ipcop-devel Mailing List for IPCop Firewall

David W Studeman wrote:


> I'm not sure if this was just a fluke since the machine I tested on has
> been giving me other problems as of late such as ethernet interfaces
> crashing at random ie not the same one each time or hard lockups while
> streaming over a ralink usb wlan using the proper firmware and the WLAN
> AP. This was my original Raq4 I had in service since June 2007. I see no
> bulging caps at first glance which the Raq3 and 4's have been known to do.
> Sound like hardware to you?
> 

It turns out that the VIA chipped PCI to USB 2.0 I was using in the PCI slot 
was causing this on any 3000 Series Cobalt I used including a Qube 3. 
Lockups are very common with the Via chipped cards as I searched the 
internet. I think the NEC chipped ones would be in order here. 

-- 
Dave Studeman
http://www.raqcop.com 

----- Mail original -----
> De: "Olaf Westrik" <wei...@ip...>
> À: "IPCop devel" <ipc...@li...>
> Envoyé: Mardi 18 Février 2014 11:45:10
> Objet: [IPCop-devel] [2.1+] installation methods
> 
> In future I'd like to 'officially' skip the floppy disk installation
> method and drop the usb-zip installation.
> 

I agree for the floppy removal.
Probably we could remove too usb-fdd and usb-hdd separate images and instead create an isohybrid capable image.

The 3 different format for usb boot (hdd, fdd, zip) may have been needed at a time when usb booting was new and a bios had a bug to understand one of the different acceptable formats.

I had one machine that only understand one format when I tested initially but after a bios upgrade, I was able to use any of the 3 format if I remember well.

Actually just using isohybrid should work fine (this should be what debian already do on current release).

That would allow to supply only one image that should work both for CD and usb booting in almost every x86 machine.
isohybrid is a trick that support in one image both the iso format and usb-hdd to boot.

http://www.syslinux.org/wiki/index.php/Doc/isolinux

isohybrid may have issue with a very small number of bios (those that only work with fdd or zip image).
An example could be https://bugs.archlinux.org/task/32189

This may be a problem if a bios update that fix the boot issue is not available. So probably don't remove yet the various usb- images creation, just let not run that script actually by default, do not distribute any usb image by default so we can see how many time this really happen.

Gilles

On 2014-02-20 12:15, G.W. Haywood wrote:

>> In future I'd like to 'officially' skip the floppy disk installation
>> method and drop the usb-zip installation.
>>
>> 'Modern' hardware should be able to use either CD, PXE boot, USB
>> (hdd/fdd) for installation.
>
> This isn't necessarily to be considered as an objection, but I don't
> think that the definition of 'modern hardware', whatever it is, should
> influence the development of IPCop as much as, say, the development of
> something like a Window manager.

No worries.
We're not considering dropping support for IDE, PCI, etc. These were 
missing in motherboards I had to do with recently. 'really-modern' would 
be something like SATA and PCIe only.


Olaf

Hi there,

On Thu, 20 Feb 2014, Olaf Westrik wrote:

> In future I'd like to 'officially' skip the floppy disk installation 
> method and drop the usb-zip installation.
> 
> 'Modern' hardware should be able to use either CD, PXE boot, USB 
> (hdd/fdd) for installation.

This isn't necessarily to be considered as an objection, but I don't
think that the definition of 'modern hardware', whatever it is, should
influence the development of IPCop as much as, say, the development of
something like a Window manager.

Many IPCop machines are in service as firewalls simply because they've
been pensioned off from other duties.  That certainly applies to many
of the IPCop machines I've used in the past decade or so.

--

73,
Ged.

