Cascading proxy servers

[edie209]

Hi i have been using clarkconnect at home for about 4 years now and have found it to be a very useful piece of software.

 

So I have decided to use it in school to act as a proxy server amonst other things it can be used for.

 

But I have hit a stumbling block, our school has to use a SWGFL proxy for our internet access. I know that this means I have to configure ClarkConnect to go through this proxy to work. I believe that the answer lies in configuring /etc/resolv.conf although I'm not really sure.

 

Is there anyone who uses Linux who could guide me through.

[webman]

The resolv.conf file is for name servers and DNS resolving only. All your proxy stuff is in squid.conf, and I believe the line in there you want is ParentProxy. However, it is best to check the manual for ClarkConnect, as I'm sure from past experience with it, that it re-generates the config files from templates so manual changes to your settings will probably get overwritten.

 

You may also want to look into IPCop or Smoothwall with the Advanced Proxy and URL Filter addons to achieve the same result, also using a web interface.

[Geoff]

Is clarkconnect squid? If so I can tell you how to do it with a vanilla squid install and you can adapt it for clarkconnect...

[edie209]

I Have found this the only problem is I have to login and alter the squid.conf file....... starting to get out of my depth here

 

OK I can login using putty? but then how do i edit the squid.conf file

 

From the Squid manual:

 

Using an upstream proxy that supports ICP is simple, using a line like this one:

 

cache_peer proxy.yourisp.com parent 3128 3130

prefer_direct off

 

The cache_peer line specifies the host name, the cache type ("parent"), the proxy port (3128) and the ICP port (in this case, the default, which is 3130).

 

If your parent cache does not support ICP then you could try the following combination instead:

 

cache_peer proxy.yourisp.com parent 3128 7 no-query default

prefer_direct off

[webman]

You can edit it using a text editor (vi or nano if one of those installed) if you login via putty. If you have root login via SSH, you can use a program called WinSCP using a windows explorer interface to edit the squid.conf file.

[edie209]

Thanks webman for letting me know about WinSCP.

 

I have just tried it at home on my ClarckConnect box here and WinSCP makes things alot easier.

 

We can't award stars for good advice here, but you should have one for that

[webman]

No problem. All part of the service; welcome to EduGeek

[ChrisH]

Make sure you use a decent text editior if you are editing it on a windows box.

try something like textpad else it may mess with some of the formatting of the text file.

[edie209]

OK I have spent most of the morning trying to get this to work, but obviously I am doing something wrong

 

cache_peer proxy.schoolname.lea.sch.uk parent 8080 3130

prefer_direct off

 

cache_peer xxx.xxx.xxx.xxx parent 8080 3130

prefer_direct off

 

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default prefer_direct off

 

cache_peer xxx.xxx.xxx.xxx parent 8080 7 no-query default prefer_direct off

 

These are what I have tried 8080 being the proxy port.

 

Can anyone seeany errors

[CyberNerd]

think you need never_direct

prefer_direct sends direct to the internet without proxying?

[Geoff]

Yep, you need never_direct. But you also need always_direct for your local intranet servers. So basically you end up with something like this

 

acl all 0.0.0.0/0
acl local-servers .yourdomain.lea.sch.uk
acl local-subnet 10.0.0.0/24

never_direct all
always_direct local-servers, local-subnet

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default

 

Disclaimer: the above is from memory so probably has stupid typos.

[edie209]

Thanks guys I will go away and try that straight away.

[edie209]

Hi I'm still having problems, is there a document i can read on this?

 

 

acl all 0.0.0.0/0 Do I edit this line?

acl local-servers .yourdomain.lea.sch.uk

acl local-subnet 10.0.0.0/24 Do I edit this line?

 

never_direct all

always_direct local-servers, local-subnet

 

cache_peer proxy.schoolname.lea.sch.uk parent 8080 7 no-query default

[Geoff]

The ACL's were just to make the never_direct/always_direct rules clear. Clarkconnect has probably already setup equivelent acls for you that do the same job as my examples. Reuse the existing acls whereever possible and adapt my example.

 

http://squid-docs.sourceforge.net/ For squid documentation.

[edie209]

Geoff

 

I think I am getting the idea now, I have just printed the conf file (48 pages) the different lines have to appear in the expected area of the conf file (am I correct?)

 

I think I have done that for the acl lines and the never_direct, but I am unsure of where to place the cache_peer line.

 

Originaly I had put all the lines at the end of the file.

[Geoff]

It doesn't matter where you put anything in the configuration file. It's broken up into sections to help readability.

[edie209]

Geoff

 

I have been playing around for about 2 days now not really getting anywhere. I noticed that after editing the conf file I was getting FAILED in the startup for the firewall.

 

So I reinstalled Clarkconnect all was fine untill I tried to edit the squid config file. Then on reboot I got this Failed again.

 

I am using notepad to do the editing and I am thinking after re reading your posts that this my be the problem, if it is can you recomend a freeware text editor for this purpose.

[ChrisH]

http://www.textpad.com not free but it just nags you to pay for it.

[webman]

metapad or PSPad, both freeware.

[CyberNerd]

It might be a good idea to learn using a *nix text editor on windows.

Vi and emacs are both available for windows:

 

http://www.vim.org/download.php

http://www.gnu.org/software/emacs/windows/ntemacs.html

 

Its can be a religious debate as to which is 'better'

[edie209]

Well I must be doing something wrong!!

 

I have just tried editing the config file with textpad and the samething happens.

 

Here is what I am doing

 

1. connect to the Linux box with winSCP

 

2. browse to the config file

 

3. save to the desktop

 

4 edit with textpad

 

5 upload the config file

 

6. reboot the linuxbox

 

7. firewall fails on reboot

 

8. putting the config file back to its original state fails

 

Is there a command that I can use to check the installation of squid ect

[CyberNerd]

Is there a command that I can use to check the installation of squid ect

 

you'll need to login via ssh or on the console:

 

locate the squid binary file - I assume its in /usr/sbin/squid -but depends on your distro.

 whereis squid

might help

 

/usr/sbin/squid -k parse

 

will output any errors in the config.

 

you shouldn't need to reboot - try

/etc/init.d/squid restart

 

and

/etc/init.d/squid status

to see if its running

[edie209]

Thanks for all that, what a learning curve this is turning into!

 

It seems that there are no errors in the config file, so I guess I need to check the lines I am entering again to make sure I have got everthing correct

[edie209]

Hi Back again, Well I have had the box talking to the internet, when I put the dns server addresses for the ISP into the settings, but if I reboot the settings revert back to the network DNS and therefore the can't talk to the internet. Once I correct this problem it can take nearly a day before the internet is back.

 

Any Ideas?

[NetworkGeezer]

You're not using DHCP on this box are you?