# Squid not responding to requests [Solved ... Kinda]

## sirlark

Hi,

I have an ADSL router and a gentoo server with two NICs, one on an internal subnet, the other on the same subnet as the ADSL router. The internal LAN consists of  a windows network, with a Server 2003 system as the primary domain controller (which also has two nics and ip addresses on both subnets). The w2k3 box is acting as both an internal DNS server as well as a DHCP server. DHCP scope options are set such that all the windows boxes look to the internal DNS server, which forwards DNS requests that it can't resolve to my ISP's DNS servers. However, nothing like to use squid as the proxy, in fact it seems as if nothing is even checking squid. Here's what happens

I start up IE on one of the windows machines. Any page I try to visit pops up an IE style error message to the effect of "The server could be be found or DNS error"

Funny thing is that firefox complains with a "connection refused" error when trying to connect to the same proxy server from within the internal subnet too.

To forestall any qeustions here are some things I think you hsould know.

1. I can access the internet perfectly on the gentoo box, /etc/resolv.conf is fine, and using links I can surf the web fine. Emerges etcc work, i.e. DNS lookups on the gentoo box are working fine.

2. The w2k3 server can surf fine too, cause it has an real/external ip address, and this to me implies DNS is working fine there too

3. Using nslookup on one of the windows machines works fine, and pinging google/altavista etc, returns an IP address, but then says "destination host is unreachable", which I expect, because ICMP isn't being proxied... from this I infer that DNS queries from clients behind the proxy are in fact working.

So it seems to me that squid (which is running) just isn't responding to requests. squid.conf is set up to listen on only an internal subnet address (10.0.2.4:3128). I've had squid working in a similar setup before, and I'm at my wits end in trying to get the windows machines to use squid as their proxy...

Cheers

James

----------

## deboeck

Have you looked at the Access Control Lists in squid.conf ? It's possible that your internal subnet is not allowed to use the proxy. You'll need some lines like:

```
acl our_networks src 10.0.2.0/24

http_access allow our_networks
```

----------

## magic919

Can you point a browser on the Gentoo box to Squid on itself.  Does it work?

----------

## sirlark

Well, it finally turned out that crap loads of stuff was broken. libcomm.so was missing, and that broke almost everything that uses the tcp/iip stack. I couldn't even ssh into the gentoo box. Either way I tried the follwowing

emerge -u --newuse --deep world && revdep-rebuild && pelink -a

And ssh started working again, and my boot sequence didn't complain about broken libraries anymore. It is notwrthy to mention however that squid still had the same problems... it showed up in a 'ps ax' listing, it seemd to be running, but still wouldn't accept connections. There is no firewall on this box either, so no, that wasn't it. Squid didn't show up as broken according to revdep-rebuild, and prelink didn't complain about it either. Anyway, I eventually tried reemerging squid, and viola. Everything worked again.

No idea why, but since this server is pretty important I ain't messin with it anymore...

This whole problem has however prompted me to ask a few questions about how proxy queries work...

I have always assumed that when my proxy enabled firefox/IE/netscape/whatever client makes a request, that entire request is sent to the proxy server which performs the DNS lookups and eveything else required gets the data, and sends it back as a reply... However, I.E. threw up DNS errors when it couldn't connect to the proxy (understandable, since the XP machine didn't have direct access to the internet, and thus also no access to any DNS servers that could resolve anything outside of out internal netwrok)... but my question is, why the hell was I.E. even trying DNS lookups? Shouldn't it have just bombed when it couldn't connect to the proxy, or at least thrown an error about the proxy refusing connection?

Is the normal process of a proxy request to do a DNS lookup locally, then request via ip??? surely not, cause that would mean haviong to have either a local DNS server running, or a direct connection to the net anyway, defaeting half the purpose of a proxy!

Cheers

James

----------

## sirlark

Just in case anyone want's to track down what the hell happened and why, let me at least answer everyone's questions

1. Connecting to the proxy from the gentoo box using links popped up a 'connection refused' error, but I know that squid was configured not to accept connections locally via acl. Turning this off had no effect, but I think that squid hould have at least accepted a connection, then thrown up an access denied page instead of dropping the connection entirely, as with other acl based denials

2. The internal subnet was explicitely allowed in the acl lists... after the deny localhost

----------

## magic919

Well IE sucks when it comes to error messages.  It will throw up the DNS error when there is no such thing going on.

Squid certainly handles DNS, as you'd expect.

----------

