James White's questions

I have setup a robocopy script that runs on a daily basis and synchronises data from a specific folder on a Windows Server 2016 storage server to a SMB share on a QNAP NAS. The Windows Server is domain authenticated, while the QNAP uses a standalone user login. In the script this handled by net use so the server maps the QNAP share with the correct credentials rather than trying to assume or run under the scheduled task user.

net use \\QNAP\share /USER:<user> "<password>"

I have confirmed that the server can read/write to the share when mapped like this.

Having running the first sync manually to confirm the script/parameters are good before setting it up to run via task scheduler automatically, the following error was reported on a few directories in the log (various different locations). An example error is below, paths modified.

2018/01/12 06:38:16 ERROR 50 (0x00000032) Accessing Destination
Directory \\QNAP\share\example folder\something The request is not supported.

This is happening on the same folders each time robocopy is run. If I manually copy any of the folders that threw the error 50 to the destination with Windows Explorer, they copy fine, but even after doing so, the error 50 is still logged for the same locations. The error seems to be at the folder level, rather than specific files.

I am using the following robocopy parameters.

robocopy D:\local\folder \\QNAP\share\example folder /e /zb /fft /DCOPY:DA /COPY:DAT /r:0 /w:0 /XJ /XD RECYCLER .TemporaryItems /XF Thumbs.db ~* ._* *.inf .DS_Store /log+:D:\backuplog.txt /NFL /NDL

I'm struggling to find any information about error 50 from a robocopy perspective. It looks like error 50 is SMB related. It seems be related some either the attributes or properties of these specific folders not being able to be written to the QNAP directory. I tried removing the "A" (attributes) from the /COPY switch, but this didn't help.

I recently synchronised an external hard disk which had approx 1.4 TB of data copied over with a GUI sync application on a Windows based file server. Sync direction, left to right.

The problem that occurred was the GUI application that did the sync was limited with the Windows Explorer 255 path size limit. As the data originated from a UNIX system, this prevent some folders/files from being copied, because they exceeded this limit.

I'm now wanting to use robocopy to pick up the remaining directories and files that were missed (because it doesn't have the path limitation), while not copying the whole lot again. Is there a combination of flags that I can use to achieve this?

I have a domain joined Windows Server 2012 R2 box that has the OpenVPN 2.3.13 client software installed on it. When the VPN connection is active the "Ethernet 2" (TAP interface) connection is placed into the Domain Network category alongside the main LAN NIC by NLA. Ideally I want to be able to assign the VPN interface to the Public category. I've tried via PowerShell, but get this error constantly:

Unable to set the NetworkCategory due to one of the following possible reasons: not running PowerShell elevated; the NetworkCategory cannot be changed from 'DomainAuthenticated'; user initiated changes to NetworkCategory are being prevented due to the Group Policy setting 'Network List Manager Policies'. At line:1 char:1 + Set-NetConnectionProfile -InterfaceIndex 15 -NetworkCategory Public + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (MSFT_NetConnect...72AADA665483}"):root/StandardCi...nnectionProfile) [Set-NetConnectionProfile], CimException + FullyQualifiedErrorId : MI RESULT 2,Set-NetConnectionProfile

15 is the interface number of "Ethernet 2"

Its worth noting, I am running this command in an elevated PowerShell session and have I tried all the available GPO policies but the error is constantly thrown. Most information about NLA suggest switching between Private and Public should work, but DomainAuthenicated seems a little bit different.

The registry method doesn't have an actual profile for Ethernet 2, so it can't be changed that way either.

Is there anyway to force the TAP adapter to be Public? The OpenVPN connection itself does not override the default gateway of the main NIC and uses the 10.0.0.0/8 subnet. The fact I use route-nopull and override the routes might be part of the problem with the way NLA detects the networks.

Ethernet adapter Ethernet 2:

Connection-specific DNS Suffix  . :
Link-local IPv6 Address . . . . . : fe80::xxxx:xxxx:xxxx:xxxx%xx
IPv4 Address. . . . . . . . . . . : 10.xx.xx.xx
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :

The main reason for needing to assign the Public profile is for firewall rules, I am having trouble preventing certain applications from only using the VPN interface, being able to write network profile based firewall rules seems to work best in this case, I've tried writing rules based on the local IP address but this didn't work.

