Enable dns_v4_first on

[veeramani (Veeramani P)]

**NethServer Version: NethServer release 7.4.1708 (Final)
**Module:Web Proxy

Dear Team,

I create custom Template for dns_v4_first, But i don’t know how to enable this settings in squid config file, Also i have a problem disabling IPv6 address. How To check if the IPv6 address are using in live.

Here are my screenshots for custom template and IPv6 address details.

After restart the proxy server we didn’t any entry in squid config file related to dns_v4_first

This for IPv6 details

This the port currently running in proxy server

Kindly let me know the solution. We are facing https sites getting very slow connection. Provide the solution for enabling dns_v4_first configuration in squid config file. Also disabling IPv6.
@filippo_carletti
@mrmarkuz
@davidep

[flatspin (Ralf Jeckel)]

To enable a template run the expand-template command and than restart the service.
Please see http://docs.nethserver.org/projects/nethserver-devel/en/latest/templates.html#the-expansion-of-templates for details.

[veeramani (Veeramani P)]

Thanks for your response @flatspin

Also why my proxy server listen only IPv6 address,

I can’t open any https page quickly its getting more than 10-15 minutes to full load. Why ?? Is there any way to solve this issue.
Kindly let me know any solution.

[flatspin (Ralf Jeckel)]

Please let me know more about your config. Which modules do you have installed relating to squid?
Squidguard? Antivirus enabled? Cache enabled? Any more custom templates? Trafficshaping?
Is ndpi-module installed? If so, any fw-rules relating to http-traffic created?
I see evebox in your post, so suricata is installed. Try to temporarely disable IPS and see if something changes in behavior of th eproxy.
I have a standard-config with only some refreshpatterns as custom template.
In standard config ports 3128, 3129 ,3130 should be used AFAIK:

netstat -tlnp | grep squid
tcp6       0      0 :::3128                 :::*                    LISTEN      4385/(squid-1)
tcp6       0      0 :::3129                 :::*                    LISTEN      4385/(squid-1)
tcp6       0      0 :::3130                 :::*                    LISTEN      4385/(squid-1)

Please show also output of config show squid.

EDIT: Which mode do you use? transparent with SSL or authenticated?

[veeramani (Veeramani P)]

Dear @flatspin

We have installed squid module for web proxy, Antivirus is disabled, Cache is enabled, Traffic-shaping is disabled and ndpi-module not installed. We always disable IPS ( suricata ). The evebox is running but I don’t know about evebox.

Web proxy enable in authentication mode for green zone. Authentication using Domain join account (Zentyal Domain Controller) .

Port 3128 entry only shown in command line.

output of config show squid.

let me know any details about my configuration.

[flatspin (Ralf Jeckel)]

I can see nothing weird.
What about your client-configuration? Authenticated mode needs to configure all clients explicitly to use the proxy. Windows or linux clients?
Is your wpad file existing in /var/www/html?

[veeramani (Veeramani P)]

The client configuration we are using FQDN (not IP address) and port number in proxy settings, Same as the Linux client also.

Also we can’t expand our custom template in command line.

The wpad file existing in the location of /var/www/html

[flatspin (Ralf Jeckel)]

The command is: expand-template /etc/squid/squid.conf
You have to specify the conf file with it’s path, not the template-file.

Did you try the IP-address? Maybe an DNS-problem?

Sorry for german screenshot, but try to enable the automatic configuration option.
We are using transparent with SSL, so no need for this at our side, but I hat once the problem, that certain websites were very slow, when this option was disabled.

[veeramani (Veeramani P)]

Once we enable this option in proxy, Chrome browser getting pop up

message like this

once we enter username and password its not cleared. Its asking again and again.
Thais the reason we are using host name and port number in proxy settings.

[flatspin (Ralf Jeckel)]

What about other browerser like firefox? Same?
Did you try to clear browsercache on the clilent?

[flatspin (Ralf Jeckel)]

There is a known issue about wpad. Please see this discusion. Exactly your problem regarding the credentials.

Non-transparent proxy: WPAD file contains IP address of Nethserver server, should be FQDN

When a user whose workstation web browser has been configured (in a way or another) to use http://proxy.lan.example.com/wpad.dat as a proxy auto configuration script then he/she is:

• Presented a proxy authentication dialog
• The credentials, even when correctly entered, aren’t accepted

[veeramani (Veeramani P)]

If i expand custom template for dns_v4_first using this command in command line
expand-template /etc/squid/squid.conf

After restarting proxy server, there is no entry regarding dns_v4_first_on in squid config file. I don’t know how to enable in squid config file. Also how to disable IPv6.
Let me know if there is any possible solutions.

If I modify the wpad.dat file and set the PROXY lines to return proxy proxy.example.com:3128 after restarting the server, same issue till occur. There is lot of TCP_DENIED/407 in squid access log compare with previous settings in wpad.dat.

I don’t exactly what to do now? Kindly provide solution.

[flatspin (Ralf Jeckel)]

Please don’t modify the wpad.dat file. Modify a client to use IP instead of fqdn.

The correct path to your template is
/etc/e-smith/templates-custom/etc/squid/squid.conf/100example_configuration
to put it at the end, or have a look at
/etc/e-smith/templates/etc/squid/squid.conf
and choose a number to put the lines between 00 and 90.
100example_configuration is the file with the configuration.
Please refer to http://docs.nethserver.org/projects/nethserver-devel/en/latest/templates.html