Iptables – Squid 3.5: Preventing forwarding loop in intercept mode

dnatiptablessquid

I have set up a router and an intercepting HTTP squid proxy on different machines. Clients should use the proxy (without knowledge) in the following way:

Client -> Router (DNATing to proxy server) -> Proxy Server -> Router -> Internet

Requests that arive at the proxy server have the following attributes:

  • Source IP address: original client's IP address
  • Source port: original client's port
  • Destination IP address: proxy server's IP address (192.168.4.50)
  • Destination port: 3380

Unfortunately it seems like squid is trying to forward packets to the request's destination address, which is the proxy server itself, and creates an infinite loop. Taken from the cache.log:

2015/12/18 14:11:50 kid1| WARNING: Forwarding loop detected for:

How can I configure squid to instead resolve the hostname in the HTTP request via DNS and then forward the requests to the resolved IP address on the default HTTP port 80?

Addition information:

DNAT is done by iptables on the router, with the following rule:
iptables -t nat -A PRE_VS_PROXY -p tcp --dport 80 -j DNAT --to-destination 192.168.4.50:3380

Example entry of access.log:

1450444309.741      0 192.168.4.50 TCP_MISS/403 4277 POST http://ocsp.digicert.com/ - HIER_NONE/- text/html
1450444309.742     46 192.168.4.46 TCP_MISS/403 4341 POST http://ocsp.digicert.com/ - ORIGINAL_DST/192.168.4.50 text/html

Effective configuration of squid:

http_access allow localhost manager
http_access deny manager

http_access deny to_localhost

cache deny all

http_access allow all
http_access deny all

http_port 3128
http_port 3380 intercept
http_port 3443 intercept

coredump_dir /var/squid/cache/squid
shutdown_lifetime 1 seconds

Looking at the DNS traffic using tcpdump, I can see that actually two DNS requests are being made when the squid is processing HTTP requests: one to resolve the hostname in the HTTP request, and one is a reverse lookup of the request's destination IP address.

Best Answer

I met the similar requirement as well today. After some digging, it looks like this is a feature for Squid to prevent a vulnerable http://www.squid-cache.org/Advisories/SQUID-2011_1.txt.

Reading code from https://github.com/squid-cache/squid/blob/master/src/peer_select.cc#L287. It intentionally avoids DNS lookup for host in interception mode.

Related Topic