Hi Ranjan,
Tarak Ranjan wrote:
Marcello Romani wrote:
Tarak Ranjan ha scritto:
Hi List,
i have one squid 2.6 proxy server. current situation is as
per browser settings for proxy...
Direct Connection: users are directly connecting to internet, no logs
are coming in access.log. not a single ACL is hitting for them
Autodetect Proxy: same as Direct Connection
Manual proxy: when anyone selecting manual proxy, that time only ACL
and logs everything is coming for the corresponding IP/user.
What i want, WHAT EVER THE CLIENT HAS SELECTED IN THEIR BROWSER.
DIRECT/AUTO/MANUEL , ACL & LOG SHOULD COME. AND ALL THE INTERNET
ACCESS TRAFFIC SHOULD PASS THROUGH SQUID......
Currently you are running a normal forward proxy. The feature that you
want is called Squid runing in "intercepting or transparent mode".
By the way, I guess that you are running Squid on a Linux machine?
For Squid to work in intercepting or transparent mode, you need to
fulfill either 1 of the 2 requirements below:
(1.) This Squid box has to be gateway for your 192.168.1.0/24.
(2.) Of if Squid box is not the gateway, then you need to redirect web
traffic from your router to your Squid box.
If you meet either 1 of the requirements, then you need to redirect web
requests on port 80 to your Squid box on port 8080.
Supposing that this Squid box is also your gateway, IPTABLES is your
tool to do this redirection.
You can run something like the following:
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp –dport 80 -j REDIRECT
–to-ports 8080
Note: eth1 is the interface of your 192.168.1.0/24 network.
HERE IS MY ACCESS.LOG.....THOSE WHO HAVE SELECTED MANUAL PROXY
1194864803.351 756 192.168.1.40 TCP_MISS/200 394 POST
http://mail.google.com/mail/channel/bind? - DIRECT/72.14.221.17
text/html
1194864803.566 1414 192.168.1.23 TCP_MISS/200 515 GET
http://us.bc.yahoo.com/b? - DIRECT/203.84.204.69 image/gif
1194864824.677 455 192.168.1.117 TCP_MISS/200 2744 GET
http://sb.google.com/
browsing/update? - DIRECT/72.14.217.91
text/html
1194864827.772 669 192.168.1.108 TCP_MISS/200 2349 GET
http://rad.msn.com/ADSAdClient31.dll? - DIRECT/207.68.178.153 text/html
1194864828.219 60561 192.168.1.154 TCP_MISS/200 668 POST
http://shttp.msg.yahoo.com/notify/ - DIRECT/216.155.194.239 text/plain
1194864828.851 1079 192.168.1.108 TCP_MISS/200 3825 GET
http://ad.doubleclick.net/adj/N3977.MSN_homepage_in/B2559371;sz=234x60;ord=1511213470?
- DIRECT/216.73.87.74 application/x-javascript
1194864828.910 58 192.168.1.108 TCP_IMS_HIT/304 321 GET
http://m1.2mdn.net/879366/flashwrite_1_2.js - NONE/-
application/x-javascript
1194864829.167 257 192.168.1.108 TCP_MISS/304 317 GET
http://m1.2mdn.net/1234724/yahoo_dotcom_234x60.swf? -
DIRECT/125.252.226.32 application/x-shockwave-flash
1194864829.436 225558 192.168.1.40 TCP_MISS/200 3260 GET
http://mail.google.com/mail/channel/bind? - DIRECT/72.14.221.17
text/plain
HERE IS MY CONFIGURATION FOR THE REFERENCE:
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl blocksites dstdomain "/etc/squid/squid-block.acl"
acl blockfiles urlpath_regex -i "/etc/squid/multimedia.files.acl"
acl malware_block_list url_regex -i "/etc/squid/malware_block_list.txt"
acl SSL_ports port 443
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny blockfiles
http_access deny blocksites
http_access deny malware_block_list
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl lk_network src 192.168.1.0/24
http_access allow lk_network
acl local-servers1 dstdomain liqwidkrystal.com
always_direct deny local-servers1
acl local-servers2 dstdomain lk.com
always_direct deny local-servers2
http_access allow localhost
http_access deny all
http_reply_access allow all
icp_access allow all
http_port 192.168.1.3:8080 transparent
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
cache_mem 8 MB
cache_dir ufs /var/spool/squid 100 16 256
Personally, I feel that 100 MB is a small cache even if your network may
be small. You can increase it to a value say 1000 or 2000 MB.
By the way, I can't seem to find the Safe_ports ACL in your squid.conf?
Also which Operating system and Squid version are you running?
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log none
logfile_rotate 7
pid_filename /var/run/squid.pid
log_fqdn off
ftp_passive on
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_mgr [EMAIL PROTECTED]
coredump_dir /var/spool/squid
Looks fine to me.
******* WHAT ARE THE NECESSARY CHANGES I HAVE TO TAKE TO WORK SQUID
AS I MENTIONED ABOVE.
You probably want to setup a transparent proxy...
oh, and btw PLEASE DON'T SHOUT we hear you just fine in lowercase.
thanks.
Sorry to post it again.... i haven't get the answer from the post....
give me some suggestions to make it out
To sum it up, make this Squid box the gateway or redirect web requests
from your router to this Squid box.
Then redirect web requests on port 80 to Squid's port 8080 using the
IPTABLES firewall if your Squid box's operating system is Linux.
Hope that helps.
Thanking you.....
--
With best regards and good wishes,
Yours sincerely,
Tek Bahadur Limbu
System Administrator
(TAG/TDG Group)
Jwl Systems Department
Worldlink Communications Pvt. Ltd.
Jawalakhel, Nepal
http://www.wlink.com.np
http://teklimbu.wordpress.com
