dgsmith Posted December 19, 2011 Posted December 19, 2011 Having some trouble configuring squid on ubuntu. We go via lancashire proxy thus I have read I need to configure this in squid.conf under cache_peer. Whilst internal lancashire sites are accessible fine (which can be accessed when no using a proxy anyway), any other site, or "outside lancashire" times out. What I have is this in squid.conf: cache_peer proxy.lancsngfl.ac.uk parent 8080 0 default no-query no-digest never_direct allow all Do I need to change something somewhere else? Can't understand it at all!
jinnantonnixx Posted December 19, 2011 Posted December 19, 2011 Can you telnet to proxy.lancsngfl.ac.uk on port 8080 to check basic networking? telnet proxy.lancsngfl.ac.uk 8080 You should see some sort of response. Presuming you are allowed to reconfigure and restart Squid, You can enable debugging in Squid by adding this line to squid.conf debug_options ALL,1 33,2 28,9 Restart squid with the command sudo service squid restart This will log everything to /var/log/squid/cache.log You can browse the end of the log with the command tail -n 200 /var/log/squid/cache.log
dgsmith Posted December 20, 2011 Author Posted December 20, 2011 Well I don't need to test proxy.lancsngfl.ac.uk, because it's the main proxy we use for internet access. I have enabled logging and do indeed see alot more logs in the file now, but it doesn't make any sense to me and I can't really identify something that says "error" or where I can pinpoint a problem. I have read every manual I can find about squid upstream/external proxies etc configured as noted in my opening post. It surely must be something easy that I am forgetting, or maybe one other thing that needs doing, possibly something out of the ordinary not usually noted in standard manuals? How can I even check that squid is connecting to the parent proxy and not just trying to go direct regardless to what I have put? This seems possible given lancs-only sites can be retrieved directly anyway without using the proxy and these are the only ones I can access..
jinnantonnixx Posted December 20, 2011 Posted December 20, 2011 What's the proxy at lancs? Is it MS-ISA or Squid? Ask the admin of that proxy to check their logs to see what your proxy is doing. Anybody 'upstream' in your organisation who can help you?
3s-gtech Posted December 20, 2011 Posted December 20, 2011 An excerpt of our similar setup config, working: # User/group to run as (squid tree should be chown user.group) cache_effective_user proxy proxy # Which upstream proxy do we use? cache_peer parentcache.address parent 3128 7 no-query default # ACLs for allowed connections - your address ranges (replace example with full IP range including subnetting) acl localServers dst Example.example.example.example/16 always_direct allow localServers never_direct allow !localServers # Squid Configuration file, part 2 # Access control list. Blacklist using text file in same directory. This is for bonus filtering via a text file. acl blacklist url_regex "/etc/squid3/blacklist.acl" http_access deny blacklist deny_info http://www.websiteofyourchoosing.com blacklist # Where to put cache and log files cache_dir ufs /etc/squid3/cache 1024 16 256 cache_access_log /etc/squid3/log/cache-access.log emulate_httpd_log on cache_log /etc/squid3/log/cache.log cache_store_log none coredump_dir /etc/squid3/cache # Cache controls maximum_object_size 16384 KB
dezt Posted December 20, 2011 Posted December 20, 2011 I'm doing the exact same thing as you at the moment, looking at using squid and dansguardian for our web proxy and filter. Here is my cache_peer line from the squid.conf file. cache_peer proxy.lancsngfl.ac.uk parent 8080 0 proxy-only no-query I have the line never_direct allow all further down my squid.conf but everything works fine for me. If you want I can PM you my squid.conf file.
glennda Posted December 20, 2011 Posted December 20, 2011 Mine is cache_peer proxy.wsgfl.org.uk parent 8080 0 no-query no-digest default
CyberNerd Posted December 20, 2011 Posted December 20, 2011 cache_peer 192.168.72.102 parent 8080 0 no-query default acl INSIDE_IP dst 192.168.92.0/24 always_direct allow INSIDE_IP never_direct allow all
dgsmith Posted December 20, 2011 Author Posted December 20, 2011 What's the proxy at lancs? Is it MS-ISA or Squid? Ask the admin of that proxy to check their logs to see what your proxy is doing. Anybody 'upstream' in your organisation who can help you? No idea what lancs proxy is - not managed by us. As noted further down by dazt in lancs, seems it can work! An excerpt of our similar setup config, working: # User/group to run as (squid tree should be chown user.group) cache_effective_user proxy proxy # Which upstream proxy do we use? cache_peer parentcache.address parent 3128 7 no-query default # ACLs for allowed connections - your address ranges (replace example with full IP range including subnetting) acl localServers dst Example.example.example.example/16 always_direct allow localServers never_direct allow !localServers # Squid Configuration file, part 2 # Access control list. Blacklist using text file in same directory. This is for bonus filtering via a text file. acl blacklist url_regex "/etc/squid3/blacklist.acl" http_access deny blacklist deny_info http://www.websiteofyourchoosing.com blacklist # Where to put cache and log files cache_dir ufs /etc/squid3/cache 1024 16 256 cache_access_log /etc/squid3/log/cache-access.log emulate_httpd_log on cache_log /etc/squid3/log/cache.log cache_store_log none coredump_dir /etc/squid3/cache # Cache controls maximum_object_size 16384 KB I guess I should try and get, or create, an uncommented file maybe, as navigating the default one is a nightmare, so hard to see how mine compares in areas you have posted. I'm doing the exact same thing as you at the moment, looking at using squid and dansguardian for our web proxy and filter. Here is my cache_peer line from the squid.conf file. cache_peer proxy.lancsngfl.ac.uk parent 8080 0 proxy-only no-query I have the line never_direct allow all further down my squid.conf but everything works fine for me. If you want I can PM you my squid.conf file. Sent you a PM - you being in lancs too may be useful! At least you can confirm it does work and definately something on our end. Mine is cache_peer proxy.wsgfl.org.uk parent 8080 0 no-query no-digest default I think I have the cache_peer line correct and in the right place, though as I posted I have also set the same end parameters!
