Squid proxy cannot access host via IPV6. . .
 

Hello, I'm having some problems configuring Squid (3.1.18) web proxy to work via IPV6.

My primary scenario is as follows:

I am attempting to access a host using a cannonical ipv6 address via a web proxy that is also addressed via a cannonical ipv6 address. I am using a browser on a windows machine to test this with (IE 8).

I get the following error:

ERROR. The requested URL cannot be retrieved

The following error was encountered while trying to retrieve the URL: http://[ipv6 address retdacted]

Access Denied.

Access control configuration prevents your request from being allowed at this time. Please contact your service provider at this time if you feel this is incorrect.

The other scenario is accessing the host using a cannonical ipv6 address via a web proxy that is addressed via a cannonical ipv4 address. This worked at one time but now fails with the following error:

ERROR. The requested URL cannot be retrieved

The following error was encountered while trying to retrieve the URL: http://[ipv6 address retdacted]

Connection to [ipv6 address retdacted] failed.

The system returned:(101) network is unreachable
The remote host or network may be down. Please try the request later.

Things I should point out:

- The host is accessible. If you enter the address without the proxy designated, the host is reachable just fine.
- The squid web proxy 3.1.18 is running on a machine running Ubuntu 10.4. The machine has two NIC's, one has a fixed address, the other is DHCP.
- All hosts involved are IPV6 capable and have valid IPV6 addresses.


Any help you may be able to offer would be most appreciated. Thanks in advance,

Rory

P.S. Here is my squid.conf file . . .


#
# Recommended minimum configuration:
#

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

# for IPV6 added 3/20

acl to_ipv6 dst ipv6
http_access allow to_ipv6 !all
tcp_outgoing_address [ipv6 address redacted] to_ipv6
tcp_outgoing_address [ipv4 address redacted] !to_ipv6



# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/64 # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /usr/local/squid/var/cache 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/var/cache

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

Hey, sorry, I have very little experience with IPv6, and proxies, however I don't see any configuration to allow your host to go through the proxy. I see something where it says "Insert your rules here," but I only see that your localhost is allowed through, and localnet. Is it possible that the host you are trying to forward through is not on your "localnet?"

Squid Config . . .
 

. . . well, funny you should mention that (I thought about that as well). Accrording to their docs I don't need it. Supposedly Squid is listening on port 3128 as I have it configured and it certainly appears to be doing so.

I should mention that the error pages I see in the browser are coming from Squid. When I look at what is coming back over the wire I see a 403 error when I have an IPV6 Proxy to IPV6 Host and a 503 error when using IPV4 Proxy to IPV6 Host. From all indications, I can get to the web proxy but it's not passing my traffic through.

The thing that is really bewildering is that I had this working for IPV4 Proxy to IPV6 host at one time. A reboot of the server appeared to 'fix' that and I haven't been able to get it back since.

I am rather un-experienced with linux and just stumbled through this so far (building and installing Squid). Most of the info I've gotten has been through blogs and forum posts (including the ipv6 specific configuration). My struggle continues.

Actually, I should ammend my last post,

This part of the config is what should allow my machines to connect to the proxy:

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/64 # RFC 4291 link-local (directly plugged) machines

My local machines have 10.x.x.x and fec0:: local addresses . . . wait a minute, I don't have fec0 in my access list.! let me give that a try.

Thanks.

OK, I'm one step further along. In the process I discovered that my outgoing NIC was misconfigured. I also added/corrected the following to squid.conf:

acl localnet src fe80::/18 # RFC 4291 link-local (directly plugged) machines
acl localnet src fec0::/18 # RFC 4291 link-local (directly plugged) machines

"/18" is the correct subnet.

Now, in both my scenarios I get this error:

The system returned: (99) Cannot assign requested address Squid is unable to create a TCP socket, presumably due to excessive load. Please retry your request.

This is also a squid web page so I'm still getting in but not out.

After much tinkering with the interface settings I am now at the point where:

- I can reach the proxy using an IPV6 address.
- Through the proxy I can reach the host with an IPV4 address.
- I can also reach the proxy using an IPV4 address
- I can use the IPV4 proxy to reach an IPV4.
- I cannot use the IPV6 proxy to reach the host with an IPV6 address
- I cannot use the IPV4 proxy to reach the host with an IPV6 address

The last scenario worked at one time but somehow I've not been able to make it work since.

The error I get now is (101) Network Unreachable. This is not entirely true as I can go on my proxy server and browse the target host, ping the target host in both IPV4 and IPV6 and ping the web proxy from the target host.

Still, this is progress . . .

You can check port forwarding issues for IPv6 and refer to this link also: http://wiki.squid-cache.org/Features/IPv6

From what I can find through some Google searches, maybe try another version?

Thanks everyone.

I think I've solved the issue even though I still don't fully understand how and why. I think it is an issue with my network and will have to ask the IT staff about it.

When I commented out this line, I was able to access my ipv6 server via the proxy:

#tcp_outgoing_address [ipv4 address redacted] !to_ipv6


I suspect that my network might be tunneling but I'll have to wait until I can get wireshark on the outbound side of the proxy.

It might be just me, but this seems counter-intuitive.