Re: [squid-users] FW: WCCP and Fedora 3 not working

Hi,

Squid works with wccp ( V1) as given by Reuben Farrelly
<reuben-squid-users@reub.net>

What i've followed is as below.

1. Created lo 0 with sec ip addr in cisco

interface Loopback0
 ip address 172.16.1.5 255.255.255.252 secondary

Wccp config as normal.
( ip wccp web redirect 123 group-list ourproxy)
( int f3/1
ip wccp web redirect in )

And in linux .
#uname -a
Linux linux12 2.6.11.4-20a-bigsmp #1 SMP Wed Mar 23 21:52:37 UTC 2005 i686
i686 i386 GNU/Linux
# cat /etc/sysconfig/network/ifcfg-gre0
DEVICE=gre0
BOOTPROTO='static'
IPADDR='172.16.1.6'
NETMASK='255.255.255.252'
STARTMODE='onboot'
IPV6INIT='no'
USERCONTROL='no'

In squid rc script

# cat /etc/init.d/squid
.......
/usr/sbin/iptables -t nat -F PREROUTING
        /usr/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j
RED
IRECT --to-port 3128
 /usr/sbin/iptables -t nat -A PREROUTING -i gre0 -p tcp -m tcp --dport
0 -j DNAT --to 192.168.1.25:3128 <- (ip addr/port on which squid listens)

        startproc -l /var/log/squid/rcsquid.log $SQUID_BIN -sYD
        rc_status $RC_OPTIONS
        ;;
.........

# lsmod | grep ip_gre
ip_gre 29856 0

# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 107 packets, 14861 bytes)
 pkts bytes target prot opt in out source
destination
    0 0 REDIRECT tcp -- eth0 any anywhere anywhere
tcp dpt:http redir ports 3128
  547 26208 DNAT tcp -- gre0 any anywhere anywhere
tcp dpt:http to:192.168.1.25:3128

Chain POSTROUTING (policy ACCEPT 549 packets, 32584 bytes)
 pkts bytes target prot opt in out source
destination

Chain OUTPUT (policy ACCEPT 505 packets, 30472 bytes)
 pkts bytes target prot opt in out source
destination

# ifconfig gre0
gre0 Link encap:UNSPEC HWaddr
00-00-00-00-FF-BF-0A-00-00-00-00-00-00-00-00-00
          inet addr:172.16.1.6 Mask:255.255.255.252
          UP RUNNING NOARP MTU:1476 Metric:1
          RX packets:11818 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:11 dropped:0 overruns:0 carrier:0
          collisions:11 txqueuelen:0
          RX bytes:763933 (746.0 Kb) TX bytes:0 (0.0 b)

Working fine, didn;t observe any problems with wccp since last 3 hours.

Thanks Reuben and Henrick!

RGDS
Sk

----- Original Message -----
From: "Omnia Ibrahem" <omnia@egyptnetwork.com>
To: "Damian-Grint Philip" <pdamian-grint@collierscre.co.uk>
Cc: <squid-users@squid-cache.org>
Sent: Tuesday, May 24, 2005 9:07 PM
Subject: Re: [squid-users] FW: WCCP and Fedora 3 not working

