Tag Info

Hot answers tagged

6

1) Squid is a special proxy for http and https traffic. As it knows this protocol it can offer some advanced features like caching, filtering, rewrite rules, dns resolving. All web browsers know how to handle http proxies as it's part of that protocol spec. Additionally Squid can act as a transparent proxy where you don't configure your web browser to use ...


6

Netcat is not a specialized HTTP client. Connecting through a proxy server for Netcat thus means creating a TCP connection through the server, which is why it expects a SOCKS or HTTPS proxy with the -x argument, specified by -X: -X proxy_protocol Requests that nc should use the specified protocol when talking to the proxy server. ...


5

Your allow google\..* is matching every URL with google. in it. The allow is matched first so access is allowed. Your rule will also be allowing any requests with google. anywhere in the URL, like http://example.com/google.asp Additionally, Google tries to do most requests via SSL so a deny via url_regex plays no part in these requests (There is no URL in ...


5

This may not be the best solution, but if you use any proxy then it will have a specific host:port so the netcat solution with still work, albeit you'll have to pick apart the proxy meta-data to make sense of it. The easiest way to do this might be to use any random anonymization proxy out there and just channel all the traffic through netcat. (I.e., set ...


4

The usual solution for this problem is to use rotate the logfiles so that the current logfile only contains current entries, rather than removing outdated entries from the file. This is all handled by the logrotate program. The following configuration should do approximately what you want. It will keep the last 6 months of log entries from ...


4

Both Perl and Python (and probably Ruby as well) have simple kits that you can use to quickly build simple HTTP proxies. In Perl, use HTTP::Proxy. Here's the 3-line example from the documentation. Add filters to filter, log or rewrite requests or responses; see the documentation for examples. use HTTP::Proxy; my $proxy = HTTP::Proxy->new( port => ...


4

You are right, even with minimal installation, the current FreeBSD requires a minimum of 600 MB, especially if you go for a amd64 release. There is still some options left: Using an "old" 7.x or 8.x (i386) release I tried to install an "old" 7.3 (i386) with everything to minimal and it took 270 MB. Assuming your machine is old enough, you will not care ...


3

You need to specify that the rule should go into the nat table, additionally DNAT commands need to go the PREROUTING chain and you need to be careful that you do not generate a loop. iptables -t nat -I PREROUTING -i br-lan -s ! 192.168.1.196 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.196:3128 The default table is the filter table. Do not ...


3

Depending on which browser you are using, using a proxy auto-config file might work best. Most modern browsers will support this. Something like this should be a good start: function FindProxyForURL(url, host) { isp = "PROXY ip_address:port; DIRECT"; tor = "SOCKS 127.0.0.1:9050"; if (shExpMatch(host,"*.onion")) { return tor; } ...


2

It sounds like it needs to startup later in the boot sequence. Maybe it is binding to the wrong interface or the interface you use is not available when it starts. Check the system startup logs for any messages squid is telling you when it firs starts, then consider changing the startup script priority number. You could also set a reboot in your rc.local ...


2

You want to block any and all HTTPS sites? You need to do this with a firewall on your router. Blocking it in Squid won't prevent people from circumventing it unless the firewall on your router also blocks it. If your router blocks it than what squid does is irrelevant. Better yet, set the firewall to block all outgoing TCP connections except for port 80 ...


2

I can answer how to manage the bandwidth once you know what IP is in which group. You can use hierarchical token bucket to allocate three groups. 10 Group A 20 Group B 30 Unknown traffic for/from non-AD devices in your network #Create egress shaping $TC qdisc add dev eth0 root handle 1: htb default 20 r2q 50 $TC class add dev eth0 parent 1: classid 1:1 ...


2

Put this in your squid.conf httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on # acl lan src 192.168.1.1 192.168.2.0/24 # configure this for your lan settings http_access allow localhost http_access allow lan and make sure you have setup the iptables on your squid server. iptables -t nat -A PREROUTING ...


2

You can't make everything transparent with Squid. Only HTTP can be transparent and HTTPS with a non recommended hack. For FTP, you need a pure FTP proxy like Frox. Anyway, it doesn't make any sense to use proxies if you want to make everything transparent, use NAT. HTTP could be useful only because the cache.


2

Given their docs: http://wiki.squid-cache.org/SquidFaq/SquidAcl#The_Basics:_How_the_parts_fit_together dstdom_regex: destination (server) regular expression pattern matching This should match only the server (i.e. the www.google.ru part in your example), while you want to use it to block a specific URL (i.e. server + path). I think you need to use ...