On 2014-02-20 10:46, Achim Weber wrote:

> Already there:
> http://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.1/
> ->  *-install-usb-hdd*
> ->  *-install-usb-fdd*

<sarcasm on>
Probably better to drop those as well and the documentation too...
<sarcasm off>


Olaf

> I think I'm using the CD image and a converter of CD image to USB boot.
> Now that would be a good thing to include in the standard distribution -
> an image ready to dd to a USB stick :-)

Already there:
http://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.1/
-> *-install-usb-hdd*
-> *-install-usb-fdd*

Achim

On Wed, 2014-02-19 at 18:51 -0800, David W Studeman wrote:

> Olaf Westrik wrote:
> 
> > On 2014-02-19 18:19, Administrator wrote:
> > 
> >> Or am I misunderstanding?
> > 
> > Probably, or are you using floppy disk and/or usb-zip images for
> > installation?
> >
> 
> Unless I am misunderstanding, the usb-zip images are for USB Iomega Zip 
> Drives. Floppies are too small, Zip drives are too, well, less than ideal as 
> a USB storage medium. 
>  
> I had all but forgotten about the existence of ZIP (not to be confused with 
> a USB Flash drive) drives. I had one back when and the last time I used it I 
> got the click of death and decided it was not worth bothering with. 
> Rewritable CDs in themselves made them pointless and then other USB storage 
> mediums really pushed them to the back of the pack.
> 

My apologies to everyone.  I have some USB ZIP drive still, but they're
covered in dust.

Yours
David

On Wed, 2014-02-19 at 19:31 +0100, Olaf Westrik wrote:

> On 2014-02-19 18:19, Administrator wrote:
> 
> > Or am I misunderstanding?
> 
> Probably, or are you using floppy disk and/or usb-zip images for 
> installation?


I think I'm using the CD image and a converter of CD image to USB boot.
Now that would be a good thing to include in the standard distribution -
an image ready to dd to a USB stick :-)

David

Olaf Westrik wrote:

> On 2014-02-19 18:19, Administrator wrote:
> 
>> Or am I misunderstanding?
> 
> Probably, or are you using floppy disk and/or usb-zip images for
> installation?
> 
> 
> Olaf
>

Unless I am misunderstanding, the usb-zip images are for USB Iomega Zip 
Drives. Floppies are too small, Zip drives are too, well, less than ideal as 
a USB storage medium. 
 
I had all but forgotten about the existence of ZIP (not to be confused with 
a USB Flash drive) drives. I had one back when and the last time I used it I 
got the click of death and decided it was not worth bothering with. 
Rewritable CDs in themselves made them pointless and then other USB storage 
mediums really pushed them to the back of the pack.

-- 
Dave Studeman
http://www.raqcop.com 

On 2014-02-19 18:19, Administrator wrote:

> Or am I misunderstanding?

Probably, or are you using floppy disk and/or usb-zip images for 
installation?


Olaf

On Tue, 2014-02-18 at 11:45 +0100, Olaf Westrik wrote:

> In future I'd like to 'officially' skip the floppy disk installation 
> method and drop the usb-zip installation.
> 
> 'Modern' hardware should be able to use either CD, PXE boot, USB 
> (hdd/fdd) for installation.


Can I register an objection. I almost always install IPCop from USB
stick.  That said, it doesn't need to be small.  If it'll fit on a CD
it'll fit on any modern USB stick.

I don't use USB disks any more - everything is either on the local hard
drive, local network drives or in the cloud.

Or am I misunderstanding?

David

In future I'd like to 'officially' skip the floppy disk installation 
method and drop the usb-zip installation.

'Modern' hardware should be able to use either CD, PXE boot, USB 
(hdd/fdd) for installation.


Olaf

I cleared my cache and since then squid hasn't been on the top of top!

