Networks

Ask something
Question Locked

block squid anonymous request

0 helpful
7 replies

by nikhilkr.rhce

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

hi all,

we have a squid proxy server in my office. we are using squid server for internet sharing. since last few days we got the internet very slow and we have chkd the squid accesslog we found some anonymous request in that log. the ip mentioned in that log has not in our network. could anybody know how to avoid these CONNECT request.

log>>

1201711176.024 59043 203.67.113.32 TCP_MISS/503 0 CONNECT 203.188.197.9:25 - DIRECT/203.188.197.9 -
1201711176.213 22047 59.104.7.192 TCP_MISS/200 370 CONNECT 195.129.12.231:25 - DIRECT/195.129.12.231 -
1201711176.368 3567 118.168.158.93 TCP_MISS/503 0 CONNECT 168.95.6.111:25 - DIRECT/168.95.6.111 -
1201711176.373 7733 203.67.113.21 TCP_MISS/200 137 CONNECT 210.59.228.93:25 - DIRECT/210.59.228.93 -
1201711176.724 79839 203.67.113.76 TCP_MISS/200 1095 CONNECT 211.20.188.150:25 - DIRECT/211.20.188.150 -
1201711176.789 2140 59.104.7.157 TCP_MISS/200 62 CONNECT 199.253.19.94:25 - DIRECT/199.253.19.94 -
1201711176.830 72862 59.104.7.253 TCP_MISS/200 258 CONNECT 211.21.151.19:25 - DIRECT/211.21.151.19 -
1201711176.897 23226 118.168.152.127 TCP_MISS/200 1974 CONNECT 210.243.151.234:25 - DIRECT/210.243.151.234 -
1201711177.004 59851 118.168.135.208 TCP_MISS/503 0 CONNECT 168.95.5.73:25 - DIRECT/168.95.5.73 -
1201711177.004 59985 59.104.7.176 TCP_MISS/503 0 CONNECT 60.250.18.59:25 - DIRECT/60.250.18.59 -
1201711177.004 59561 203.67.113.155 TCP_MISS/503 0 CONNECT 72.14.221.114:25 - DIRECT/72.14.221.114 -
1201711177.289 12285 118.168.153.179 TCP_MISS/200 394 CONNECT 65.54.244.136:25 - DIRECT/65.54.244.136 -
1201711177.987 51167 203.67.113.32 TCP_MISS/200 312 CONNECT 59.124.16.179:25 - DIRECT/59.124.16.179 -
1201711178.054 59570 59.104.7.23 TCP_MISS/503 0 CONNECT 168.95.6.132:25 - DIRECT/168.95.6.132 -
1201711178.054 59869 203.67.113.41 TCP_MISS/503 0 CONNECT 168.95.5.18:25 - DIRECT/168.95.5.18 -
1201711178.063 24477 203.67.113.32 TCP_MISS/200 1924 CONNECT 210.160.15.6:25 - DIRECT/210.160.15.6 -
1201711178.202 18089 118.168.152.127 TCP_MISS/200 204 CONNECT 68.142.202.247:25 - DIRECT/68.142.202.247 -
1201711178.313 22514 203.67.113.32 TCP_MISS/200 2349 CONNECT 60.248.41.49:25 - DIRECT/60.248.41.49 -
1201711178.521 8755 203.67.113.141 TCP_MISS/200 175 CONNECT 217.146.188.189:25 - DIRECT/217.146.188.189 -
1201711178.714 19688 203.67.113.32 TCP_MISS/200 2150 CONNECT 60.248.144.6:25 - DIRECT/60.248.144.6 -
1201711178.856 16304 203.67.113.122 TCP_MISS/200 372 CONNECT 64.18.5.11:25 - DIRECT/64.18.5.11 -

Please Advice
Nikhil K R

7 replies

by dumphrey

And if you have not done so, webmin makes a good front end to squid. Also, looking through the default squid.conf file should show you where to allow connections from if you want to edit the file directly.

by evilhomergd

but I still end up going to vi for 99% of my configuration.

Pete did hit the nail on the head. You'll need to create some ACL entries to allow only computers on your network to access your proxy. The ACLs should look something like this:
acl localnet src 192.168.0.0/24 (substitute your IP block and subnet for the one I used)
http_access allow localnet (this allows the computers in your local network as configured above to access the web through sqiud)
http_access deny all (this should be the last rule as it will block anything not specifically allowed in an earlier rule)

HTH

by subhradip

HTTP can be used for downloading (GETting data) or uploads (POSTing data to a site).
Simmilarly the CONNECT mode is used for SSL data transfers. When a connection is made to the proxy the client specifies what kind of request (called a method) it is sending.
So when 'https' is come into play in place of 'http', CONNECT is used in place of GET.
But in your case squid proxy is not configured properly so it is not allowing ssl(https) connections like "https//mail.google.com", etc through it p, so your LAN network become very slow. I'm also facing same problem, for some days. So trying to sort out the squid configuration problem actively.If you find any solution pl. give a rply to me at my mail address subhradip1039@gmail.com

by tobif

You just answered a 2.5 years old question.
Any cheese that old would have been finished by now.
The initial problem has probably also been solved (or abandoned), so we're just left here with archives and academic interest.

by oldbaritone

acl localnet src 203.67.113.0.0/255.255.255.0
..
http_access deny !localnet
icp_access deny !localnet

(I'm guessing that 203.67.113.x is your in-house network.)

Right now, you're running an "open" proxy, and outsiders are using your equipment to "anonymize" their browsing. Often that means they're doing something they're not supposed to. Get your proxy secured ASAP.

This discussion is closed to new replies.