1

There is a more detailed explanation about settings you need DynamicSSL For example always_direct allow all ssl_bump allow all # the following two options are unsafe and not always necessary: sslproxy_cert_error allow all sslproxy_flags DONT_VERIFY_PEER and the cert caching preparation.


1

Assuming it is a apache server. <Proxy *> Order deny,allow Allow from all </proxy> ServerName https://production.server.com ProxyPass https://api.production-server.com https://production.server.com:8099 ProxyPassReverse https://api.production-server.com https://production.server.com:8099


1

I also have an openwrt router configured to forward anything going to port 80 to port 3128 and then SNATting it to include the router's ip fro every client request. The thing is that everything was working with the default config ( transparent only added) with the 3.2 version but the 3.3.8 version is not happy. If I switch it to transparent and use the ...


1

First of all i don't know sarg but it seems that the problem is caused by your logfile. This could be caused by two things: Random characters / binary data / changed log format of your squid configuration sarg may have a problem with log files rotated by logrotate Based on http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=369693 as well as ...


1

dns_nameservers 182.190.0.21 182.176.39.17 192.168.1.100 #broken_vary_encoding allow apache #extension_methods REPORT MERGE MKACTIVITY CHECKOUT #acl M1 arp 00:18:8B:28:DD:7F #acl M2 arp 00:21:9b:d3:d8:de #http_access allow M1 #http_access allow M2 #http_access deny all #http_port 80 #httpd_accel_host 127.0.0.1 #http_accel_port 80 http_port 80 accel ...


1

Here you can look at the Squid configuration directives on this page maintained by the Squid project. This page shows the different directives and which versions of squid they're available in. The page is titled: Squid configuration directives.   


1

It appears Skype use SOCKS or HTTPS proxies. Squid is neither. For incoming connections you need to NAT incoming connections to your PC using the port specified in your Skype settings. For outgoing connections you need to open the ephemeral ports your PC uses. Skype is not a good citizen in protected environments. If your firewall support upnp, then ...


1

Private browsing is a complicated thing. A SSH tunnel can protect you from some kind of sniffing and "man-in-the-middle" attack inside your network, or other LAN focused attack. It will basically connect you to a host, and encrypt the connection between you and this hosts using ssh and add this one to the "path" before you access the site. If the site is ...


1

I think this article will include everything you need. http://www.deckle.co.uk/squid-users-guide/transparent-caching-proxy.html And yes, squid is often used as a transparent proxy, in fact many ISPs implement it unbeknownst to the users in order to reduce traffic. You should set this up inside your network though, don't put the cache outside the network ...


1

Create a file /etc/squid/white.acl Put the following data there: finam.ru/analysis/.* finam.ru/.*\.js finam.ru/.*\.css Put this code into squid.conf. You have to put the whitelist before the blacklist: acl good_url url_regex "/etc/squid/white.acl" http_access allow good_url acl bad_url url_regex "/etc/squid/block.acl" http_access deny bad_url


1

The line http_access allow manager localhost lagrangian64 allows you to access squid's management interface. All conditions must be matched for a rule to apply - in this case, your IP and localhost (which is impossible) must try to access the manager (which is defined in an earlier acl manager line in the default config file). This should work: # Allow your ...


1

You can use acl my_network src 192.168.0.0/16 # RFC1918 possible internal network acl block_yahoo dstdomain .yahoo.com http_access deny my_network block_yahoo http_access allow my_network http_access deny all after adding above lines in '/etc/squid/squid.conf' just run below command to reload squid configuration squid -k reconfigure refer this ...


1

You must combine your ACLs on a single http_access line like this: http_access allow allow_tutorial tutorial http_access deny allow_tutorial By setting ACLs this way you are telling squid: If any IP from ACL allow_tutorial tries to visit any URL from ACL tutorial allow it If any IP from ACL allow_tutorial tries to visit any URL deny it


1

Most browsers that support Javascript also support Netscape-style proxy autoconfiguration (PAC) files (I'm not aware of a JavaScript-capable browser released this century that doesn't). PAC files contain JavaScript code that is executed to determine what proxy (if any) to use for each request. function FindProxyForURL(url, host) { if (shExpMatch(host, ...


1

The answer here is going to be to set your single value to a proxy server of your own so that all traffic hits it. This can be a system wide setting. As for setting up your own proxy server, yes squid is the best option I know of and yes it can be setup and run on a Linux machine. It is best run on a gateway/router machine, but you can run it on your ...



Only top voted, non community-wiki answers of a minimum length are eligible