I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external intercepting and filtering proxy service).
Our network setup looks like this:
[Client device/browser] -- [proxy, public IP only] -- [target websites, e.g. Google, Facebook, etc]
When testing out the setup, doing this from a Linux client works fine (since port 8991 is not set up with intercept):
$ curl --proxy http://<squidserverip>:8991 http://www.example.com/
This version, however, gives out an Access Denied error page from Squid (since port 8990 is set up with intercept):
$ curl --proxy http://<squidserverip>:8990 http://www.example.com/
On the Squid server, I see the following in cache.log:
2015/03/11 20:10:44 kid1| WARNING: Forwarding loop detected for:
GET / HTTP/1.1
User-Agent: curl/7.26.0
Host: www.example.com
Accept: */*
Via: 1.1 <servername> (squid/3.4.8)
X-Forwarded-For: <client-source-ip>
Cache-Control: max-age=259200
Connection: keep-alive
In these examples, I've obfuscated the actual requests (with placeholder names/titles), for security reasons.
My squid.conf currently looks like this (with commented lines and blank lines removed):
acl SSL_ports port 443
acl SSL_ports port 8443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 8443
acl CONNECT method CONNECT
acl SSL method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow localhost
http_access allow all
http_reply_access allow all
http_port 8990 intercept ssl-bump cert=/etc/squid3/certificate.pem generate-host-certificates=on
http_port 8991
https_port 8443 cert=/etc/squid3/certificate.pem key=/etc/squid3/certificate.pem ssl-bump intercept generate-host-certificates=on dynamic_cert_mem_cache_size=4MB options=ALL
ssl_bump none localhost
ssl_bump client-first all
sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_error allow all
sslcrtd_program /usr/lib/squid3/ssl_crtd -s /var/lib/ssl_db -M 4MB
sslcrtd_children 5
netdb_filename none
coredump_dir /var/spool/squid3
pinger_enable off
cache deny all
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
query_icmp off
always_direct allow all
never_direct allow all
Based on my searches via Google, I've come to the conclusion that the intercept functionality requires me to set up some custom routing with iptables, but none of the various configurations I've tried have given any results.
We seem to be able to connect to Squid from the client just fine (on all three ports, including SSL handshake for https_port), but I'm unable to successfully perform requests on the two ports that do the intercepting.
Any help would be appreciated, either with the correct iptables setup for our network configuration, or changes needed to squid.conf (or other config files on the server).
