Re: [squid-users] Caching for download servers

2018-01-03 Thread Umut Arus
Thank you. It seems a nice guide. I mean caching some destinations used for download without doing any setup on client side. Is it possible to use dns to proxy redirection for some destination zones? Regards. On Wed, Jan 3, 2018 at 3:25 PM, Amos Jeffries wrote: > On 03/01/18 20:25, Umut Arus wr

Re: [squid-users] questions setting up transparent proxy

2018-01-03 Thread Amos Jeffries
On 04/01/18 14:09, John Ratliff wrote: On 1/3/2018 3:26 PM, Antony Stone wrote: On Wednesday 03 January 2018 at 21:06:42, John Ratliff wrote: When I try to setup squid as a transparent proxy, I never get any response from Squid. When I try a wget request from a server that is being redirect

Re: [squid-users] questions setting up transparent proxy

2018-01-03 Thread John Ratliff
On 1/3/2018 3:26 PM, Antony Stone wrote: On Wednesday 03 January 2018 at 21:06:42, John Ratliff wrote: When I try to setup squid as a transparent proxy, I never get any response from Squid. When I try a wget request from a server that is being redirected How (and more importantly, where) a

Re: [squid-users] ALPN, HTTP/2 and sslbump

2018-01-03 Thread Amos Jeffries
On 04/01/18 12:37, Alex Rousskov wrote: On 01/03/2018 03:30 PM, brianbergstrom wrote: If I understand the docs and this thread correctly, Squid should be removing h2 from the ALPN in the Client Hello since Squid does not support it. Please note that Squid cannot remove something when using "p

Re: [squid-users] ALPN, HTTP/2 and sslbump

2018-01-03 Thread Amos Jeffries
On 04/01/18 11:30, brianbergstrom wrote: I am using Squid 3.5.27 and recently started having issues when I upgraded from openssl 1.0.1 to 1.0.2 which I believe introduced support for h2/ALPN. I have narrowed down the issue to a request that fails but succeeds with curl's --no-alpn flag. Here is

Re: [squid-users] ALPN, HTTP/2 and sslbump

2018-01-03 Thread Alex Rousskov
On 01/03/2018 03:30 PM, brianbergstrom wrote: > If I understand the docs and this thread correctly, Squid should be removing > h2 from the ALPN in the Client Hello since Squid does not support it. Please note that Squid cannot remove something when using "peek" and "splice" actions. I do not kno

Re: [squid-users] ALPN, HTTP/2 and sslbump

2018-01-03 Thread brianbergstrom
I am using Squid 3.5.27 and recently started having issues when I upgraded from openssl 1.0.1 to 1.0.2 which I believe introduced support for h2/ALPN. I have narrowed down the issue to a request that fails but succeeds with curl's --no-alpn flag. Here is the error message from Squid for the fai

Re: [squid-users] questions setting up transparent proxy

2018-01-03 Thread Antony Stone
On Wednesday 03 January 2018 at 21:06:42, John Ratliff wrote: > When I try to setup squid as a transparent proxy, I never get any > response from Squid. > When I try a wget request from a server that is being redirected How (and more importantly, where) are you doing the redirect? > Both machin

[squid-users] questions setting up transparent proxy

2018-01-03 Thread John Ratliff
When I try to setup squid as a transparent proxy, I never get any response from Squid. I can make it work fine as a regular proxy using Firefox. I've tried it on a Debian 9 server and a CentOS 7 server, and I get the same result. This is my configuration for the CentOS 7 server. I've put it

Re: [squid-users] Help with UA filtering in https connections

2018-01-03 Thread Alex Rousskov
On 01/03/2018 10:38 AM, Matus UHLAR - fantomas wrote: >> In a general case, the admin has to pick between two evils: >> >> * Allow TLS handshakes with arbitrary servers on TLS ports (my sketch) >> >> * or tell Squid to respond with error pages that the user cannot see >>  (without bypassing browse

Re: [squid-users] Help with UA filtering in https connections

2018-01-03 Thread Matus UHLAR - fantomas
On 01/03/2018 05:52 AM, Matus UHLAR - fantomas wrote: On 02.01.18 09:06, Alex Rousskov wrote: On 01/02/2018 07:08 AM, Matus UHLAR - fantomas wrote: On 02.01.18 06:04, squidnoob wrote: http_access allow CONNECT safe_ports http_access deny CONNECT the two lines above unconditionally allow CON

