Squid Proxy Server not allowing connections

Mastermind- · 04-03-2012, 04:32 PM

Hello LQ!

I wanted to share a problem with you in the hope that you will be able to work out a solution with me.

I have tried to setup Squid proxy but everytime I try to access a webpage I get the famous webpage "The requested URL could not be retrieved - Access Denied."

The access.log tells me:

Code:

1333487822.659      0 55.555.555.55 TCP_DENIED/403 2596 GET http://google.com/ - NONE/- text/html
1333487822.711      0 55.555.555.55 TCP_DENIED/403 2406 GET http://google.com/favicon.ico - NONE/- text/html

I have tried several solutions that I've found elsewhere on this forum, but without any luck.

This is my config file:

http://pastebin.com/RTdr92LV

Could you please help me?

Thanks in advance!

dougt · 04-09-2012, 04:47 PM

Is iptables running? If so, stop it and retry the web connection. If it works, there's your problem.

nikmit · 04-11-2012, 08:28 AM

If you see those logs, iptables is letting the traffic through.

You need to modify the config file though. The default one has no way of knowing what is your local subnet, and who should squid proxy for - you do not want to be an open proxy, allowing connections from everyone.

Code:

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
#acl localnet src 192.168.0.0/16        # RFC1918 possible internal network
....
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost home

Uncomment the relevant localnet entry, and the last but one line. If your local network is 192.168.123.0 then it should look like this:

Code:

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16        # RFC1918 possible internal network
....
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost home

Or you can ber more specific and say 'acl localnet src 192.168.123.0/24', or specify multiple access-list entries
acl localnet src x.x.x.x/aa
acl guest1 src y.y.y.y/bb
http_access allow localnet
http_access allow guest1