From owner-freebsd-questions@FreeBSD.ORG Sat Feb 28 15:19:42 2015 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id CF968CE3 for ; Sat, 28 Feb 2015 15:19:42 +0000 (UTC) Received: from mail-la0-x22f.google.com (mail-la0-x22f.google.com [IPv6:2a00:1450:4010:c03::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 37AE2A9 for ; Sat, 28 Feb 2015 15:19:42 +0000 (UTC) Received: by labgm9 with SMTP id gm9so22787577lab.2 for ; Sat, 28 Feb 2015 07:19:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=QV+tU87UNAvmjMq0iJpGHb90R7AT0EvU5h1e+bJXbK0=; b=t6tDn6kWDhFLs2OLLcIkhTAml5scMzOnUfcCJTf4NXEX8QxbeBnd01dsJjH6PUgMbS wsPhbKrCTPQ2mAVytpZ2pVNSpssUdj9GXWI6Wx1fmeNWRKLge8n1LI1tYnTApELFzOVM imNIgzhtB61OQdCWMPoQsY5iZntjW96GUC44llHicjv6/QW0sGt2CUUxsztzRtiO94ZB MgTq9ifSnwAIS6psDOwm2VqHG+6cpH/L8LS23YouqFqYlulzGJlgVamiXZOhTGmVmV1g u4MHeFGuWXwPHizj6KrtKrFoAzv4rO5oQnnCMd7M3DaADDZwdYwI7UQcElkC+JHH0CiB RGiA== X-Received: by 10.152.22.67 with SMTP id b3mr16885467laf.117.1425136780365; Sat, 28 Feb 2015 07:19:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.112.89.170 with HTTP; Sat, 28 Feb 2015 07:19:20 -0800 (PST) In-Reply-To: References: From: Monah Baki Date: Sat, 28 Feb 2015 10:19:20 -0500 Message-ID: Subject: Re: FreeBSD RDR question To: Odhiambo Washington Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: FreeBSD Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Feb 2015 15:19:42 -0000 The server has one interface only. On the router this is the clients config: ip access-list extended REDIRECT (Redirect of my IP www) deny tcp host 10.0.0.24 any eq www permit tcp host 10.0.0.23 any eq www route-map CFLOW permit 10 (route map) match ip address REDIRECT set ip next-hop 10.0.0.24 # rdr pass inet proto tcp from 10.0.0.9/32 to any port 80 -> 10.0.0.24 port 3128 rdr pass on bge0 proto tcp from any to bge0 port 80 -> 10.0.0.24 port 3128 # block in pass in log quick on bge0 pass out log quick on bge0 pass out keep state' pf_enable="YES" pf_flags="" # additional flags for pfctl startup pf_rules="/etc/pf.conf" pflog_enable="YES" http_port 3128 http_port 80 intercept On Sat, Feb 28, 2015 at 10:10 AM, Odhiambo Washington wrote: > So, it would be great of you could show us the relevant configurations of > FreeBSD (rc.conf(, squid.conf, pf.conf and the router configurations. > > > 1. Do you have gateway_enable="YES" in rc.conf? > 2. Are you using the gree tunnel method? > > If you are using WCCP2, please google for "wccp2 squid freebsd). There's a > lot more needed in squid.conf for WCCP2. > > We cannot guess all these. > > > > On 28 February 2015 at 15:41, Monah Baki wrote: > >> The user cannot access the internet. If he enters however the IP and port >> number in his browser he can access the internet. >> >> I have the server running in intercept mode, in my squid.con >> >> http_port 3128 intercept >> >> http_port 80 >> >> >> >> The log files display00:00:19.008499 rule 0..16777216/0(match): pass in >> on bge0: 10.0.0.111.5678 > 255.255.255.255.5678: UDP, length 93 >> >> 00:00:00.764414 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.50.5678 > 255.255.255.255.5678: UDP, length 91 >> >> 00:00:00.120755 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.56.5678 > 255.255.255.255.5678: UDP, length 91 >> >> 00:00:00.070800 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.53.5678 > 255.255.255.255.5678: UDP, length 91 >> >> 00:00:00.150908 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.55.5678 > 255.255.255.255.5678: UDP, length 91 >> >> 00:00:09.898853 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.14.63515 > 10.0.0.24.22: Flags [S], seq 2684525113, win 8192, >> options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0 >> >> 00:00:00.186720 rule 0..16777216/0(match): pass in on bge0: >> 10.0.0.54.5678 > 255.255.255.255.5678: UDP, length 91 >> >> >> >> >> Thanks >> >> >> >> On Sat, Feb 28, 2015 at 7:10 AM, Odhiambo Washington >> wrote: >> >>> By 'it's not working', what do you mean? >>> >>> What do you see in squid's access log? That would make more sense. >>> >>> Does 10.0.0.24 know how to get to the Internet? >>> >>> I need to read about WCCP2 because never used it before. It did look >>> simple enough though from the HOWTOs I read. >>> >>> >>> >>> >>> On 28 February 2015 at 15:03, Monah Baki wrote: >>> >>>> Hi all, >>>> >>>> I have a freebsd 10.1 running squid, it has a single interface (bge0). >>>> My >>>> Cisco is doing policy based routing and forwarding all http request to >>>> my >>>> Freebsd server. >>>> >>>> In my pf.conf I have the following rule: >>>> >>>> rdr on bge0 inet proto tcp from any to any port 80 -> 10.0.0.24 port >>>> 3128 >>>> >>>> >>>> Do I need to add anything else? Reason I ask, it's not working. >>>> >>>> >>>> Thanks >>>> Monah >>>> _______________________________________________ >>>> freebsd-questions@freebsd.org mailing list >>>> http://lists.freebsd.org/mailman/listinfo/freebsd-questions >>>> To unsubscribe, send any mail to " >>>> freebsd-questions-unsubscribe@freebsd.org" >>>> >>> >>> >>> >>> -- >>> Best regards, >>> Odhiambo WASHINGTON, >>> Nairobi,KE >>> +254733744121/+254722743223 >>> "I can't hear you -- I'm using the scrambler." >>> >> >> > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254733744121/+254722743223 > "I can't hear you -- I'm using the scrambler." >