I'm trying to connect to Squid with one IPv4 IP and based on the port I'm connecting with, I want Squid to use a different IPv6 IP for the connection.
Below is my config file
The issue I'm facing is that I can only use the proxy with port 3128, and it does proxy it to "2000:3c03:e000:25f::1:0" as it should. But if I use port 3129 then I can not connect to the proxy.
squid-users mailing list
On 19.08.2017 04:03, [hidden email] wrote:
I'm trying to connect to Squid with one IPv4 IP and based on the port I'm connecting with, I want Squid to use a different IPv6 IP for the connection.because you only have
you also need
and in case there is a firewall, these ports must be open, too ...
by the way this setting only makes sense, when there is a restriction, that only a specific IP can use port 3128,
a specific IP can use port 3129, ....
need not be IPv4 can also be IPv6 ...
squid-users mailing list
smime.p7s (4K) Download Attachment
On 19/08/17 18:15, Walter H. wrote:
> On 19.08.2017 04:03, davidjesse091 wrote:
>> I'm trying to connect to Squid with one IPv4 IP and based on the port
>> I'm connecting with, I want Squid to use a different IPv6 IP for the
NP: you are making two wrong assumptions here.
1) that Squid only uses outbound IPv6.
Ideally it would, but not all servers are IPv6-enabled, nor the
connection to any that are guaranteed to be working. As a proxy part of
Squids job is to detect failures and seamlessly workaround them "at
2) that the inbound connection has any relationship to the outbound one.
HTTP is stateless and multiplexed. That means any client request can go
out any outbound connection, or none, or *multiple* servers. Likewise
for server responses being delivered to any client, or none, or multiple
HTTP and Squid permit what you are doing, but neither implies anything
about whether it is a good idea or not. Be aware that by forcing
specific traffic flows you are artificially inhibiting what Squid can do
and potentially causing breakage in normal HTTP behaviour.
>> Below is my config file
>> |acl SSL_ports port 443 acl Safe_ports port 80 acl Safe_ports port 21
>> acl Safe_ports port 443 acl Safe_ports port 70 acl Safe_ports port 210
>> acl Safe_ports port 1025-65535 acl Safe_ports port 280 acl Safe_ports
>> port 488 acl Safe_ports port 591 acl Safe_ports port 777 acl CONNECT
>> method CONNECT http_access deny !Safe_ports http_access deny CONNECT
>> !SSL_ports http_access allow localhost manager http_access deny
>> manager http_access allow localhost #http_access deny all http_port
>> 3128 coredump_dir /var/spool/squid refresh_pattern ^ftp: 1440 20%
>> 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i
>> (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
>> # Allow all
>> machines to all sites http_access allow all
Really *anybody* on the entire Internet is allowed to use this
anonymizing proxy to perform any abuse they want to?
Including bypassing hardware-level protection on your 'lo' NIC
hardware to attack the proxy machine from the inside?
There are definitely far better ways to configure client access. But we
need to know what your intended use of the proxy really is make good
>> #Privacy Things via off
>> forwarded_for off follow_x_forwarded_for deny all
Question is "privacy for whom?" - these settings are hiding the proxy.
Increasing the *proxy* privacy. While leaving the client details exposed
If you are seeking to increase client and end-user privacy, you want to
be telling the server that there is a proxy in the way so it cannot
trust any of the 'user' values it sees to be user-unique.
>> ## designate acl
>> based on inbound connection name acl user1 myportname 3128 acl user2
>> myportname 3129 acl user3 myportname 3130 acl user4 myportname 3131
>> acl user5 myportname 3132 ## define outgoing IPv6 per user
>> tcp_outgoing_address 2000:3c03:e000:25f::1:0 user1
>> tcp_outgoing_address 2000:3c03:e000:25f::1:1 user2
>> tcp_outgoing_address 2000:3c03:e000:25f::1:2 user3
>> tcp_outgoing_address 2000:3c03:e000:25f::1:3 user4
>> tcp_outgoing_address 2000:3c03:e000:25f::1:4 user5|
Here you are mixing up the concepts of authentication, IP address, and
port numbers in a way which is horribly confusing.
The entity which connects to a port is a *client* not a user.
A) Why don't you let Squid just perform HTTP the way it is supposed to work?
HTTP is stateless with proxying as a designed part of the protocol.
The more people go out of their way to hide proxies existence from
server scripts the more the server-side script developers write broken
code assuming proxies don't exist. Reality is that almost all web
traffic goes through at least a handful of proxies. Bad scripts need to
be eradicated and the only way that is going to happen is if it is made
very clear to the naive authors how broken they are.
B) If you really have to break the stateless behaviour of HTTP why not
use the clients IP (or Squid receiving IP) instead of the Squid
>> The issue I'm facing is that I can only use the proxy with port 3128,
>> and it does proxy it to "2000:3c03:e000:25f::1:0" as it should. But if
>> I use port 3129 then I can not connect to the proxy.
> because you only have
> http_port 3128
> you also need
> http_port 3129
> http_port 3130
> http_port 3131
> http_port 3132
> and in case there is a firewall, these ports must be open, too ...
> by the way this setting only makes sense, when there is a restriction,
> that only a specific IP can use port 3128,
> a specific IP can use port 3129, ....
> need not be IPv4 can also be IPv6 ...
As Walter said that is your current problem. But when you get over that
you will hit the ones I've mentioned above - though they may not be
squid-users mailing list
|Free forum by Nabble||Edit this page|