From owner-freebsd-questions@FreeBSD.ORG Mon Mar 9 14:57:37 2015 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B1EEADF4 for ; Mon, 9 Mar 2015 14:57:37 +0000 (UTC) Received: from mail-la0-x230.google.com (mail-la0-x230.google.com [IPv6:2a00:1450:4010:c03::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1D8B43B5 for ; Mon, 9 Mar 2015 14:57:37 +0000 (UTC) Received: by labgm9 with SMTP id gm9so2179256lab.13 for ; Mon, 09 Mar 2015 07:57:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=CfjO3+ehAvlCoKEKiHKIaWOWrVGovyTWUJanHN9+X3o=; b=JE2VFvGG9hbox4EuIiPBV8onkO4Bfy/WnJqlg14BBRf9Z+E9g7gi0LKNCeoXpKpkxt o5PMYhBlaQ8yO1HpSVV5TjCBuWQyQITAqaSnn5IkzQHuAObrmaF7EZ++zT+1F6vFg7iM leplzP5poMtgRtlhqdpRRz0Uv4zo/7othY2lw6AT1kxOhTo1JOKWFK2FwlS7ST8PFqWl tvrfxTsWqOkkMCMHxI5kY1WCJVRSRPrD2DZVG7af5jUoOe0b23m8wYVKzxeBEtrSWHny Tb3iHoxzc6RPeviT3zjZoREiEivbpemBg/qKyX2qw99VCCB4i+VdgBDpB4I3H7daWaWs WlZg== X-Received: by 10.152.245.41 with SMTP id xl9mr9338306lac.24.1425913054881; Mon, 09 Mar 2015 07:57:34 -0700 (PDT) MIME-Version: 1.0 Received: by 10.112.89.170 with HTTP; Mon, 9 Mar 2015 07:57:14 -0700 (PDT) In-Reply-To: References: From: Monah Baki Date: Mon, 9 Mar 2015 10:57:14 -0400 Message-ID: Subject: Re: FreeBSD PF question To: krad Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: FreeBSD Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2015 14:57:37 -0000 I'm a not a cisco person, but "no ip redirect" shouldn't that take care of it? Thanks On Mon, Mar 9, 2015 at 10:46 AM, krad wrote: > yes the squid box needs to be whitelisted for no redirection > > On 9 March 2015 at 14:27, Monah Baki wrote: > >> Should I do this on the cisco itself? >> >> On Mon, Mar 9, 2015 at 10:24 AM, krad wrote: >> >>> It sounds like your cisco isnt letting the squid web traffic out and >>> redirecting it back to itself. You need to exclude the squid proxyies >>> address from redirection >>> >>> On 9 March 2015 at 14:03, Monah Baki wrote: >>> >>>> Hi All, >>>> >>>> I have a freebsd 10.1 server with a single interface (bge0) running >>>> squid >>>> in intercept mode. There is a Cisco device doing the policy routing. >>>> >>>> interface GigabitEthernet0/0/1.1 >>>> >>>> encapsulation dot1Q 1 native >>>> >>>> ip address 10.0.0.9 255.255.255.0 >>>> >>>> no ip redirects >>>> >>>> no ip unreachables >>>> >>>> ip nat inside >>>> >>>> standby 1 ip 10.0.0.10 >>>> >>>> standby 1 priority 120 >>>> >>>> standby 1 preempt >>>> >>>> standby 1 name HSRP >>>> >>>> ip policy route-map CFLOW >>>> >>>> >>>> >>>> ip access-list extended REDIRECT >>>> >>>> deny tcp host 10.0.0.24 any eq www >>>> >>>> permit tcp host 10.0.0.23 any eq www >>>> >>>> >>>> >>>> route-map CFLOW permit 10 >>>> >>>> match ip address REDIRECT >>>> set ip next-hop 10.0.0.24 >>>> >>>> My squid.conf has the following: >>>> http_port 3128 >>>> http_port 3129 intercept >>>> >>>> >>>> >>>> My pf.conf has the following: >>>> >>>> rdr on bge0 inet proto tcp from 10.0.0.0/8 to any port 80 -> 10.0.0.24 >>>> port >>>> 3129 >>>> # block in >>>> pass in log quick on bge0 >>>> pass out log quick on bge0 >>>> pass out keep state >>>> >>>> >>>> >>>> User gets an access denied on browsing, and in my cache.log file, I see: >>>> WARNING: Forwarding loop detected for: >>>> >>>> >>>> >>>> Any help/guidance is appreciated. >>>> >>>> >>>> Thanks >>>> _______________________________________________ >>>> freebsd-questions@freebsd.org mailing list >>>> http://lists.freebsd.org/mailman/listinfo/freebsd-questions >>>> To unsubscribe, send any mail to " >>>> freebsd-questions-unsubscribe@freebsd.org" >>>> >>> >>> >> >