Re: [squid-users] Help with UA filtering in https connections

2018-01-03 Thread Alex Rousskov
On 01/03/2018 05:52 AM, Matus UHLAR - fantomas wrote: > On 02.01.18 09:06, Alex Rousskov wrote: >> On 01/02/2018 07:08 AM, Matus UHLAR - fantomas wrote: >>> On 02.01.18 06:04, squidnoob wrote: http_access allow CONNECT safe_ports http_access deny CONNECT >>> the two lines above unconditi

[squid-users] Squid crash: assertion failed: store_swapout.cc:289: "mem->swapout.sio == self"

2018-01-03 Thread Roberto Carna
Dear, I have updated Squid on pfSense to 0.4.42_1 version. But after start the service togeteher with squidGuard, Squid crashes. I try running from CLI in debug mode: # squid -d 10 [2.4.2-RELEASE][ad...@fw-pfsense-guest.g-bapro.net]/var/log: 2018/01/03 12:46:44 kid1| Starting Squid Cache version

Re: [squid-users] Help with UA filtering in https connections

2018-01-03 Thread Matus UHLAR - fantomas
On 03.01.18 13:52, Matus UHLAR - fantomas wrote: http_access deny CONNECT !safe_ports ... in this case you can deny the connect request later, unlike the previous example, where the CONNECT was allowed and further checks are done. corrected: _no_ futher checks are done. -- Matus UHLAR - fanto

Re: [squid-users] access blocking using DNS -> "NO Address records in response to '....'

2018-01-03 Thread Amos Jeffries
On 04/01/18 02:01, Paul Neuwirth wrote: On Thu, 4 Jan 2018 01:24:57 +1300 Amos Jeffries wrote: On 03/01/18 20:34, Paul Neuwirth wrote: On Wed, 3 Jan 2018 08:30:36 +0100 Paul Neuwirth wrote: Hello list, named is configured to block (resulting in NXDOMAIN) some domains. Using squid I have

Re: [squid-users] access blocking using DNS -> "NO Address records in response to '....'

2018-01-03 Thread Paul Neuwirth
On Thu, 4 Jan 2018 01:24:57 +1300 Amos Jeffries wrote: > On 03/01/18 20:34, Paul Neuwirth wrote: > > On Wed, 3 Jan 2018 08:30:36 +0100 > > Paul Neuwirth wrote: > > > >> Hello list, > >> > >> named is configured to block (resulting in NXDOMAIN) some domains. > >> Using squid I have following pr

Re: [squid-users] Help with UA filtering in https connections

2018-01-03 Thread Matus UHLAR - fantomas
On 02.01.18 09:06, Alex Rousskov wrote: On 01/02/2018 07:08 AM, Matus UHLAR - fantomas wrote: On 02.01.18 06:04, squidnoob wrote: http_access allow CONNECT safe_ports http_access deny CONNECT the two lines above unconditionally allow CONNECT anywhere, This is incorrect. The lines deny CONN

Re: [squid-users] Caching for download servers

2018-01-03 Thread Amos Jeffries
On 03/01/18 20:25, Umut Arus wrote: Hi, I'd like to ask about how redirect a client to squid server for only some destination domain zone (or IP addresses). We would like to cache some download server without doing any setup on client side. What do you mean by "cache some download server"

Re: [squid-users] access blocking using DNS -> "NO Address records in response to '....'

2018-01-03 Thread Amos Jeffries
On 03/01/18 20:34, Paul Neuwirth wrote: On Wed, 3 Jan 2018 08:30:36 +0100 Paul Neuwirth wrote: Hello list, named is configured to block (resulting in NXDOMAIN) some domains. Using squid I have following problem: Browser requests such a blocked URL and named is not delivering an error, request

Re: [squid-users] Transparent proxy for WiFi users

2018-01-03 Thread Amos Jeffries
On 03/01/18 10:15, Yuri wrote: 03.01.2018 02:13, Amos Jeffries пишет: On 03/01/18 02:48, Roberto Carna wrote: Dear, I've setup a Squid transparent proxy + Squidgard on pfSEnse 2.4 in order to filter HTTP and HTTPS web content for different types of WiFi clients on my company: - Android (diffe