Squid + Dansguardian? No internet through proxy.

[dany2010]

Hi,

 

I've just re-installed Ubuntu after i had finished playing with squid and dansguardian to start from fresh and i cant get it working now.

 

We have a proxy provided by the LEA that we must connect to so squid is going to be inbetween.

 

I've set it up following this guide

The Daily Admin: How-to install Virtual Machine with Ubuntu/Squid/Dansguardian/Clam AV/Bannerfilter/SARG

 

I've also added the following to squid.conf

cache_peer 10.*.*.* parent 8080 0 no-query proxy-only
never_direct allow all

(* replaces IP Address numbers)

 

I have obviously missed something as it was working before i reinstalled.

 

Any ideas?

 

Thanks

Edited November 7, 2012 by dany2010

[glennda]

Are you literally putting 10.*.*.*?

 

this has to be a full hostname or IP address.

[dany2010]

Sorry, had to change as the Coucncil probably wont want it published. WIll update the original post to say this.

 

If i change the port on the test computer to 3128 and type the server ip address in i get the "It works!" page.

 

So squid must be up.

Edited November 7, 2012 by dany2010

[glennda]

Sorry, had to change as the Coucncil probably wont want it published. WIll update the original post to say this.

 

If i change the port on the test computer to 3128 and type the server ip address in i get the "It works!" page.

 

So squid must be up.

 

No your it works it loading an Apache page the default is it works I think. Will the squid proxy send things normally without the upstream proxy?

[dany2010]

Found out what makes it works.

 

If i uncomment

http_access allow all

 

SHould you do this? Is it safe to do this?

[glennda]

Found out what makes it works.

 

If i uncomment

http_access allow all

 

SHould you do this? Is it safe to do this?

 

Have you specified a local Subnet which is allowed to be proxied?

 

normally you have http_access 192.168.10.0/24 etc so that it only proxies machines with that IP i think. Not used squid for a while.

[dany2010]

I havnt no.

 

Is that something that is recommended? If they are outside the IP range does it just deny their internet? Everything in the domain will probably end up going through the filter i would guess.

 

Is there any security issues leaving it open to all?

[Geoff]

That would depend on how your network is setup.

[glennda]

I havnt no.

 

Is that something that is recommended? If they are outside the IP range does it just deny their internet? Everything in the domain will probably end up going through the filter i would guess.

 

Is there any security issues leaving it open to all?

 

As mentioned above - depends on your network setup. You simple need to change it to http_access xx.xx.xx.0/xx for whatever your internal subnet is. You can then restrict it even further - for example I used to have a second squid proxy running over an unfiltered ADSL line in the school before we took on the leased line.

 

enabling this feature meant we could restrict it to purely the static addresses of our machines in the office rather then everybody.