On 02/16/14 19:10, ipc...@li... wrote:
> Send IPCop-devel mailing list submissions to
> 	ipc...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> or, via email, send a message with subject or body 'help' to
> 	ipc...@li...
>
> You can reach the person managing the list at
> 	ipc...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of IPCop-devel digest..."
>
>
> Today's Topics:
>
>     1. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid
>        high cpu usage (Olaf Westrik)
>     2. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid
>        high cpu usage (Olaf Westrik)
>     3. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid
>        high cpu usage (Eric Oberlander)
>     4. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid
>        high cpu usage (Michael Rasmussen)
>     5. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes squid
>        high cpu usage (Michael Rasmussen)
>     6. Re: [IPCop-user] bug in relase 2.1.0 or 2.1.1: causes	squid
>        high cpu usage (David W Studeman)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sun, 16 Feb 2014 19:58:53 +0100
> From: Olaf Westrik <wei...@ip...>
> Subject: Re: [IPCop-devel] [IPCop-user] bug in relase 2.1.0 or 2.1.1:
> 	causes squid high cpu usage
> To: ipc...@li...
> Message-ID: <530...@ip...>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> On 2014-02-16 16:07, Olaf Westrik wrote:
>
>> Probably because the syntax of squid.conf was changed and we did not
>> rewrite it after the upgrade.
> This is incorrect, the 2.1.1 upgrade did modify squid.conf.
>
> We'll need to repeat calling makesquidconf.pl via upgrade.sh in 2.1.2/setup
> After fixing makesquidconf.pl of course.
>
>
> Olaf
>
>
>
> ------------------------------
>
> Message: 2
> Date: Sun, 16 Feb 2014 21:41:57 +0100
> From: Olaf Westrik <wei...@ip...>
> Subject: Re: [IPCop-devel] [IPCop-user] bug in relase 2.1.0 or 2.1.1:
> 	causes squid high cpu usage
> To: ipc...@li...
> Message-ID: <530...@ip...>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> On 2014-02-16 18:10, Eric Oberlander wrote:
>> It may be part of the problem, but it's not the full story. After I
>> changed 'transparent' to 'intercept' I still get errors in the
>> sytem>proxy logs, and this warning when I run squid -k parse
>> WARNING: HTTP requires the use of Via
>> and still no actual hits on the cache...
> that's only a warning.
>
> For the errors I may have found a solution. Looks like we need 2
> entries, one for transparent and one for 'normal' proxying.
>
> http_port 192.168.1.1:<transparent> intercept
> http_port 192.168.1.1:<webproxy>
>
> This also seems to solve a problem when you have mixed clients (with /
> without proxy config). In my case squid went up to 100% CPU when a
> browser with proxy config tried to access the internet.
>
>
> Will need to think about that, takes some modifications in firewalling too.
>
>
> Olaf
>
>
>
> ------------------------------
>
> Message: 3
> Date: Sun, 16 Feb 2014 21:38:39 +0000
> From: Eric Oberlander <eri...@gm...>
> Subject: Re: [IPCop-devel] [IPCop-user] bug in relase 2.1.0 or 2.1.1:
> 	causes squid high cpu usage
> To: Olaf Westrik <wei...@ip...>
> Cc: IPCop devel <ipc...@li...>
> Message-ID:
> 	<CAP...@ma...>
> Content-Type: text/plain; charset="iso-8859-1"
>
>   Do the <transparent> and <webproxy> ports have to be different?
> Is the order in squid.conf significant?
>
>
> On 16 February 2014 20:41, Olaf Westrik <wei...@ip...> wrote:
>
>> On 2014-02-16 18:10, Eric Oberlander wrote:
>>> It may be part of the problem, but it's not the full story. After I
>>> changed 'transparent' to 'intercept' I still get errors in the
>>> sytem>proxy logs, and this warning when I run squid -k parse
>>> WARNING: HTTP requires the use of Via
>>> and still no actual hits on the cache...
>> that's only a warning.
>>
>> For the errors I may have found a solution. Looks like we need 2
>> entries, one for transparent and one for 'normal' proxying.
>>
>> http_port 192.168.1.1:<transparent> intercept
>> http_port 192.168.1.1:<webproxy>
>>
>> This also seems to solve a problem when you have mixed clients (with /
