Добрый день, уже бьюсь неделю. Стоит маршрутизатор TP-Linck который прошит под OpenWRT, внутри локальной сети(192.168.1.1) есть сервер с установленным squid(3.5.23)(192.168.1.3). Сквид настроен как прозрачный и не прозрачный одновременно через
http_port 3129 http_port 127.0.0.1:3128 intercept
При этом не прозрачный прокси отрабатывает без проблем. Перенаправление в правилах шлюза задано следующим образом:
-A zone_lan_postrouting -p tcp -m tcp --dport 3128 -m comment --comment "!fw3: @redirect[1]" -j SNAT --to-source 192.168.1.1
-A zone_lan_prerouting ! -s 192.168.1.3/32 ! -d 192.168.1.0/24 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: forward proxy" -j DNAT --to-destination 192.168.1.3:3128
По tcpdump по портам 80 и 3128 видно как ходят пакеты, но сожалению результат в браузере «Не удается получить доступ к сайту»
Конфигурация сквида:
===============================================================
############## HAVP #############
cache_peer 127.0.0.1 parent 3131 0 no-query no-digest no-netdb-exchange default
cache_peer_access 127.0.0.1 allow all
############## SQUID #############
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 1025-65535 # unregistered ports
acl localnet src 192.168.1.0/24
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow localnet
http_access deny all
http_port 3129
http_port 127.0.0.1:3128 intercept
dns_v4_first on
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_effective_user proxy
cache_effective_group proxy
cache_dir ufs /var/cache/squid 100 16 256
icp_access allow all
http_reply_access allow all
===============================================================
Лог cash.log сквида:
===============================================================
2018/01/09 12:59:56 kid1| Set Current Directory to /var/spool/squid
2018/01/09 12:59:56 kid1| Starting Squid Cache version 3.5.23 for x86_64-pc-linux-gnu...
2018/01/09 12:59:56 kid1| Service Name: squid
2018/01/09 12:59:56 kid1| Process ID 1493
2018/01/09 12:59:56 kid1| Process Roles: worker
2018/01/09 12:59:56 kid1| With 65535 file descriptors available
2018/01/09 12:59:56 kid1| Initializing IP Cache...
2018/01/09 12:59:56 kid1| DNS Socket created at [::], FD 6
2018/01/09 12:59:56 kid1| DNS Socket created at 0.0.0.0, FD 8
2018/01/09 12:59:56 kid1| Adding domain sed.fat from /etc/resolv.conf
2018/01/09 12:59:56 kid1| Adding domain sed.fat from /etc/resolv.conf
2018/01/09 12:59:56 kid1| Adding nameserver 192.168.1.1 from /etc/resolv.conf
2018/01/09 12:59:56 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2018/01/09 12:59:56 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2018/01/09 12:59:57 kid1| Unlinkd pipe opened on FD 14
2018/01/09 12:59:57 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2018/01/09 12:59:57 kid1| Store logging disabled
2018/01/09 12:59:57 kid1| Swap maxSize 102400 + 262144 KB, estimated 28041 objects
2018/01/09 12:59:57 kid1| Target number of buckets: 1402
2018/01/09 12:59:57 kid1| Using 8192 Store buckets
2018/01/09 12:59:57 kid1| Max Mem size: 262144 KB
2018/01/09 12:59:57 kid1| Max Swap size: 102400 KB
2018/01/09 12:59:57 kid1| Rebuilding storage in /var/cache/squid (clean log)
2018/01/09 12:59:57 kid1| Using Least Load store dir selection
2018/01/09 12:59:57 kid1| Set Current Directory to /var/spool/squid
2018/01/09 12:59:57 kid1| Finished loading MIME types and icons.
2018/01/09 12:59:57 kid1| HTCP Disabled.
2018/01/09 12:59:57 kid1| commBind: Cannot bind socket FD 19 to [::1]: (99) Cannot assign requested address
2018/01/09 12:59:57 kid1| commBind: Cannot bind socket FD 20 to [::1]: (99) Cannot assign requested address
2018/01/09 12:59:57 kid1| ERROR: Failed to create helper child read FD: UDP[::1]
2018/01/09 12:59:57 kid1| Configuring Parent 127.0.0.1/3131/0
2018/01/09 12:59:57 kid1| Squid plugin modules loaded: 0
2018/01/09 12:59:57 kid1| Adaptation support is off.
2018/01/09 12:59:57 kid1| Accepting HTTP Socket connections at local=[::]:3129 remote=[::] FD 17 flags=9
2018/01/09 12:59:57 kid1| Accepting NAT intercepted HTTP Socket connections at local=127.0.0.1:3128 remote=[::] FD 18 flags=41
2018/01/09 12:59:57 kid1| Done reading /var/cache/squid swaplog (10 entries)
2018/01/09 12:59:57 kid1| Finished rebuilding storage from disk.
2018/01/09 12:59:57 kid1| 10 Entries scanned
2018/01/09 12:59:57 kid1| 0 Invalid entries.
2018/01/09 12:59:57 kid1| 0 With invalid flags.
2018/01/09 12:59:57 kid1| 10 Objects loaded.
2018/01/09 12:59:57 kid1| 0 Objects expired.
2018/01/09 12:59:57 kid1| 0 Objects cancelled.
2018/01/09 12:59:57 kid1| 0 Duplicate URLs purged.
2018/01/09 12:59:57 kid1| 0 Swapfile clashes avoided.
2018/01/09 12:59:57 kid1| Took 0.01 seconds (1142.99 objects/sec).
2018/01/09 12:59:57 kid1| Beginning Validation Procedure
2018/01/09 12:59:57 kid1| Completed Validation Procedure
2018/01/09 12:59:57 kid1| Validated 10 Entries
2018/01/09 12:59:57 kid1| store_swap_size = 224.00 KB
2018/01/09 12:59:58 kid1| storeLateRelease: released 0 objects
===============================================================
Помогите победить «Не удается получить доступ к сайту» для прозрачного прокси!!!!