I'm currently backing up a server and the data on the shares it hosts to a single 8TB drive (its not the only backup copy). Because of the single drive dependency, running low on capacity and 8TB being the maximum size currently commercially available for the general market as a single drive, I was going to run 4x USB 3 drives to create a pool as a parity storage space and continue backing up data to that, to provide more capacity and a little bit of redundancy.

My question is does the Windows Server 2012 R2 Essentials Server Backup component support this? I've never tried a server backup with anything but a single drive before. Because this is the 2012 R2 Essentials version, server backup is configured via the Dashboard app, so I was wanting to know if it was supported?

Thanks,

After a reboot of a ESXi 6.0 server it will no longer mount several NFS shares being hosted on a Windows Server 2012 R2 box. Previously these shares were working fine, but now any NFS mount is met with the following error:

The NFS server does not support MOUNT version 3 over TCP

This is strange because the NFS server has both version 3 and 4 enabled

Likewise the protocols have both TCP and UDP enabled.

The firewall is also allowing NFS connections. I'm at a bit of a loss as to why the NFS shares have stopped being able to be mounted on ESXi. No major configuration changes have been made as far as I'm aware.

Network Setup

Two physical adapters. One configured for failover, but all traffic under one subnet 192.168.1.0/24 the same as the main LAN. No VLAN's or anything complicated.

Storage Setup

2TB Storage Space Mirror hosted on a Windows Server 2012 R2 server. 3 NFS shares set to read/write for the ESXi host with "All Machines" as read-only.

I've tried restarting the NFS Server service on the Windows Server 2012 R2 box but the problem remains.

Any ideas?

I want to disable shadow copies being created on a specific Windows NFS share folder which is being used by an ESXi 6 server for virtual machine backups (via xsibackup). The reason for wanting to do this is because the VM backups are being handled by xsibackup with full and incremental backups being done daily via xsibackup and xsibackup-rsync. The shadow copies generated for this NFS share are using a lot of space on my disk array and are not really required in this case.

I would like to be able to disable the NFS share from being shadow copied while keeping the main shadow copy process unaffected for the rest of the volume the NFS share is on. I'd also like to be able to delete the shadow copies already created for the NFS share folder to reclaim the disk space.

I'm aware of this KB, but it doesn't appear to be working. I tried creating a new multi string REG_MULTI_SZ in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot called it "ESXi NFS Share" and set the value to E:\NFS FOLDER NAME\*.* /s

https://msdn.microsoft.com/en-us/library/aa819132%28v=vs.85%29.aspx

What is the best approach to provide exclusion rules for shadow copies and delete already created copies if possible?

I'm trying to run ESXi 6 off the Internal USB 2.0 port on a HP Microserver Gen8. No matter what I try it will not make any attempt to boot the internal USB to load the hypervisor.

I installed ESXi 6 with the customised ProLiant HP image (Jan 2016). The steps I took to do this was burn the ISO to a CD and installed it to a 8 GB Transcend while it was plugged into the internal USB slot of the Microserver Gen8. I pulled all SATA drives before installing. The ESXi setup detected the USB drive no problem and installed without an issues. Upon rebooting it doesn't boot from it at all.

I checked my BIOS and all the USB related options appear to be correct:

• USB Enabled - Enabled
• USB Boot Support - Enabled
• Main Boot order - USB DriveKey is set to first priority
• Internal drives boot priority - USB DriveKey first
• USB Enumeration - Enabled

To confirm the USB stick is working I pulled it out of the Microserver Gen8 and booted it on a laptop, which booted no problem.

I had the same problem with another USB drive but thought it might just be bad luck for compatibility, however two USB drives doing the same thing seems a little bit suspect.

What am I missing that's preventing the USB drive from booting on the Microserver Gen8 when using the internal port?

My Windows Server 2012 R2 Essentials server has started throwing the same error each time during daily backups, each backup has this error in the failed items backup log:

Error in backup of E:\System Volume Information\SRM\quota.md during write: Error [0x80070020] The process cannot access the file because it is being used by another process.

E: is a parity Storage Space. Each backup status is now incomplete but otherwise all other data appears to have been backed up. It does mean however that each backup task now runs a full backup on E: rather than incremental because of the "failure" status.

I tried using the Dashboard to exclude this path from backup however I just got a different error related to items under the System Volume Information folder. There seems to be a underlying issue as to why System Volume Information is now causing problems, but I'm not sure what it is. As far as I'm aware I am not using any Quota functionality unless Windows itself is doing something I'm not aware of.