> Hi Philip,
> Plz can u send me the steps of how to downgrade kernel from
> 2.6.9 to 2.6.8 cause im new dealing with kernel.
>
> Thanx alot
>
>
>
>
> ----- Original Message -----
> From: "Damian-Grint Philip" <pdamian-grint@collierscre.co.uk>
> To: "Omnia Ibrahem" <omnia@egyptnetwork.com>
> Cc: <squid-users@squid-cache.org>
> Sent: Monday, May 23, 2005 8:10 PM
> Subject: RE: [squid-users] FW: WCCP and Fedora 3 not working
>
>
> Hi Omnia,
>
> I backed down to 2.6.8 only because the ip_wccp.c module in the squid
> faq was last modified to work with 2.6.8 and I was just being cautious -
> it may well work with later versions but I didn't have time to build,
> find problems and rebuild.
>
> Regards
>
> Philip DG
>
> > -----Original Message-----
> > From: Omnia Ibrahem [mailto:omnia@egyptnetwork.com]
> > Sent: 22 May 2005 10:40
> > To: Damian-Grint Philip; Nigel Oakley; squid-users@squid-cache.org
> > Subject: Re: [squid-users] FW: WCCP and Fedora 3 not working
> >
> >
> > Hii there,
> > u mean that i cant make wccp work with kernel
> > 2.6.9 , as u
> > backed down to 2.6.8 to make it work.
> >
> >
> >
> >
> > ----- Original Message -----
> > From: "Damian-Grint Philip" <pdamian-grint@collierscre.co.uk>
> > To: "Nigel Oakley" <nigel@oakley.vnworks.net>;
> > <squid-users@squid-cache.org>
> > Sent: Friday, May 20, 2005 7:15 PM
> > Subject: RE: [squid-users] FW: WCCP and Fedora 3 not working
> >
> >
> > Hi Nigel,
> >
> > I have just upgraded all my Redhat 7.2 Squid servers to
> > Fedora FC3, and
> > I have WCCP working fine.
> >
> > It sounds like you have the squid wccp bit done ok - that's what does
> > the hello stuff. - check your output from debug ip icmp on
> > your router -
> > if you're getting protocol unreachable, the problem is your wccp
> > interception at the kernel on your squid box.
> >
> > I backed the kernel down to 2.6.8, only because that is what the wccp
> > module had been supposedly written for. You shouldn't need to play
> > around with sysctl settings, although you might need to switch off ECN
> > if on and your testing indicates a need.
> >
> > I've never used ip_gre, only the ip_wccp module:
> >
> > Download the ip_wccp.c module from the Squid FAQ into /var/tmp
> >
> > echo 'obj-m := ip_wccp.o' > Makefile
> > make -C /usr/src/linux M=$PWD V=1 modules
> > cp ip_wccp.ko /lib/modules/2.6.8/kernel/net/ipv4
> > edit modules dep file (vi /lib/modules/2.6.8/modules.dep) and add the
> > following line:
> > /lib/modules/2.6.8/kernel/net/ipv4/ip_wccp.ko:
> >
> > modprobe ip_wccp
> >
> > Squid config fragment:
> >
> > wccp_version 4
> > wccp_router 10.129.110.251
> > snmp_port 3401
> > httpd_accel_host virtual
> > httpd_accel_with_proxy on
> > httpd_accel_uses_host_header on
> >
> > Cisco config:
> >
> > ip wccp web-cache redirect-list 100
> > ip wccp version 1
> > ip cef
> >
> > interface fa0/0
> > ! facing the firewall
> > ip wccp web-cache redirect out
> > no ip redirects
> > ip route-cache same-interface
> >
> > interface fa0/1
> > ! facing the internal network
> >
> > ! don't classify internal traffic
> > access-list 100 deny ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
> > ! classify internet bound traffic
> > access-list 100 permit 10.0.0.0 0.255.255.255 any
> > access-list 100 deny ip any
> >
> > IPtables config:
> >
> > iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT \
> > --to-port 3128
> > iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT \
> > --to 127.0.0.1:3128
> >
> > Hope that something in the above sorts your problem, otherwise let me
> > know and I will send you my (tediously long) build log which
> > I wrote for
> > the non-linux guys here.
> >
> > Regards
> >
> > Philip Damian-Grint
> > CCNP
> > Infrastructure Team
> > Business Systems & IT
> > Colliers CRE
> > Tel. +44(0)20 7487 1928
> > Fax. +44(0)20 7487 1671
> >
> >
> > Confidentiality Notice
> > This communication and the information it contains:
> > (a) is intended for the person(s) or Organisation(s) named
> > above and for no
> > other persons or organisations and,
> > (b) may be confidential, legally privileged and protected by law.
> > Unauthorised use, copying or disclosure of any of it may be unlawful.
> > When addressed to our clients any opinions or advice
> > contained in this
> > e-mail are subject to CCRE's terms and conditions of business
> > notified to
> > the client or expressed in the governing client engagement letter.
> > If you receive this communication in error, please notify us
> > immediately,
> > destroy any copies and delete it from your computer system.
> >
> >
> > ______________________________________________________________________
> > This email has been scanned by the MessageLabs Email Security System.
> > For more information please visit http://www.messagelabs.com/email
> > ______________________________________________________________________
> >
>
> Confidentiality Notice
> This communication and the information it contains:
> (a) is intended for the person(s) or Organisation(s) named above and for
no
> other persons or organisations and,
> (b) may be confidential, legally privileged and protected by law.
> Unauthorised use, copying or disclosure of any of it may be unlawful.
> When addressed to our clients any opinions or advice contained in this
> e-mail are subject to CCRE's terms and conditions of business notified to
> the client or expressed in the governing client engagement letter.
> If you receive this communication in error, please notify us immediately,
> destroy any copies and delete it from your computer system.
>
>
Received on Thu May 26 2005 - 04:57:30 MDT