Squid proxy - how to enable tcp connect - receive TCP_DENIAL / 400 with ERR_INVALID_DOMAIN

Question

I have a device that needs to connect to the tcp: 80 internet service, but there is no direct internet access on the network. Therefore, I use squid proxy to solve this problem.

The device allows me to enter a proxy server, port, username and password.

I found out that the device uses http CONNECT instead of http GET (which works fine with my browser).

When the device tries to connect, it receives an http 400 error. Squid access.log gives me only this:

  1338885433.033 0 172.22.140.129 TCP_DENIED / 400 1728 CONNECT: 0 - NONE / - text / html

So, I grabbed the packages to really see what happens:

Request from device:

  CONNECT mydomain.com index HTTP / 1.0
 User-agent: Sequencer / 5.5.0.5539

Answer from the squid:

  HTTP / 1.0 400 Bad Request
 squid / 2.7.STABLE9
 X-Squid-Error: ERR_INVALID_URL 0
 close

My squid.conf:

  auth_param basic program / usr / lib / squid / pam_auth
 auth_param basic children 5
 auth_param basic realm Squid proxy-caching web server
 auth_param basic credentialsttl 2 hours
 auth_param basic casesensitive off

 acl all src all
 acl manager proto cache_object
 acl localhost src 127.0.0.1/32
 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
 acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
 acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

 acl SSL_ports port 443 # https
 acl SSL_ports port 563 # snews
 acl SSL_ports port 873 # rsync

 acl Safe_ports port 80 # http
 acl Safe_ports port 21 # ftp
 acl Safe_ports port 443 # https
 acl Safe_ports port 70 # gopher
 acl Safe_ports port 210 # wais
 acl Safe_ports port 1025-65535 # unregistered ports
 acl Safe_ports port 280 # http-mgmt
 acl Safe_ports port 488 # gss-http
 acl Safe_ports port 591 # filemaker
 acl Safe_ports port 777 # multiling http
 acl Safe_ports port 631 # cups
 acl Safe_ports port 873 # rsync
 acl Safe_ports port 901 # SWAT

 acl purge method PURGE
 acl CONNECT method CONNECT
 acl checkpw proxy_auth REQUIRED

 http_access allow manager localhost
 http_access deny manager
 http_access allow purge localhost
 http_access deny purge
 http_access deny! Safe_ports
 http_access allow CONNECT
 http_access allow localnet
 http_access allow localhost
 http_access allow checkpw all
 http_access deny all

 icp_access allow localnet
 icp_access deny all

 http_port 3128

 hierarchy_stoplist cgi-bin?

 access_log /var/log/squid/access.log squid

 debug_options ALL, 1 33.2 28.9

 refresh_pattern ^ ftp: 1440 20% 10080
 refresh_pattern ^ gopher: 1440 0% 1440
 refresh_pattern -i (/ cgi-bin / | \?) 0 0% 0
 refresh_pattern (Release | Packages (.gz) *) $ 0 20% 2880
 refresh_pattern.  0 20% 4320

 acl shoutcast rep_header X-HTTP09-First-Line ^ ICY. [0-9]

 upgrade_http0.9 deny shoutcast

 acl apache rep_header Server ^ Apache

 broken_vary_encoding allow apache

 extension_methods REPORT MERGE MKACTIVITY CHECKOUT

 hosts_file / etc / hosts

 forwarded_for off

 coredump_dir / var / spool / squid

Is there a solution to get rid of ERR_INVALID_URL? Am I missing an understanding of the concept of a squid proxy or is the request from the device invalid?

Please let me know if any other information is needed.

Thanks in advance, Christian.

Answer 1

I resolved the same error by commenting on the default squid.conf:

# Deny CONNECT to other than secure SSL ports #http_access deny CONNECT !SSL_ports 

By default, Squid is configured to not allow CONNECT for non-SSL ports. If you want to test without SSL, you can disable this by commenting out the line above.

Answer 2

I had a connection to non-SSL ports that was allowed as described above, but forgot to open acl from the network I was trying to access. Discovery that fixed the problem:

 acl localnet src 1.1.0.0/24 # <- My Internal network I am accessing from acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network 

Answer 3

I solved this with device product support.

They showed me a way to enable a more detailed debugging view of the proxy process.

The line "Failed to connect to relay 0.0.0.0" occurred in the log file

So, I checked the dns server settings on the device, there was a typo. Here it is.

Answer 4

For me, this was the opposite of @peaxol : I defined acl, but not http_access allow . I should have added them:

 acl vpn src xx.xx.xx.xx/xx ... http_access allow vpn