Additionally the core configuration of the server has not changed, so I am slightly confused as to why the backup is now "failing".

I have Storage Space configured with Parity resiliency that has a total of 5 SATA drives. 4 of the drives are near full capacity (90% used).

I am now getting a low capacity warning because this. I have no more SATA ports available for additional drives (and I don't want to use USB 2.0/USB 3.0), so my plan was to replace two of the existing 2 TB drives with 3 TB drives. As well as a capacity increase, the idea is the during the rebuilding/repairing the remaining 2 TB drives will hopefully be "balanced" a bit, so their usage will be below my custom set threshold of 85%.

As I have parity I can survive one disk being pulled out of the space without any data loss, however I want to perform the swap properly, rather than that simulating hard disk failure by simply pull one drive out.

What steps do I need to take to perform this task? I'm aware I'd need to use PowerShell but I'm looking for specific guidance to ensure that the swap is done correctly. I'm thinking I'll also need to do this with one disk at time, otherwise I'll lose the pool.

I'm having trouble getting TPROXY working with Squid and IPv6 on a CentOS 7 server. I was previously using a generic intercept setup with NAT, but it was limited to IPv4 only. I'm now expanding the setup to include IPv6 with TPROXY.

I've been using the official Squid wiki article on the subject to configure everything:

http://wiki.squid-cache.org/Features/Tproxy4

Thus far the TPROXY config appears to be working for IPv4 with no issues. With IPv6 however connections are timing out and not working properly. I'll break down the setup for better understanding.

Note all firewall and routing rules are exactly the same for IPv4, the only difference is inet6 and ip6tables for configuring IPv6 based rules in the examples below.

• OS and Kernel: CentOS 7 (3.10.0-229.14.1.el7.x86_64)
• All packages are up to date according to yum
• Squid Version: 3.3.8 (Also tried 3.5.9)
• Firewall: iptables/ip6tables 1.4.21
• libcap-2.22-8.el7.x86_64

IPv6 connectivity is currently through a 6in4 tunnel via Hurricane Electric, this is configured on the DD-WRT router and then the assigned prefix delegated to clients via radvd. The Squid box has several static IPv6 addresses configured.

The Squid box sits within the main LAN which it is serving. Clients that are having traffic on port 80 intercepted (mainly wireless clients) are being pushed to the Squid box via my DD-WRT router with the following firewall and routing rules, adapted from the Policy Routing wiki article and DD-WRT wiki

• http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute

• http://www.dd-wrt.com/wiki/index.php/Squid_Transparent_Proxy

  ip6tables -t mangle -A PREROUTING -i "$CLIENTIFACE" -s "$PROXY_IPV6" -p tcp --dport 80 -j ACCEPT
  ip6tables -t mangle -A PREROUTING -i "$CLIENTIFACE" -p tcp --dport 80 -j MARK --set-mark $FWMARK
  ip6tables -t mangle -A PREROUTING -m mark --mark $FWMARK -j ACCEPT
  ip6tables -t filter -A FORWARD -i "$CLIENTIFACE" -o "$CLIENTIFACE" -p tcp --dport 80 -j ACCEPT
  
  ip -f inet6 rule add fwmark $FWMARK table 2
  ip -f inet6 route add default via "$PROXY_IPV6" dev "$CLIENTIFACE" table 2
  

This appears to be working OK in terms of passing the traffic to the Squid box. One additional rule I had to add on the DD-WRT router in addition to the above was an exception rule for the configured outgoing IPv4 and IPv6 addresses on the Squid box, otherwise I get a crazy loop issue and traffic gets broken for all clients including the main LAN that uses Squid on 3128.

ip6tables -t mangle -I PREROUTING -p tcp --dport 80 -s "$OUTGOING_PROXY_IPV6" -j ACCEPT

On the Squid box I am then using the following routing rules and the DIVERT chain to handle the traffic accordingly. I needed to add additional rules to prevent any errors with the chain already existing during testing. My firewall is CSF, I have added the following to csfpre.sh

ip -f inet6 route flush table 100
ip -f inet6 rule del fwmark 1 lookup 100

ip -f inet6 rule add fwmark 1 lookup 100
ip -f inet6 route add local default dev eno1 table 100

ip6tables -t mangle -F
ip6tables -t mangle -X
ip6tables -t mangle -N DIVERT

ip6tables -t mangle -A DIVERT -j MARK --set-mark 1
ip6tables -t mangle -A DIVERT -j ACCEPT
ip6tables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
ip6tables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

squid.conf is configured for two ports:

http_proxy 3128
http_proxy 3129 tproxy

In addition I am also using Privoxy and had to add no-tproxy to my cache_peer line, otherwise all traffic was unable to be forwarded for both protocols.