>> without proxy config). In my case squid went up to 100% CPU when a
>> browser with proxy config tried to access the internet.
>>
>>
>> Will need to think about that, takes some modifications in firewalling too.
>>
>>
>> Olaf
>>
>>
>> ------------------------------------------------------------------------------
>> Android apps run on BlackBerry 10
>> Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
>> Now with support for Jelly Bean, Bluetooth, Mapview and more.
>> Get your Android app in front of a whole new audience.  Start now.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk
>> _______________________________________________
>> IPCop-devel mailing list
>> IPC...@li...
>> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
> Message: 4
> Date: Sun, 16 Feb 2014 22:50:11 +0100
> From: Michael Rasmussen <mi...@mi...>
> Subject: Re: [IPCop-devel] [IPCop-user] bug in relase 2.1.0 or 2.1.1:
> 	causes squid high cpu usage
> To: Eric Oberlander <eri...@gm...>
> Cc: Olaf Westrik <wei...@ip...>,	list
> 	<ipc...@li...>
> Message-ID:
> 	<mai...@li...>
> Content-Type: text/plain; charset=utf-8
>
> The ordet is not important but the ports must be differant since intercept applies security constrains if I have understand it correct.
>
> On Feb 16, 2014 10:38 PM, Eric Oberlander <eri...@gm...> wrote:
>> Do the <transparent> and <webproxy> ports have to be different??
>> Is the order in squid.conf significant?
>>
>>
>> On 16 February 2014 20:41, Olaf Westrik <wei...@ip...> wrote:
>>> On 2014-02-16 18:10, Eric Oberlander wrote:
>>>> It may be part of the problem, but it's not the full story. After I
>>>> changed 'transparent' to 'intercept' I still get errors in the
>>>> sytem>proxy logs, and this warning when I run squid -k parse
>>>> WARNING: HTTP requires the use of Via
>>>> and still no actual hits on the cache...
>>> that's only a warning.
>>>
>>> For the errors I may have found a solution. Looks like we need 2
>>> entries, one for transparent and one for 'normal' proxying.
>>>
>>> http_port 192.168.1.1:<transparent> intercept
>>> http_port 192.168.1.1:<webproxy>
>>>
>>> This also seems to solve a problem when you have mixed clients (with /
>>> without proxy config). In my case squid went up to 100% CPU when a
>>> browser with proxy config tried to access the internet.
>>>
>>>
>>> Will need to think about that, takes some modifications in firewalling too.
>>>
>>>
>>> Olaf
>>>
>>> ------------------------------------------------------------------------------
>>> Android apps run on BlackBerry 10
>>> Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
>>> Now with support for Jelly Bean, Bluetooth, Mapview and more.
>>> Get your Android app in front of a whole new audience. ?Start now.
>>> http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> IPCop-devel mailing list
>>> IPC...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>>
>> !DSPAM:5301302e298149224913990!
> ------------------------------
>
> Message: 5
> Date: Sun, 16 Feb 2014 23:51:06 +0100
> From: Michael Rasmussen <mi...@mi...>
> Subject: Re: [IPCop-devel] [IPCop-user] bug in relase 2.1.0 or 2.1.1:
> 	causes squid high cpu usage
> To: ipc...@li...
> Message-ID: <201...@sl...>
> Content-Type: text/plain; charset="us-ascii"
>
> Hi Olaf,
>
> On Sun, 16 Feb 2014 21:41:57 +0100
> Olaf Westrik <wei...@ip...> wrote:
>
>> For the errors I may have found a solution. Looks like we need 2
>> entries, one for transparent and one for 'normal' proxying.
>>
>> http_port 192.168.1.1:<transparent> intercept
>> http_port 192.168.1.1:<webproxy>
>>
>> This also seems to solve a problem when you have mixed clients (with /
>> without proxy config). In my case squid went up to 100% CPU when a
>> browser with proxy config tried to access the internet.
>>
>>
>> Will need to think about that, takes some modifications in firewalling too.
>>
> It seems no matter what I do the cache is never populated with any
> objects what so ever. Hitting reload on a page containing only static
> objects nothing is stored in the cache since every new reload on logs
> TCP_MISS/200 in the access.log file.
>
> Why is this?
>

