172.16.0.0/12 网络中的客户端无法使用 SQUID 代理。知道是什么原因造成的吗？
$ curl --proxy 172.20.0.20:3128 www.google.com -I
curl: (56) Recv failure: Connection reset by peer
来自 squid 服务器的相同命令运行良好。
root@SQUID-SRV01:# curl --proxy 172.20.0.20:3128 www.google.com -I
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
配置：
acl localhost src 127.0.0.1/32 ::1
acl localnet src 172.16.0.0/12
acl Safe_ports port 80
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access allow localhost
http_access allow localnet
http_access deny all
http_port 172.20.0.20:3128
access_log daemon:/var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
TCP 转储和 Netstat：
root@SQUID-SRV01:# netstat -naop | grep :3128
tcp 0 0 172.20.0.20:3128 0.0.0.0:* LISTEN 17454/(squid-1) off (0.00/0/0)
root@SQUID-SRV01:# tcpdump port 3128
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes
14:30:53.463935 IP 172.26.0.11.58301 > SQUID-SRV01.3128: Flags [S], seq 2612553964, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:30:53.464031 IP SQUID-SRV01.3128 > 172.26.0.11.58301: Flags [S.], seq 4099169320, ack 2612553965, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
14:30:53.464453 IP 172.26.0.11.58301 > SQUID-SRV01.3128: Flags [.], ack 1, win 256, length 0
14:30:53.465041 IP 172.26.0.11.58301 > SQUID-SRV01.3128: Flags [R.], seq 1, ack 1, win 256, length 0
缓存日志：
2016/08/15 14:23:56 kid1| Starting Squid Cache version 3.5.12 for x86_64-pc-linux-gnu...
2016/08/15 14:23:56 kid1| Service Name: squid
2016/08/15 14:23:56 kid1| Process ID 17454
2016/08/15 14:23:56 kid1| Process Roles: worker
2016/08/15 14:23:56 kid1| With 65535 file descriptors available
2016/08/15 14:23:56 kid1| Initializing IP Cache...
2016/08/15 14:23:56 kid1| DNS Socket created at [::], FD 6
2016/08/15 14:23:56 kid1| DNS Socket created at 0.0.0.0, FD 8
2016/08/15 14:23:56 kid1| Adding nameserver 127.0.0.1 from /etc/resolv.conf
2016/08/15 14:23:56 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2016/08/15 14:23:56 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2016/08/15 14:23:56 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2016/08/15 14:23:56 kid1| Store logging disabled
2016/08/15 14:23:56 kid1| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2016/08/15 14:23:56 kid1| Target number of buckets: 1008
2016/08/15 14:23:56 kid1| Using 8192 Store buckets
2016/08/15 14:23:56 kid1| Max Mem size: 262144 KB
2016/08/15 14:23:56 kid1| Max Swap size: 0 KB
2016/08/15 14:23:56 kid1| Using Least Load store dir selection
2016/08/15 14:23:56 kid1| Current Directory is /
2016/08/15 14:23:56 kid1| Finished loading MIME types and icons.
2016/08/15 14:23:56 kid1| HTCP Disabled.
2016/08/15 14:23:56 kid1| Pinger socket opened on FD 13
2016/08/15 14:23:56 kid1| Squid plugin modules loaded: 0
2016/08/15 14:23:56 kid1| Adaptation support is off.
2016/08/15 14:23:56 kid1| Accepting HTTP Socket connections at local=172.20.0.20:3128 remote=[::] FD 11 flags=9
2016/08/15 14:23:56| pinger: Initialising ICMP pinger ...
2016/08/15 14:23:56| pinger: ICMP socket opened.
2016/08/15 14:23:56| pinger: ICMPv6 socket opened
2016/08/15 14:23:57 kid1| storeLateRelease: released 0 objects
access.log 没有有关客户端的信息。
答案1
答案：客户端和 SQUID 服务器之间的第 7 层 IPS 防火墙正在重置连接，因为默认情况下 Web 浏览与 TCP 端口 3128 无关。通过更改应用程序过滤器解决了该问题。