cache_peer localhost parent 8118 7 no-tproxy no-query no-digest

I am not using any tcp_outgoing_address directives because of Privoxy, instead I am controlling the outbound addresses through CentOS and the bind order.

sysctl values:

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.eno1.rp_filter = 0

I am not sure if the rp_filter modifications are needed as the setup works on IPv4 with or without them and produces the same result for IPv6.

SELINUX

SELINUX is enabled on the Squid box, but policies have been configured to allow the TPROXY setup, so its not being blocked (IPv4 working shows this anyway). I have checked with grep squid /var/log/audit/audit.log | audit2allow -a and get <no matches>

#============= squid_t ==============

#!!!! This avc is allowed in the current policy
allow squid_t self:capability net_admin;

#!!!! This avc is allowed in the current policy
allow squid_t self:capability2 block_suspend;

#!!!! This avc is allowed in the current policy
allow squid_t unreserved_port_t:tcp_socket name_connect;

I have also set the following booleans:

setsebool squid_connect_any 1
setsebool squid_use_tproxy 1

Broken IPv6 connectivity

Ultimately, IPv6 connectivity is completely broken for TPROXY clients (LAN clients on port 3128 which use a WPAD/PAC file have fully working IPv6). While it appears the traffic is being routed to the Squid box in some way, no requests over IPv6 via TPROXY are appearing in the access.log. All IPv6 requests both literal IPv6 and DNS, timeout. I can access internal IPv6 clients but again, this traffic isn't logged either.

I did some testing using test-ipv6.com and found that it detected my outgoing Squid IPv6 address but the IPv6 tests either showed as bad/slow or timeout. I temporarily enabled the via header and found the Squid HTTP header was visible, so the traffic is at least getting to the Squid box but not being routed properly once its there.

I've been trying to get this to work for some time and cannot find what the problem is, I've even asked on the Squid mailing list, but have been unable to diagnose the actual issue or solve it. Based on my testing, I'm pretty sure its one of the following areas and the Squid box the problem:

• Routing
• Kernel
• Firewall

Any ideas and additional steps that I can take to get TPROXY and IPv6 working would be greatly appreciated!

Additional information

ip6tables rules:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DIVERT     tcp      ::/0                 ::/0                 socket
TPROXY     tcp      ::/0                 ::/0                 tcp dpt:80 TPROXY redirect :::3129 mark 0x1/0x1

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain DIVERT (1 references)
target     prot opt source               destination
MARK       all      ::/0                 ::/0                 MARK set 0x1
ACCEPT     all      ::/0                 ::/0

IPv6 routing table (prefix obscured)

unreachable ::/96 dev lo  metric 1024  error -101
unreachable ::ffff:0.0.0.0/96 dev lo  metric 1024  error -101
2001:470:xxxx:xxx::5 dev eno1  metric 0
    cache  mtu 1480
2001:470:xxxx:xxx:b451:9577:fb7d:6f2d dev eno1  metric 0
    cache
2001:470:xxxx:xxx::/64 dev eno1  proto kernel  metric 256
unreachable 2002:a00::/24 dev lo  metric 1024  error -101
unreachable 2002:7f00::/24 dev lo  metric 1024  error -101
unreachable 2002:a9fe::/32 dev lo  metric 1024  error -101
unreachable 2002:ac10::/28 dev lo  metric 1024  error -101
unreachable 2002:c0a8::/32 dev lo  metric 1024  error -101
unreachable 2002:e000::/19 dev lo  metric 1024  error -101
unreachable 3ffe:ffff::/32 dev lo  metric 1024  error -101
fe80::/64 dev eno1  proto kernel  metric 256
default via 2001:470:xxxx:xxxx::1 dev eno1  metric 1

I have several IPv6 addresses on a CentOS 7 server and need to make a specific v6 address the default address used in routing. I have been able to do this by modifying the route table.

ip -6 route del default
ip -6 route add default via 2001:470:xxxx:xx::1 src 2001:470:xxxx:xx::6

Problem is each time the network interface is restarted or the server itself is rebooted, the change to the default IPv6 route is lost. How can I make this change persistent so its permanently kept?