-- 
Josh Nijenhuis

On Sun, 16 Feb 2014 23:51:06 +0100
Michael Rasmussen <mi...@mi...> wrote:

> It seems no matter what I do the cache is never populated with any
> objects what so ever. Hitting reload on a page containing only static
> objects nothing is stored in the cache since every new reload on logs
> TCP_MISS/200 in the access.log file.
> 
> Why is this?
> 
To answer myself. The squid-graph script needs upgrading to since squid
3.x has introduced new status codes. One of these status codes is
TCP_REFRESH_UNMODIFIED/304 which is to be counted as a hit but since
squid-graph only considers status codes containing HIT as a hit these
other hits will be counted as MISS.

Another thing. To be able to see any hits at all from squid I had to
add the following to squid.conf: cache allow all 

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Love -- the last of the serious diseases of childhood.

Michael Rasmussen wrote:


> It seems no matter what I do the cache is never populated with any
> objects what so ever. Hitting reload on a page containing only static
> objects nothing is stored in the cache since every new reload on logs
> TCP_MISS/200 in the access.log file.
> 
> Why is this?

Because proxy caching is useless in today's internet and has been for at 
least a decade. Many of us quit bothering with it years ago when we saw that 
we had only a few percent of actual hits per hour. The other problem is 
cache corruption for the few things that do get cached. This made more sense 
when almost nobody had broadband and websites were rather static with 
limited content.

The proxy is best used for other uses and many who use redirectors set the 
cache at 0. I only use it for urlfilter. 

If you stream internet music you will not want it going through Squid at 
all. You'll get your tags mutilated and audio anomalies such as chirps, 
spits, and thunks.  
-- 
Dave Studeman
http://www.raqcop.com 

Hi Olaf,

On Sun, 16 Feb 2014 21:41:57 +0100
Olaf Westrik <wei...@ip...> wrote:

> 
> For the errors I may have found a solution. Looks like we need 2 
> entries, one for transparent and one for 'normal' proxying.
> 
> http_port 192.168.1.1:<transparent> intercept
> http_port 192.168.1.1:<webproxy>
> 
> This also seems to solve a problem when you have mixed clients (with / 
> without proxy config). In my case squid went up to 100% CPU when a 
> browser with proxy config tried to access the internet.
> 
> 
> Will need to think about that, takes some modifications in firewalling too.
> 
It seems no matter what I do the cache is never populated with any
objects what so ever. Hitting reload on a page containing only static
objects nothing is stored in the cache since every new reload on logs
TCP_MISS/200 in the access.log file.

Why is this?

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Q:	How many IBM CPU's does it take to do a logical right shift?
A:	33.  1 to hold the bits and 32 to push the register.

The ordet is not important but the ports must be differant since intercept applies security constrains if I have understand it correct.

On Feb 16, 2014 10:38 PM, Eric Oberlander <eri...@gm...> wrote:
>
> Do the <transparent> and <webproxy> ports have to be different? 
> Is the order in squid.conf significant?
>
>
> On 16 February 2014 20:41, Olaf Westrik <wei...@ip...> wrote:
>>
>> On 2014-02-16 18:10, Eric Oberlander wrote:
>> > It may be part of the problem, but it's not the full story. After I
>> > changed 'transparent' to 'intercept' I still get errors in the
>> > sytem>proxy logs, and this warning when I run squid -k parse
>> > WARNING: HTTP requires the use of Via
>> > and still no actual hits on the cache...
>>
>> that's only a warning.
>>
>> For the errors I may have found a solution. Looks like we need 2
>> entries, one for transparent and one for 'normal' proxying.
>>
>> http_port 192.168.1.1:<transparent> intercept
>> http_port 192.168.1.1:<webproxy>
>>
>> This also seems to solve a problem when you have mixed clients (with /
>> without proxy config). In my case squid went up to 100% CPU when a
>> browser with proxy config tried to access the internet.
>>
>>
>> Will need to think about that, takes some modifications in firewalling too.
>>
>>
>> Olaf
>>
>> ------------------------------------------------------------------------------
>> Android apps run on BlackBerry 10
>> Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
>> Now with support for Jelly Bean, Bluetooth, Mapview and more.
>> Get your Android app in front of a whole new audience.  Start now.
>> http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk
>> _______________________________________________
>> IPCop-devel mailing list
>> IPC...@li...
>> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>
>
> !DSPAM:5301302e298149224913990!

