Squid "cache_peer" (upstream proxy) troubles

[dgsmith]

Having some trouble configuring squid on ubuntu. We go via lancashire proxy thus I have read I need to configure this in squid.conf under cache_peer.

 

Whilst internal lancashire sites are accessible fine (which can be accessed when no using a proxy anyway), any other site, or "outside lancashire" times out.

 

What I have is this in squid.conf:

 

cache_peer proxy.lancsngfl.ac.uk parent 8080 0 default no-query no-digest
never_direct allow all

 

Do I need to change something somewhere else? Can't understand it at all!

[jinnantonnixx]

Can you telnet to proxy.lancsngfl.ac.uk on port 8080 to check basic networking?

telnet proxy.lancsngfl.ac.uk 8080

You should see some sort of response.

 

Presuming you are allowed to reconfigure and restart Squid, You can enable debugging in Squid by adding this line to squid.conf

debug_options ALL,1 33,2 28,9

 

Restart squid with the command

sudo service squid restart

 

This will log everything to /var/log/squid/cache.log

You can browse the end of the log with the command

tail -n 200 /var/log/squid/cache.log

[jinnantonnixx]

Any good?

 

Squid 3 Transparent Proxy

[dgsmith]

Well I don't need to test proxy.lancsngfl.ac.uk, because it's the main proxy we use for internet access.

 

I have enabled logging and do indeed see alot more logs in the file now, but it doesn't make any sense to me and I can't really identify something that says "error" or where I can pinpoint a problem.

 

I have read every manual I can find about squid upstream/external proxies etc configured as noted in my opening post. It surely must be something easy that I am forgetting, or maybe one other thing that needs doing, possibly something out of the ordinary not usually noted in standard manuals?

 

How can I even check that squid is connecting to the parent proxy and not just trying to go direct regardless to what I have put? This seems possible given lancs-only sites can be retrieved directly anyway without using the proxy and these are the only ones I can access..

[jinnantonnixx]

What's the proxy at lancs? Is it MS-ISA or Squid?

Ask the admin of that proxy to check their logs to see what your proxy is doing. Anybody 'upstream' in your organisation who can help you?

[3s-gtech]

An excerpt of our similar setup config, working:

 

# User/group to run as (squid tree should be chown user.group)
cache_effective_user proxy proxy

# Which upstream proxy do we use?  
cache_peer parentcache.address parent 3128 7 no-query default

# ACLs for allowed connections - your address ranges (replace example with full IP range including subnetting)
acl localServers dst Example.example.example.example/16
always_direct allow localServers
never_direct allow !localServers


# Squid Configuration file, part 2

# Access control list.  Blacklist using text file in same directory. This is for bonus filtering via a text file.
acl blacklist url_regex "/etc/squid3/blacklist.acl"
http_access  deny blacklist
deny_info http://www.websiteofyourchoosing.com blacklist


# Where to put cache and log files

cache_dir ufs /etc/squid3/cache 1024 16 256

cache_access_log /etc/squid3/log/cache-access.log
emulate_httpd_log on

cache_log /etc/squid3/log/cache.log
cache_store_log none

coredump_dir /etc/squid3/cache


# Cache controls
maximum_object_size 16384 KB

[dezt]

I'm doing the exact same thing as you at the moment, looking at using squid and dansguardian for our web proxy and filter. Here is my cache_peer line from the squid.conf file.

 

cache_peer proxy.lancsngfl.ac.uk parent 8080 0 proxy-only no-query

 

I have the line

never_direct allow all

further down my squid.conf but everything works fine for me.

 

If you want I can PM you my squid.conf file.

[glennda]

Mine is

 

cache_peer proxy.wsgfl.org.uk parent 8080 0 no-query no-digest default

[CyberNerd]

cache_peer 192.168.72.102 parent 8080 0 no-query default

acl INSIDE_IP dst 192.168.92.0/24
always_direct allow INSIDE_IP
never_direct allow all

[dgsmith]

What's the proxy at lancs? Is it MS-ISA or Squid?

Ask the admin of that proxy to check their logs to see what your proxy is doing. Anybody 'upstream' in your organisation who can help you?

 

No idea what lancs proxy is - not managed by us. As noted further down by dazt in lancs, seems it can work!

 

An excerpt of our similar setup config, working:

 

# User/group to run as (squid tree should be chown user.group)
cache_effective_user proxy proxy

# Which upstream proxy do we use?  
cache_peer parentcache.address parent 3128 7 no-query default

# ACLs for allowed connections - your address ranges (replace example with full IP range including subnetting)
acl localServers dst Example.example.example.example/16
always_direct allow localServers
never_direct allow !localServers


# Squid Configuration file, part 2

# Access control list.  Blacklist using text file in same directory. This is for bonus filtering via a text file.
acl blacklist url_regex "/etc/squid3/blacklist.acl"
http_access  deny blacklist
deny_info http://www.websiteofyourchoosing.com blacklist


# Where to put cache and log files

cache_dir ufs /etc/squid3/cache 1024 16 256

cache_access_log /etc/squid3/log/cache-access.log
emulate_httpd_log on

cache_log /etc/squid3/log/cache.log
cache_store_log none

coredump_dir /etc/squid3/cache


# Cache controls
maximum_object_size 16384 KB

 

I guess I should try and get, or create, an uncommented file maybe, as navigating the default one is a nightmare, so hard to see how mine compares in areas you have posted.