I'm trying to establish the cause of a strange issue with mobile device that goes through a Squid 3.3 proxy on CentOS 7 using transparent mode which is not able to access news content within the Bing News app on Windows Phone 8.

When content loads I just get an error with "An error occurred while loading this page" Each time a news story is requested, a GET request similar to the one below is logged from the mobile device:

TCP_MISS/200 414 GET http://en-gb.appex-rf.msn.com/article/v4/EN-GB/news/0/BBm10XM.js? - FIRSTUP_PARENT/::1 text/javascript

I made the same GET request on a client that has the proxy configured via WPAD and it seems the response is slightly different:

TCP_MISS/200 399 GET http://en-gb.appex-rf.msn.com/article/v4/EN-GB/news/0/BBm10XM.js - FIRSTUP_PARENT/::1 application/json

With further details using curl:

* About to connect() to en-gb.appex-rf.msn.com port 80 (#0)
*   Trying 213.104.143.210...
* Connected to en-gb.appex-rf.msn.com (213.104.143.210) port 80 (#0)
> GET /article/v4/EN-GB/news/0/BBm10XM.js HTTP/1.1
> User-Agent: curl/7.29.0
> Host: en-gb.appex-rf.msn.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Last-Modified: Sun, 23 Aug 2015 19:43:49 GMT
< ETag: "7daadd066c8a3c246e24515a03b7eeb5"
< Server: Microsoft-IIS/8.5
< X-Diagnostic-S: AppContentService_IN_21
< X-Diagnostic-DC: eastus
< X-CMS-ACSElapsedTimeInMilliseconds: 4
< AppEx-Activity-Id: 18579b38-f191-4ba8-9af9-9fd97c0d15bb
< X-Trace-Context: {"ActivityId":"18579b38-f191-4ba8-9af9-9fd97c0d15bb"}
< X-AspNet-Version: 4.0.30319
< X-Powered-By: ASP.NET
< Cache-Control: public, max-age=300
< Date: Sun, 23 Aug 2015 20:33:32 GMT
< Content-Length: 7209
< Connection: keep-alive

The Bing News app works when not using the proxy or when using the proxy via configuration or WPAD (i.e. not transparent). Tested on a Windows 8.1 PC.

I'm assuming that because the data type is different this is likely the cause of the issue with the app on Windows Phone 8, but I am unsure as to why Squid is seeing it differently in transparent mode vs WPAD/configured proxy settings.

Are there any specific settings I need to look at in my squid.conf or other methods to resolve this? I would prefer to have this client go through the proxy, but as a short term solution I could write a iptables rule for this client IP to bypass the proxy entirely.

I'm running Squid 3.3 (EPEL) on CentOS 7 and recently I have been getting the following error message in my cache.log

WARNING! Your cache is running out of filedescriptors

I am slightly confused by this because I seem to have ample descriptors available:

squidclient mgr:info | grep 'file descri'
Maximum number of file descriptors:   16384
Available number of file descriptors: 16326
Reserved number of file descriptors:   100

Squid was also compiled with this flag:

--with-filedescriptors=16384

Squid confirms that these are actually available on startup:

2015/08/18 21:11:45 kid1| With 16384 file descriptors available

However this error keeps occurring. Not long after this error is logged the squid process seems to also hit 100% CPU or use nearly all of the system memory up over 90%, causing the internet speed to drop to a crawl or just hang indefinitely. Killing the process and restarting resolves it but eventually it will happen again.

I have a total of 8 GB of memory available, these are the memory/cache related parameters in my squid.conf

cache_dir ufs /var/spool/squid 16000 16 256
cache_mem 1024 MB

I am also using ufdbguard and additional helper plugins for Kerberos and NTLM authentication.

Any advice?

I have a Windows Server 2012 R2 Essentials box which is configured with the basic RRAS VPN functionality, it isn't configured as a router, this functionality is not enabled and my R2 Essentials box doesn't have the DHCP role installed (I have a gateway router to handle DHCP), it is however a DNS server as its configured as an Active Directory server.

I've noticed that when using the VPN through SSTP and other protocols, the IPv6 connectivity is broken. Clients get an IPv6 address as per the assigned prefix, but after the first hop from a tracert, it is unroutable and cannot get to the outside, so my server is not handling the IPv6 traffic properly.