 Do the <transparent> and <webproxy> ports have to be different?
Is the order in squid.conf significant?


On 16 February 2014 20:41, Olaf Westrik <wei...@ip...> wrote:

> On 2014-02-16 18:10, Eric Oberlander wrote:
> > It may be part of the problem, but it's not the full story. After I
> > changed 'transparent' to 'intercept' I still get errors in the
> > sytem>proxy logs, and this warning when I run squid -k parse
> > WARNING: HTTP requires the use of Via
> > and still no actual hits on the cache...
>
> that's only a warning.
>
> For the errors I may have found a solution. Looks like we need 2
> entries, one for transparent and one for 'normal' proxying.
>
> http_port 192.168.1.1:<transparent> intercept
> http_port 192.168.1.1:<webproxy>
>
> This also seems to solve a problem when you have mixed clients (with /
> without proxy config). In my case squid went up to 100% CPU when a
> browser with proxy config tried to access the internet.
>
>
> Will need to think about that, takes some modifications in firewalling too.
>
>
> Olaf
>
>
> ------------------------------------------------------------------------------
> Android apps run on BlackBerry 10
> Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
> Now with support for Jelly Bean, Bluetooth, Mapview and more.
> Get your Android app in front of a whole new audience.  Start now.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>

On 2014-02-16 18:10, Eric Oberlander wrote:
> It may be part of the problem, but it's not the full story. After I
> changed 'transparent' to 'intercept' I still get errors in the
> sytem>proxy logs, and this warning when I run squid -k parse
> WARNING: HTTP requires the use of Via
> and still no actual hits on the cache...

that's only a warning.

For the errors I may have found a solution. Looks like we need 2 
entries, one for transparent and one for 'normal' proxying.

http_port 192.168.1.1:<transparent> intercept
http_port 192.168.1.1:<webproxy>

This also seems to solve a problem when you have mixed clients (with / 
without proxy config). In my case squid went up to 100% CPU when a 
browser with proxy config tried to access the internet.


Will need to think about that, takes some modifications in firewalling too.


Olaf

On 2014-02-16 16:07, Olaf Westrik wrote:

> Probably because the syntax of squid.conf was changed and we did not
> rewrite it after the upgrade.

This is incorrect, the 2.1.1 upgrade did modify squid.conf.

We'll need to repeat calling makesquidconf.pl via upgrade.sh in 2.1.2/setup
After fixing makesquidconf.pl of course.


Olaf

On Sun, 16 Feb 2014 17:10:34 +0000
Eric Oberlander <eri...@gm...> wrote:

> It may be part of the problem, but it's not the full story. After I changed
> 'transparent' to 'intercept' I still get errors in the sytem>proxy logs,
> and this warning when I run squid -k parse
> WARNING: HTTP requires the use of Via
> and still no actual hits on the cache...
> 
> Sorry, I'm out of my depth here.
> 
Following Amos' suggestion from here:
http://squid-web-proxy-cache.1019090.n4.nabble.com/ERROR-No-forward-proxy-ports-configured-td4099088.html

by added 'http_port 3128' to squid.conf solves the 'No forward-proxy
ports configured.'. What influence this has to IPCop I do not know.

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
"Your stupidity, Allen, is simply not up to par."
-- Dave Mack (ma...@in...)

