0

I'm trying to run Squid with DD-WRT, but I can not. I use as a DNS server the Pi-hole. Ubuntu 18.04

This error appears

ERROR The requested URL could not be retrieved The following error was encountered while trying to retrieve the URL: http://bol.com.br/ Access denied. Setting up access control will prevent your request from being allowed at this time. Contact your service provider if you think this is incorrect. Your cache administrator is a webmaster.

The situation is as follows. I have a small home server ip of it 192.168.1.150. And I have my Tp-Link router WR940N v6 ip 192.168.1.4

I am using this code on the router to redirect traffic to Squid

#!/bin/sh
PROXY_IP=192.168.1.150
PROXY_PORT=3128
LAN_IP=`nvram get lan_ipaddr`
LAN_NET=$LAN_IP/`nvram get lan_netmask`

iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT

Squid.conf

root@ubuntu:~# grep -v '^$\|^\s*\#' /etc/squid/squid.conf
acl localnet src 192.168.1.0/24 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
dns_nameservers 1.1.1.1
dns_nameservers 8.8.8.8
visible_hostname squid
http_port 192.168.1.150:3129
http_port 192.168.1.150:3128 transparent
cache_mem 128 MB
cache_dir ufs /var/spool/squid 100 16 256
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320
root@ubuntu:~#

access.log

1557575463.721      0 192.168.1.150 TCP_MISS/403 6615 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - HIER_NONE/- text/html
1557575463.722      2 192.168.1.4 TCP_MISS/403 6705 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - ORIGINAL_DST/192.168.1.150 text/html
1557575465.318      0 192.168.1.150 TCP_MISS/403 4169 GET http://connectivitycheck.gstatic.com/generate_204 - HIER_NONE/- text/html
1557575465.319      1 192.168.1.4 TCP_MISS/403 4259 GET http://connectivitycheck.gstatic.com/generate_204 - ORIGINAL_DST/192.168.1.150 text/html
1557575467.851      0 192.168.1.150 TCP_MISS/403 6615 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - HIER_NONE/- text/html
1557575467.852      2 192.168.1.4 TCP_MISS/403 6705 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - ORIGINAL_DST/192.168.1.150 text/html
1557575471.938      0 192.168.1.150 TCP_MISS/403 4054 GET http://www.google.com/ - HIER_NONE/- text/html
1557575471.939     34 192.168.1.4 TCP_MISS/403 4139 GET http://www.google.com/ - ORIGINAL_DST/192.168.1.150 text/html
1557575472.371      0 192.168.1.150 TCP_MISS/403 4123 GET http://d2uzsrnmmf6tds.cloudfront.net/50KB.txt - HIER_NONE/- text/html
1557575472.372     35 192.168.1.4 TCP_MISS/403 4208 GET http://d2uzsrnmmf6tds.cloudfront.net/50KB.txt - ORIGINAL_DST/192.168.1.150 text/html
1557575472.915      0 192.168.1.150 TCP_MISS/403 4166 GET http://connectivitycheck.android.com/generate_204 - HIER_NONE/- text/html
1557575472.915      1 192.168.1.4 TCP_MISS/403 4256 GET http://connectivitycheck.android.com/generate_204 - ORIGINAL_DST/192.168.1.150 text/html
1557575476.003      0 192.168.1.150 TCP_MISS/403 6615 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - HIER_NONE/- text/html
1557575476.004      2 192.168.1.4 TCP_MISS/403 6705 POST http://api-global.netflix.com/nq/nrdjs/pbo_logblob/%5E1.0.0/router - ORIGINAL_DST/192.168.1.150 text/html
1557575476.317      0 192.168.1.150 TCP_MISS/403 4324 GET http://connectivitycheck.android.com/generate_204 - HIER_NONE/- text/html
1557575476.318      1 192.168.1.4 TCP_MISS/403 4409 GET http://connectivitycheck.android.com/generate_204 - ORIGINAL_DST/192.168.1.150 text/html
1557575477.266      0 192.168.1.150 TCP_MISS/403 4136 GET http://clients3.google.com/generate_204 - HIER_NONE/- text/html
1557575477.266      0 192.168.1.150 TCP_MISS/403 4136 GET http://clients3.google.com/generate_204 - HIER_NONE/- text/html
1557575477.268     38 192.168.1.4 TCP_MISS/403 4226 GET http://clients3.google.com/generate_204 - ORIGINAL_DST/192.168.1.150 text/html
1557575477.268     38 192.168.1.4 TCP_MISS/403 4226 GET http://clients3.google.com/generate_204 - ORIGINAL_DST/192.168.1.150 text/html

cache.log

root@ubuntu:~# tail -f /var/log/squid/cache.log
GET /generate_204 HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 6.0; XT1068 Build/MPB24.65-34-3)
Accept-Encoding: gzip
Via: 1.1 squid (squid/3.5.27)
X-Forwarded-For: 192.168.1.4
Cache-Control: max-age=259200
Connection: keep-alive
Host: connectivitycheck.gstatic.com


2019/05/11 08:51:46 kid1| WARNING: Forwarding loop detected for:
GET /generate_204 HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SM-G531H Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.0 Chrome/38.0.2125.102 Mobile Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,en;q=0.4
Via: 1.1 squid (squid/3.5.27)
X-Forwarded-For: 192.168.1.4
Cache-Control: max-age=259200
Connection: keep-alive
Host: connectivitycheck.android.com


2019/05/11 08:51:50 kid1| WARNING: Forwarding loop detected for:
GET /generate_204 HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 6.0; MotoG3 Build/MPIS24.65-33.1-2-16)
Accept-Encoding: gzip
Via: 1.1 squid (squid/3.5.27)
X-Forwarded-For: 192.168.1.4
Cache-Control: max-age=259200
Connection: keep-alive
Host: connectivitycheck.gstatic.com

iptables (INPUT)

root@ubuntu:/home/vinibudd# iptables -vnL INPUT
Chain INPUT (policy ACCEPT 41490 packets, 7722K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3129
 4117 1376K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3128
 8851 2371K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
 2485  134K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
  110  8544 ACCEPT     tcp  --  *      *       192.168.1.126        0.0.0.0/0            tcp dpt:8200
39748 2277K ACCEPT     tcp  --  *      *       192.168.1.127        0.0.0.0/0            tcp dpt:8200
  127  6628 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8200
root@ubuntu:/home/vinibudd#

iptables (PREROUTING)

root@ubuntu:/home/vinibudd# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 1057 packets, 69363 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REDIRECT   tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 3128

Chain INPUT (policy ACCEPT 769 packets, 53067 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 2136 packets, 150K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 2136 packets, 150K bytes)
 pkts bytes target     prot opt in     out     source               destination
root@ubuntu:/home/vinibudd#

Summing up. I want my traffic to go through Squid, but I'm doing something wrong.

IP address of my router 192.168.1.4 IP from my server (old laptop) 192.168.1.150

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.