My IPv6 connectivity is provided by Hurricane Electric (tunnel), this is configured at the router level with the /64 provided and dynamically pushed to clients on the LAN via radvd. On the box itself, I have disabled auto-configuration and setup IPv6 manually. IPv6 connectivity of the box itself is working fine.

When configuring IPv6 in RRAS the following are all enabled:

• IPv6 Remote Access Server [checked]
• Enable IPv6 Forwarding [checked]
• Enable Default Route Advertisement [checked]

The IPv6 prefix assigned is the /64 provided by Hurricane Electric, I am unsure if this is correct or not, seems its already configured at router level.

I do have a /48 which is not currently used and may be suitable here.

IPv4 traffic is forwarded no problem and a tracert shows the traffic can pass through, this VPN issues are limited to IPv6.

It doesn't appear to be a firewall issue as I've tested with it disabled.

I can post any route/IP information required to help solve the issue. I would appreciate any pointers/additional help on solving this IPv6 connectivity issue with my RRAS VPN.

I'm trying to block a specific client access to the WAN with this:

iptables -I FORWARD -s 192.168.X.X -o $WAN_INTERFACE -j DROP

I however need a exception to allow outbound connections to a specific IP, so I need an ACCEPT rule before it in the right chain.

What is the best way to create this exception and block everything else?

On my HP Microserver N54L which acts as file server, I have a parity storage spool consisting of the following:

• 4x 2TB WD Caviar Green
• 1x 3TB WD Caviar Green (Recently added)

The OS (Server 2012 R2) is run on an SSD.

The 2TB drives are all over 70% used, I added the 3TB drive recently because of low capacity warnings. What I didn't realise until finding out now is there is no data rebalancing system in 2012 R2, so the new drive I have added is not being used as I thought it would once introduced into the pool.

Furthermore I am now getting the prompt to add two additional drives to the pool, even though there is plenty of capacity since the upgrade, I'm assuming because all 4 of the 2TB drives are over 70% used, this warning is being generated.

Are there options available to manually rebalance the data across all the drives, reducing the usage on the 2TB drives, and sharing it across the new 3TB? Would Windows correct the issue overtime, simply by new data being introduced to the pool, its apparent there isn't any PowerShell commands available to do it, though apparently Microsoft have introduced this in Windows Server 2016, but this doesn't help my situation and its doubtful this feature would be added to 2012 R2.

I'm wondering if similar situations have happened to others and what the best action is to resolve it?

I'm running a Squid proxy and want to exclude a certain web address that is accessed over a non-standard port from going through the proxy, rather than open the port in an ACL within squid.conf (seems its a specific usage case).

In my case the port in question TCP 2222 (DirectAdmin) over both http:// and https://. I wasn't sure if this was actually possible to do without opening the port itself, but I did find several articles about bypassing URL's with non standard ports with PAC/WPAD. I've tried a ruleset like the one below, which sets a wildcard for the TLD and specific rules for the non-standard port URL.

 if (shExpMatch(host, "*.somedomain.com") ||
     shExpMatch(url, "http://example.somedomain.com:2222/*") ||
     shExpMatch(url, "https://example.somedomain.com:2222/*"))
     return "DIRECT";

Using pactester, I am getting the correct response of DIRECT from a rule test

pactester -p /path/to/wpad.dat -u http://example.somedomain.com
DIRECT
pactester -p /path/to/wpad.dat -u http://example.somedomain.com:2222
DIRECT
pactester -p /path/to/wpad.dat -u https://example.somedomain.com:2222
DIRECT

However it appears the request is still being sent through the proxy as I get "Proxy is refusing connections" etc in a web browser. The port itself is not blocked, I can telnet to it, but the Sqiud ACL doesn't have the port allowed. Though this is what I am trying to avoid doing, and surely the DIRECT response means bypass?

Is this actually possible to achieve with a PAC/WPAD with non-standard ports, or their an alternative way to bypass and send directly for this specific case?

I've re-edited the original question, because I have changed the setup since the original answer, which was for NAT based setup. NAT is no longer being used and has been replaced with TPROXY for IPv6 compatibility.

I'm running squid in a small network. I've setup a couple of squid listening ports for different scenarios.

Excerpt of squid.conf

• http_port 3128 - This is will be pushed to Windows clients via domain policy, with the HTTP Proxy set via WPAD.
• http_port 3129 tproxy - This is for clients that are having traffic on port 80 intercepted.

