Cascading proxy servers

[edie209]

Hi i have been using clarkconnect at home for about 4 years now and have found it to be a very useful piece of software.

So I have decided to use it in school to act as a proxy server amonst other things it can be used for.

But I have hit a stumbling block, our school has to use a SWGFL proxy for our internet access. I know that this means I have to configure ClarkConnect to go through this proxy to work. I believe that the answer lies in configuring /etc/resolv.conf although I'm not really sure.

Is there anyone who uses Linux who could guide me through.

[webman]

The resolv.conf file is for name servers and DNS resolving only. All your proxy stuff is in squid.conf, and I believe the line in there you want is ParentProxy. However, it is best to check the manual for ClarkConnect, as I'm sure from past experience with it, that it re-generates the config files from templates so manual changes to your settings will probably get overwritten.

You may also want to look into IPCop or Smoothwall with the Advanced Proxy and URL Filter addons to achieve the same result, also using a web interface.

[Geoff]

Is clarkconnect squid? If so I can tell you how to do it with a vanilla squid install and you can adapt it for clarkconnect...

[edie209]

I Have found this the only problem is I have to login and alter the squid.conf file....... starting to get out of my depth here

OK I can login using putty? but then how do i edit the squid.conf file

From the Squid manual:

Using an upstream proxy that supports ICP is simple, using a line like this one:

cache_peer proxy.yourisp.com parent 3128 3130
prefer_direct off

The cache_peer line specifies the host name, the cache type ("parent"), the proxy port (3128) and the ICP port (in this case, the default, which is 3130).

If your parent cache does not support ICP then you could try the following combination instead:

cache_peer proxy.yourisp.com parent 3128 7 no-query default
prefer_direct off

[webman]

You can edit it using a text editor (vi or nano if one of those installed) if you login via putty. If you have root login via SSH, you can use a program called WinSCP using a windows explorer interface to edit the squid.conf file.

[edie209]

Thanks webman for letting me know about WinSCP.

I have just tried it at home on my ClarckConnect box here and WinSCP makes things alot easier.

We can't award stars for good advice here, but you should have one for that

[webman]

No problem. All part of the service; welcome to EduGeek

[ChrisH]

Make sure you use a decent text editior if you are editing it on a windows box.
try something like textpad else it may mess with some of the formatting of the text file.

[edie209]

OK I have spent most of the morning trying to get this to work, but obviously I am doing something wrong

cache_peer proxy.schoolname.lea.sch.uk parent 8080 3130
prefer_direct off

cache_peer xxx.xxx.xxx.xxx parent 8080 3130
prefer_direct off

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default prefer_direct off

cache_peer xxx.xxx.xxx.xxx parent 8080 7 no-query default prefer_direct off

These are what I have tried 8080 being the proxy port.

Can anyone seeany errors

[CyberNerd]

think you need never_direct
prefer_direct sends direct to the internet without proxying?

[Geoff]

Yep, you need never_direct. But you also need always_direct for your local intranet servers. So basically you end up with something like this

acl all 0.0.0.0/0
acl local-servers .yourdomain.lea.sch.uk
acl local-subnet 10.0.0.0/24

never_direct all
always_direct local-servers, local-subnet

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default

Disclaimer: the above is from memory so probably has stupid typos.

[edie209]

Thanks guys I will go away and try that straight away.

[edie209]

Hi I'm still having problems, is there a document i can read on this?


acl all 0.0.0.0/0 Do I edit this line?
acl local-servers .yourdomain.lea.sch.uk
acl local-subnet 10.0.0.0/24 Do I edit this line?

never_direct all
always_direct local-servers, local-subnet

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default

[Geoff]

The ACL's were just to make the never_direct/always_direct rules clear. Clarkconnect has probably already setup equivelent acls for you that do the same job as my examples. Reuse the existing acls whereever possible and adapt my example.

http://squid-docs.sourceforge.net/ For squid documentation.

[edie209]

Geoff

I think I am getting the idea now, I have just printed the conf file (48 pages) the different lines have to appear in the expected area of the conf file (am I correct?)

I think I have done that for the acl lines and the never_direct, but I am unsure of where to place the cache_peer line.

Originaly I had put all the lines at the end of the file.