"Yours is."
		-- Allen Gwinn (al...@su...), in alt.flame

On Sun, 16 Feb 2014 17:10:34 +0000
Eric Oberlander <eri...@gm...> wrote:

> It may be part of the problem, but it's not the full story. After I changed
> 'transparent' to 'intercept' I still get errors in the sytem>proxy logs,
> and this warning when I run squid -k parse
> WARNING: HTTP requires the use of Via
> and still no actual hits on the cache...
> 
Running: squid -k parse
2014/02/16 18:25:52| Startup: Initializing Authentication Schemes ...
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme 'basic'
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme 'digest'
2014/02/16 18:25:52| Startup: Initialized Authentication Scheme
'negotiate' 2014/02/16 18:25:52| Startup: Initialized Authentication
Scheme 'ntlm' 2014/02/16 18:25:52| Startup: Initialized Authentication.
2014/02/16 18:25:52| Processing Configuration
File: /etc/squid/squid.conf (depth 0) 2014/02/16 18:25:52| Processing:
shutdown_lifetime 5 seconds 2014/02/16 18:25:52| Processing: icp_port 0
2014/02/16 18:25:52| Processing: http_port 192.168.2.1:8080 intercept
2014/02/16 18:25:52| Starting Authentication on port 192.168.2.1:8080
2014/02/16 18:25:52| Disabling Authentication on port 192.168.2.1:8080
(interception enabled) 2014/02/16 18:25:52| Processing:
cache_effective_user squid 2014/02/16 18:25:52| Processing:
cache_effective_group squid 2014/02/16 18:25:52| Processing: umask 022
2014/02/16 18:25:52| Processing: pid_filename /var/run/squid.pid
2014/02/16 18:25:52| Processing: cache_mem 512 MB
2014/02/16 18:25:52| Processing: cache_dir aufs /var/log/cache 61440 16
256 2014/02/16 18:25:52| Processing:
error_directory /usr/lib/squid/errors/en 2014/02/16 18:25:52|
Processing: memory_replacement_policy heap LFUDA 2014/02/16 18:25:52|
Processing: access_log stdio:/var/log/squid/access.log 2014/02/16
18:25:52| Processing: cache_log /var/log/squid/cache.log 2014/02/16
18:25:52| Processing: cache_store_log none 2014/02/16 18:25:52|
Processing: strip_query_terms off 2014/02/16 18:25:52| Processing:
log_mime_hdrs off 2014/02/16 18:25:52| Processing: logfile_rotate 0
2014/02/16 18:25:52| Processing: forwarded_for off
2014/02/16 18:25:52| Processing: via off
2014/02/16 18:25:52| Processing: acl within_timeframe time MTWHFAS
00:00-24:00 2014/02/16 18:25:52| Processing: acl localhost src
127.0.0.0/32 2014/02/16 18:25:52| Processing: acl SSL_ports port 443 #
https 2014/02/16 18:25:52| Processing: acl SSL_ports port 8443 #
alternative https 2014/02/16 18:25:52| Processing: acl Safe_ports port
80 # http 2014/02/16 18:25:52| Processing: acl Safe_ports port 21 # ftp
2014/02/16 18:25:52| Processing: acl Safe_ports port 443 # https
2014/02/16 18:25:52| Processing: acl Safe_ports port 1025-65535 #
unprivileged ports 2014/02/16 18:25:52| Processing: acl Safe_ports port
8080 # Squids port (for icons) 2014/02/16 18:25:52| Processing: acl
IPCop_http  port 81 2014/02/16 18:25:52| Processing: acl IPCop_https
port 8445 2014/02/16 18:25:52| Processing: acl IPCop_ips
dst 192.168.2.1 2014/02/16 18:25:52| Processing: acl
IPCop_networks         src "/var/ipcop/proxy/acls/src_networks.acl"
2014/02/16 18:25:52| Processing: acl IPCop_servers          dst
"/var/ipcop/proxy/acls/src_subnets.acl" 2014/02/16 18:25:52|
Processing: acl IPCop_green_network    src 192.168.2.0/24 2014/02/16
18:25:52| Processing: acl IPCop_green_servers    dst 192.168.2.0/24
2014/02/16 18:25:52| Processing: acl CONNECT method CONNECT 2014/02/16
18:25:52| Processing: http_access allow         localhost 2014/02/16
18:25:52| Processing: http_access allow         IPCop_ips
IPCop_networks IPCop_http 2014/02/16 18:25:52| Processing: http_access
allow CONNECT IPCop_ips IPCop_networks IPCop_https 2014/02/16 18:25:52|
Processing: http_access deny          !Safe_ports 2014/02/16 18:25:52|
Processing: http_access deny  CONNECT !SSL_ports 2014/02/16 18:25:52|
Processing: http_access allow IPCop_networks within_timeframe
2014/02/16 18:25:52| Processing: http_access deny  all 2014/02/16
18:25:52| Processing: request_header_access X-Forwarded-For deny all
2014/02/16 18:25:52| Processing: request_header_access Via deny all
2014/02/16 18:25:52| Processing: httpd_suppress_version_string on
2014/02/16 18:25:52| Processing: maximum_object_size 1048576 KB
2014/02/16 18:25:52| Processing: minimum_object_size 0 KB 2014/02/16
18:25:52| Processing: request_body_max_size 0 KB 2014/02/16 18:25:52|
Processing: reply_body_max_size none all 2014/02/16 18:25:52|
Processing: visible_hostname cache.datanom.net 2014/02/16 18:25:52|
Processing: cache_mgr mi...@da... 2014/02/16 18:25:52| WARNING:
HTTP requires the use of Via

