From owner-freebsd-pf@FreeBSD.ORG Fri Dec 19 13:48:45 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6F3711065674 for ; Fri, 19 Dec 2008 13:48:45 +0000 (UTC) (envelope-from allicient3141@googlemail.com) Received: from mail-bw0-f19.google.com (mail-bw0-f19.google.com [209.85.218.19]) by mx1.freebsd.org (Postfix) with ESMTP id E22D18FC20 for ; Fri, 19 Dec 2008 13:48:44 +0000 (UTC) (envelope-from allicient3141@googlemail.com) Received: by bwz12 with SMTP id 12so2707998bwz.19 for ; Fri, 19 Dec 2008 05:48:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references :x-google-sender-auth; bh=CUoWX9efHFFQsE/jG/O+HI+Zvl4jpSKRx1s80CrDXcs=; b=Gy/o+bjIY4JEl0mIrhrdLlsJqkDk8wOyUNYA39YbmJXdkJZrY1WR0kAGlp1rq7kUvK iqYgYwEfa6McDjrBijT3VbKSrrGdSnPkL5FdeyT722dB4OA98p85CiUe+WfrQcwngcak W9e72SGo+KrizCPoA3ZKagrVNKOoU9ted/hXY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=uD1Jw8gJxF+SYMLb/MwQX8+vp+/CxVNa5CMb+zrbQuqd5TYfqXVMo/v1vJc0X8aNne k1g88e6juGjMIgCI7g1V8zX5Xd59qhCHJ1m3R2S0quCfHFPatddEcpKIBhbYZMRlSbmY qAuC+wQO5F0sf+2M6JWiqS88gK9C48gtdiBpU= Received: by 10.181.216.14 with SMTP id t14mr116553bkq.103.1229694521912; Fri, 19 Dec 2008 05:48:41 -0800 (PST) Received: by 10.181.195.18 with HTTP; Fri, 19 Dec 2008 05:48:41 -0800 (PST) Message-ID: <7731938b0812190548r399e6c2by4ff666ce9fa63481@mail.gmail.com> Date: Fri, 19 Dec 2008 13:48:41 +0000 From: "Peter Maxwell" Sender: allicient3141@googlemail.com To: freebsd-pf@freebsd.org In-Reply-To: <494B9FE5.6070501@eskk.nu> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <494B9FE5.6070501@eskk.nu> X-Google-Sender-Auth: 4cddc822b7035722 Subject: Re: clientNatLookup: PF open failed: (13) Permission denied X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Dec 2008 13:48:45 -0000 Hi Leslie, The message you're getting is usually associated with the rule base blocking an outbound connection - so check that you've opened all the outbound ports that squid needs in your pf.conf. Tip: you can use tcpdump to see what's going on, the openbsd pf pages at http://www.openbsd.org/faq/pf/logging.html will give an introduction and there's lots of info on tcpdump around - note tcpdump is great for testing purposes but don't use tcpdump on a production box (it's not got a great security record and if you get the parameters wrong with high load you can kill the box). Transparent http proxing is basically where there is a rdr rule in your pf config so that outbound port 80 connections (or 443 for that matter) are forwarded to squid's inbound port and, if configured properly, squid can then handle the request. The reason its called 'transparent' is because the user's broswer doesn't need configuring because pf redirects all http traffic - so to the browser it just looks like a direct connection to the internet (with a few extra HTTP headers). There are several implications of this, if squid fails (which it does a lot) then you don't get web browsing until you fix squid; it forces use of the proxy; you can use any authentication mechanisms with squid. Personally, transparent proxying is more trouble than its worth but your milage may vary. Best wishes, Peter 2008/12/19 Leslie Jensen : > I've tried the squid users mail list but I try here. I'm aware that this > list is not a squid list, but with it beeing PF I hope someone has a > suggestion how to fix my problem. > > I'm not sure if I want to change the rights on /dev/pf that's why I'm > asking. > > > > I'm running Squid-3.0.10 on FreeBSD 7.0-RELEASE-p4 with PF. > > I've noticed that in cache.log are a lot of entries as the one below > > clientNatLookup: PF open failed: (13) Permission denied > > I've found some information on the problem via Google. > > One is "start Squid as root". Squid is started via rc.conf so I think > that is sorted. > > There is a concern about rights on /dev/pf > > Finally there's some advice > > ---- snip---- > If you are performing any kind of transparent interception with squid > you will need one of the --*-transparent options. Without it squid will > fail to correctly spoof the clients IP. > ----- snip ---- > > I do not fully understand where the "--*-transparent options" are to be > found. And if it's the solution to the problem. > > Will someone Please enlighten me? > > Thank you > /Leslie > > > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" >