[squid-users] Weirdness with cisco l2tp tunnel, transparent proxy, Centos 4.2 squid server

This is a strange one.
We are terminating an L2TP tunnel on our Cisco 7200 running ios
c7200-js-mz.123-13.bin.
The tunnel is using a virtual template which has the proxy route map enabled
on it.

The relevant Cisco config:

access-list 110 deny�� tcp host 10.0.0.2 any� # squid server eth0:1
access-list 110 permit tcp any any eq www
access-list 110 deny�� ip any any

route-map proxy-redirect permit 10
�match ip address 110
�set ip next-hop 10.0.0.2� # squid server eth0:1

interface Virtual-Template1
�description Tunnel Virtual Template
�ip unnumbered FastEthernet3/0
�ip mroute-cache
�ip policy route-map proxy-redirect
�no logging event link-status
�timeout absolute 4320 0
�peer default ip address pool IP-POOL
�no keepalive
�ppp authentication chap pap callin
�ppp multilink

The Centos box is running IPTables with the following rules for squid:

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128

And it’s a standard squid config.

Some users are able to browse web sites fine.
However a handful of users can’t they get “Web site found” in the IE status
bar and blue progress lines but the site fails.
I can see the request for the site hit the squid access log.

Has anyone got a setup like this and if so am I doing it correctly?

Thanks
Tony
Received on Sun Mar 05 2006 - 09:54:33 MST