 

I'm doing the exact same thing as you at the moment, looking at using squid and dansguardian for our web proxy and filter. Here is my cache_peer line from the squid.conf file.

 

cache_peer proxy.lancsngfl.ac.uk parent 8080 0 proxy-only no-query

 

I have the line

never_direct allow all

further down my squid.conf but everything works fine for me.

 

If you want I can PM you my squid.conf file.

 

Sent you a PM - you being in lancs too may be useful! At least you can confirm it does work and definately something on our end.

 

 

Mine is

 

cache_peer proxy.wsgfl.org.uk parent 8080 0 no-query no-digest default

 

I think I have the cache_peer line correct and in the right place, though as I posted I have also set the same end parameters!

[2097]

Did you manage to sort this ?

 

mine was fine in Nov when testing ..

 

Now come Jan when i want to deploy

 

The browser is saying

 

(13) permission denied in regards to our external proxy peer

[dgsmith]

Unfortunately not.. I still didn't manage to get the upstream proxy working! The box still on allows sites internal to lancs even when using dazt's config =\

[2097]

Very strange . Ive got our council support team looking into it .

 

im pretty sure mine is a cache_peer issue , they might be blocking me !

 

What software is the Peer using ? are they also using squid ?

[2097]

I feel really bad now , blaming it on a ISP problem !

 

Its actually this !

 

How to fix: Squid cache_dir (13) Permission denied | Kaliphonia.com

 

Well mine was any way !

[2097]

just to note . if i stopped squid and then ran 'squid -z -F' it then worked

 

It must be a problem on the YUm install file . ( on centos 5.7)

 

Ive now gone back to centos 6 , and all is well ? and working good actually straight from the box !

[dgsmith]

Bumping my old thread, but I am going to try this again from scratch seeing as I have some time now and I was never able to get it working as I wanted!

 

Those who tried, replied or have it working themselves, could you advise if you read any online guide as to how to correctly set this up? I read a few, and think I did it correct though as mentioned a few months ago, was not able to get the upstream proxy working (seeing as our inet ISP is itself via a proxy).

[jinnantonnixx]

Is Squid actually running properly?

 

What platform are you using? On Centos/RH, try the command

service squid status

 

A common fault when you regenerate the cache directories is the error 'Squid is started but no running copy' or something like that.

[dgsmith]

On Ubuntu - squid itself did work (I think), as dansguardian did work in that. I am currently running a fresh install anyway as I can't remember what I changed etc and probably easier to start again, but then the risk is configuring all again to get the same issue as last time!

[grant_girdwood]

Hi dgsmith,

 

My guess is that the upstream proxy requires authentication - can you confirm if this is the case?

 

If it is then you will need to use the login=PASS parameter

[Duke5A]

@dgsmith

 

I had a similar issue a while back with Squid and an upstream proxy that isn't administrated by my department. The upstream proxy sat in a public network and would only allow connections from certain addresses which were the public outside addresses of all the schools that used it. This setup works great when connecting directly to it, but when we tried to go through an internal squid proxy the connections would time out. It turns out in Squid's default configuration it sends the originating internal IP address to the outside proxy in the payload. The outside proxy was looking at this as the originating address instead our outside interface on the firewall and blocking the connection as a result. To disable Squid from passing the internal address to the upstream proxy add this to your config:

 

forwarded_for off

 

I hope this fixes it....

[dgsmith]

Hi dgsmith,

 

My guess is that the upstream proxy requires authentication - can you confirm if this is the case?

 

If it is then you will need to use the login=PASS parameter

 

We do not have authentication to our LEA proxy.

 

@dgsmith

 

I had a similar issue a while back with Squid and an upstream proxy that isn't administrated by my department. The upstream proxy sat in a public network and would only allow connections from certain addresses which were the public outside addresses of all the schools that used it. This setup works great when connecting directly to it, but when we tried to go through an internal squid proxy the connections would time out. It turns out in Squid's default configuration it sends the originating internal IP address to the outside proxy in the payload. The outside proxy was looking at this as the originating address instead our outside interface on the firewall and blocking the connection as a result. To disable Squid from passing the internal address to the upstream proxy add this to your config:

 

forwarded_for off

 

I hope this fixes it....

 

Thanks for the advice; I simply can't remember if this was configured or not and I have since reinstalled the lot but personal concerns have meant I have yet to finish that. I'll be sure to try when I next have the opportunity and let you know - it sure does sound like it may be a resolution!