For the TPROXY setup I'm using the following iptables/ip6tables rules on my DD-WRT router with iproute2 to mark and redirect traffic to the proxy. The problem is in this setup all traffic is tagged, including IPv4 and IPv6 traffic that is going to the Squid proxy via the 3128 port setup.

I need a way to exclude this traffic because it is is adding overhead and breaking connectivity (particularly IPv6) on LAN clients that have the proxy applied directly.

I'm aware I could add specific clients to the PREROUTING table with an ACCEPT rule, but doing this for both IPv4 and IPv6 will become hard to manage quickly. I need to find a generic way to exclude all LAN clients that go through the Squid Proxy on port 3128 at router level but I don't know the best way to do it.

Current DD-WRT Squid policy routing:

# Squid transparent proxy
PROXY_IPV4=192.168.x.x
PROXY_IPV6=2001:470:xxxx:xx::x
CLIENTIFACE=br0
FWMARK=3

iptables -t mangle -A PREROUTING -i $CLIENTIFACE -s $PROXY_IPV4 -p tcp --dport 80 -j ACCEPT
ip6tables -t mangle -A PREROUTING -i $CLIENTIFACE -s $PROXY_IPV6 -p tcp --dport 80 -j ACCEPT

iptables -t mangle -A PREROUTING -i $CLIENTIFACE -p tcp --dport 80 -j MARK --set-mark $FWMARK
iptables -t mangle -A PREROUTING -m mark --mark $FWMARK -j ACCEPT
ip6tables -t mangle -A PREROUTING -i $CLIENTIFACE -p tcp --dport 80 -j MARK --set-mark $FWMARK
ip6tables -t mangle -A PREROUTING -m mark --mark $FWMARK -j ACCEPT

iptables -t filter -A FORWARD -i $CLIENTIFACE -o $CLIENTIFACE -p tcp --dport 80 -j ACCEPT
ip6tables -t filter -A FORWARD -i $CLIENTIFACE -o $CLIENTIFACE -p tcp --dport 80 -j ACCEPT

ip rule add fwmark $FWMARK table 2
ip -6 rule add fwmark $FWMARK table 2
ip route add default via $PROXY_IPV4 table 2
ip -6 route add default via $PROXY_IPV6 table 2

# End Squid intercept proxy config

I've got a CentOS 7 box configured as a Squid proxy, with clamav and Squidclamav. Normally I would just disable SELINUX, but I am attempting to understand and setup allow rules properly. I've managed to create several to fix issues identified with squid however, one error related to sockets with clamd is causing problems.

type=AVC msg=audit(1436899859.808:9282): avc: denied { unlink } for pid=22802 comm="clamd" name="clamd.sock" dev="tmpfs" ino=729382 scontext=system_u:system_r:antivirus_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file

What module/allow rule do I need to fix this entry being reported in the audit.log?

I'm running OpenVPN 2.3.7 on CentOS 6. I'm using routing (tun) and have two instance of OpenVPN. On the second instance there are two clients that I'd like to be make visible to each other i.e ping, access ports etc. They are both within the same subnet, so it should be fairly straight forward, they are configured with static addresses through ccd.

I want the two clients to be able to see each other via their OpenVPN LAN IP addresses without enabling client-to-client in the server.conf.

I'm pretty sure it can be done with iptables, which I use as my firewall, although I use CSF, but its a wrapper for iptables.

These are the IPv4 addresses of the clients:

OpenVPN Client #1: 10.8.2.14 
OpenVPN Client #2: 10.8.2.17

I need to client #1 to be able to access services running on client 2, and I guess for compatibility client #2 to see client #1 if a response is required.

I have tried several FORWARD chain rules on the OpenVPN server, but I can't get any communication between the two clients. The OpenVPN server can obviously ping both clients, the clients can ping the OpenVPN server gateway, the clients cannot obviously see each other.

Some rules I've already tried and haven't worked:

iptables -A FORWARD -s 10.8.2.14 -d 10.8.2.17 -j ACCEPT
iptables -A FORWARD -s 10.8.2.17 -d 10.8.2.14 -j ACCEPT

I'm looking for help with iptables to get the two clients visible to each other, without enabling client-to-client, see this is a special requirement for two clients and not needed anywhere else.

The alternative is exposing the services on the VPN client through NAT, but I'd rather avoid doing this for security.

Any insight would be helpful!

Thanks,

James