33 flags=9
2013/02/08 09:02:33 kid1| Accepting NAT intercepted HTTP Socket connections at local=127.0.0.1:3129 remote=[::] FD 34 flags=41
My /etc/ipnat.rules:
root@server:/root # cat /etc/ipnat.rules
# em0 = External NIC
# bge0 = Internal NIC
map em0 0/0 -> 0/32 proxy port ftp ftp/tcp
map em0 0/0 -> 0/32 portmap tcp/udp auto
map em0 0/0 -> 0/32
# Redirect direct web traffic to local web server.
rdr em0 192.168.0.3/32 port 80 -> 127.0.0.1 port 80 tcp
rdr bge0 192.168.1.3/32 port 80 -> 127.0.0.1 port 80 tcp
# Redirect everything else to squid on port 3128 or 3129 intercept
rdr em0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3128 tcp
rdr bge0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3128 tcp
#rdr em0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3129 tcp
#rdr bge0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3129 tcp
With 3128 is OK, but with 3129, Does not work, when switch in ipnat.rules.
© Server Fault or respective owner
