PROBLEM - Squid - create a exception for an IP Address to pass direct

dikamba · 02-01-2010, 10:16 AM

Hi guys ,
I need your help for a problem that it's happening in my customer.

What I need is to change the configuration of a proxy, configured on Linux Cent OS v 4.3( explanation - see below) .My squid configuration's file it's like this:

WELCOME TO SQUID 2
# ------------------
#
# This is the default Squid configuration file. You may wish
# To look at the Squid home page (http://www.squid-cache.org/)
# For the FAQ and other documentation.

Detail of the squid config:

http_port 8080

src 111.222.230.0/28 acl net_YYY

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # http multiling
acl CONNECT method CONNECT

http_access allow net_YYY
http_access deny all
http_reply_access allow all
icp_access allow all

NEED:

What I need is to create an exception for one of the PCs on my network YYY, so that I can go out of the proxy with a specific IP address and not with the IP of Proxy, this is because then I have a PIX doing - NAT: IP_Proxy = NAT_Proxy, and the PIX has also to do this - NAT: IP_PCYYY = NAT_PCYYY. The only thing is , to do this it's necessary We can out of the proxy with its own IP .

Can you help me in this issue ?

Best regards

dikamba

acid_kewpie · 02-01-2010, 12:38 PM

Well you can use the tcp_outgoing_addess but I'd be more tempted to think you're going about whatever the real issue is in a less than ideal way. If this is a specific machine then why not just don't require it go go via the proxy in the first place and use a NAT rule directly, or leave totally untouched until it hits the pix?

dikamba · 02-09-2010, 06:48 AM

Quote:

Originally Posted by acid_kewpie

Well you can use the tcp_outgoing_addess but I'd be more tempted to think you're going about whatever the real issue is in a less than ideal way. If this is a specific machine then why not just don't require it go go via the proxy in the first place and use a NAT rule directly, or leave totally untouched until it hits the pix?

Hi acid,

I've been out of office in past week and I could not try your approach. Tomorrow I´ll go to this customer to see the "real network configuration". I think that your approach to use a NAT Rule is the most correct. We Wait for tomorrow for more news.

thks for all