2097 Posted January 5, 2012 Posted January 5, 2012 Did you manage to sort this ? mine was fine in Nov when testing .. Now come Jan when i want to deploy The browser is saying (13) permission denied in regards to our external proxy peer
dgsmith Posted January 16, 2012 Author Posted January 16, 2012 Unfortunately not.. I still didn't manage to get the upstream proxy working! The box still on allows sites internal to lancs even when using dazt's config =\
2097 Posted January 16, 2012 Posted January 16, 2012 Very strange . Ive got our council support team looking into it . im pretty sure mine is a cache_peer issue , they might be blocking me ! What software is the Peer using ? are they also using squid ?
2097 Posted January 16, 2012 Posted January 16, 2012 I feel really bad now , blaming it on a ISP problem ! Its actually this ! How to fix: Squid cache_dir (13) Permission denied | Kaliphonia.com Well mine was any way !
2097 Posted January 16, 2012 Posted January 16, 2012 just to note . if i stopped squid and then ran 'squid -z -F' it then worked It must be a problem on the YUm install file . ( on centos 5.7) Ive now gone back to centos 6 , and all is well ? and working good actually straight from the box !
dgsmith Posted August 14, 2012 Author Posted August 14, 2012 Bumping my old thread, but I am going to try this again from scratch seeing as I have some time now and I was never able to get it working as I wanted! Those who tried, replied or have it working themselves, could you advise if you read any online guide as to how to correctly set this up? I read a few, and think I did it correct though as mentioned a few months ago, was not able to get the upstream proxy working (seeing as our inet ISP is itself via a proxy).
jinnantonnixx Posted August 14, 2012 Posted August 14, 2012 Is Squid actually running properly? What platform are you using? On Centos/RH, try the command service squid status A common fault when you regenerate the cache directories is the error 'Squid is started but no running copy' or something like that.
dgsmith Posted August 14, 2012 Author Posted August 14, 2012 On Ubuntu - squid itself did work (I think), as dansguardian did work in that. I am currently running a fresh install anyway as I can't remember what I changed etc and probably easier to start again, but then the risk is configuring all again to get the same issue as last time!
grant_girdwood Posted August 15, 2012 Posted August 15, 2012 Hi dgsmith, My guess is that the upstream proxy requires authentication - can you confirm if this is the case? If it is then you will need to use the login=PASS parameter
Duke5A Posted August 20, 2012 Posted August 20, 2012 @dgsmith I had a similar issue a while back with Squid and an upstream proxy that isn't administrated by my department. The upstream proxy sat in a public network and would only allow connections from certain addresses which were the public outside addresses of all the schools that used it. This setup works great when connecting directly to it, but when we tried to go through an internal squid proxy the connections would time out. It turns out in Squid's default configuration it sends the originating internal IP address to the outside proxy in the payload. The outside proxy was looking at this as the originating address instead our outside interface on the firewall and blocking the connection as a result. To disable Squid from passing the internal address to the upstream proxy add this to your config: forwarded_for off I hope this fixes it....
dgsmith Posted August 21, 2012 Author Posted August 21, 2012 Hi dgsmith, My guess is that the upstream proxy requires authentication - can you confirm if this is the case? If it is then you will need to use the login=PASS parameter We do not have authentication to our LEA proxy. @dgsmith I had a similar issue a while back with Squid and an upstream proxy that isn't administrated by my department. The upstream proxy sat in a public network and would only allow connections from certain addresses which were the public outside addresses of all the schools that used it. This setup works great when connecting directly to it, but when we tried to go through an internal squid proxy the connections would time out. It turns out in Squid's default configuration it sends the originating internal IP address to the outside proxy in the payload. The outside proxy was looking at this as the originating address instead our outside interface on the firewall and blocking the connection as a result. To disable Squid from passing the internal address to the upstream proxy add this to your config: forwarded_for off I hope this fixes it.... Thanks for the advice; I simply can't remember if this was configured or not and I have since reinstalled the lot but personal concerns have meant I have yet to finish that. I'll be sure to try when I next have the opportunity and let you know - it sure does sound like it may be a resolution!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now