Endian firewall

[plexer]

Well our LEA supplied cachpilot died yesterday and the day before I had finally got round to installing endian firewall on our rackmount server bought for this purpose.

 

Trouble is I've had enormous problems access certain websites which also prevented me from posting on edugeek all day and up until now.

 

I've just set my machine to use the proxy ip and firefox to use the upstream proxy and now can access my easymail web email and post on here so it's definately a problem with endian.

 

I turned off the content filter and also gave myself unrestricted access but still had the same problems.

 

Ben

[ChrisH]

Problems like you can get the front page of Edugeek but trying anything like forums screws up?

[plexer]

ChrisH: Nope I can read the forums fine it's just when I submit a new post or a reply it just gives up and times out with a could not find server error from endian.

 

I know my problems with posting to edugeek and getting into my webmail was caused by endian because when I set my pc to the .5 address and set firefox to use the upstream proxy it worked perfectly.

 

So now I'm looking for another distro that can give me just a proxy no need for a firewall so smoothwall and ipcop is out as I don't want to change my ip range.

 

Ben

[Geoff]

Is ECN enabled?

[plexer]

Whats ECN?

 

Ben

[Geoff]

Explicit Congestion Notification

 

http://www.icir.org/floyd/ecn.html

 

Also see

 

http://www.cctec.com/maillists/nanog/historical/0104/msg00714.html

[plexer]

Thanks Geoff I'll have a look on monday.

 

Cheers,

 

Ben

[plexer]

I tried a fix for the ECN issue today by:

 

echo "0" >/proc/sys/ipv4/tcp_ecn

 

This appears to have had no effect, I did find a webpage that is supposed to list broken ecn hosts and I could connect to those without problem.

 

I have now for the time being setup privoxy on a machine and I'm using that to proxy everyones requests to give me some breathing space on this.

 

Ben

[Geoff]

Then it's likely to be a configuration error in the proxy itself. Does it use Squid?

[plexer]

Hi Geoff,

 

Yes it does.

 

Ben

[Geoff]

hieracrchy_stoplist and no_cache comes to mind..

 

e.g.

 

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

[plexer]

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
acl no_cache_domains dstdomain "/var/efw/proxy/advanced/acls/dst_nocache.acl"
no_cache deny no_cache_domains

 

Is in there.

 

Ben

[Geoff]

curious. What does the access.log say when you go to a page that has the problem?

[plexer]

1159773840.809 39 10.104.64.3 TCP_MISS/302 297 GET http://mail.wayland.norfolk.sch.uk

 

Ben

[Geoff]

Is it HTTPS?

[plexer]

Nope

[Geoff]

Out of ideas then. Sorry.