Intercept seems to be accepted. However, it looks like a parameter is
missing (Via) maybe that is why we see no hit in the cache.

So therefore making these changes at squid works again:
#http_port <green_ip>:8080 transparent
http_port <green_ip>:8080 intercept
#via off
via on

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Read terms and conditions.

On Sun, 16 Feb 2014 17:31:45 +0100
Olaf Westrik <wei...@ip...> wrote:

> On 2014-02-16 16:52, Eric Oberlander wrote:
> > Here's something that may be relevant...
> >
> > ## This makes squid transparent in versions before squid 3.1
> > #http_port 8080 transparent
> > ## For squid 3.1 and later, use this instead
> > http_port 8080 intercept
> > ## Note that you need Squid 3.4 or above to support IPv6 for intercept mode. Requires ip6tables support
> 
> our makesquidconf.pl still writes transparent.
> I'll first recover my build machine after loosing it's PSU and then get 
> to work on that.
> 
I have made the change manual in squid.conf but stil no cache hits?

-- 
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
If you knew what to say next, would you say it?

It may be part of the problem, but it's not the full story. After I changed
'transparent' to 'intercept' I still get errors in the sytem>proxy logs,
and this warning when I run squid -k parse
WARNING: HTTP requires the use of Via
and still no actual hits on the cache...

Sorry, I'm out of my depth here.


On 16 February 2014 16:31, Olaf Westrik <wei...@ip...> wrote:

> On 2014-02-16 16:52, Eric Oberlander wrote:
> > Here's something that may be relevant...
> >
> > ## This makes squid transparent in versions before squid 3.1
> > #http_port 8080 transparent
> > ## For squid 3.1 and later, use this instead
> > http_port 8080 intercept
> > ## Note that you need Squid 3.4 or above to support IPv6 for intercept
> mode. Requires ip6tables support
>
> our makesquidconf.pl still writes transparent.
> I'll first recover my build machine after loosing it's PSU and then get
> to work on that.
>
>
> Olaf
>
>
> ------------------------------------------------------------------------------
> Android apps run on BlackBerry 10
> Introducing the new BlackBerry 10.2.1 Runtime for Android apps.
> Now with support for Jelly Bean, Bluetooth, Mapview and more.
> Get your Android app in front of a whole new audience.  Start now.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>

On 2014-02-16 16:52, Eric Oberlander wrote:
> Here's something that may be relevant...
>
> ## This makes squid transparent in versions before squid 3.1
> #http_port 8080 transparent
> ## For squid 3.1 and later, use this instead
> http_port 8080 intercept
> ## Note that you need Squid 3.4 or above to support IPv6 for intercept mode. Requires ip6tables support

our makesquidconf.pl still writes transparent.
I'll first recover my build machine after loosing it's PSU and then get 
to work on that.


Olaf