Squid doesn't use IPv6 address

Question

Score:0

Server

Squid doesn't use IPv6 address

Tchupy

7/12/24, 7:55 AM

I've got a small issue with my squid (forward) proxy server. It keeps using IPv4 as outgoing IP address even if remote server and client have IPv6 connectivity.

My client's IP address:

devuan@devuan:~$ ip a show scope global
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:6e:90:f3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.110/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 75947sec preferred_lft 75947sec
    inet6 2a01:xxxx::90f3/64 scope global dynamic mngtmpaddr
       valid_lft 86362sec preferred_lft 562sec

I test my connectivity with an HTTP server I made that just answers with IP address & all HTTP headers.

devuan@devuan:~$ curl -x proxy.home:3128 20102020.xyz
{
  "headers": {
    "Host": "20102020.xyz",
    "X-Real-Ip": "90.1.1.1",
    "X-Forwarded-For": "2a01:xxxx::90f3, 90.1.1.1",
    "X-Forwarded-Proto": "http",
    "X-Api": "/api",
    "Connection": "close",
    "User-Agent": "curl/7.74.0",
    "Accept": "*/*",
    "Via": "1.1 proxy.home (squid/5.7)",
    "Cache-Control": "max-age=259200"
  },
  "date": "12-Jul-2023 09:37:33",
  "ip": "90.1.1.1"

I got this flow : client --> IPv6 --> proxy server --> IPv4 --> http server of course, if I force the client to use its IPv4 address, the connectivity flow becomes : client --> IPv4 --> proxy server --> IPv4 --> http server

From the proxy server, by default the connection is made through IPv6

tchupy@proxy:~ $ curl -vI 20102020.xyz
*   Trying [2001:bc8:1820:134::1]:80...
* Connected to 20102020.xyz (2001:bc8:1820:134::1) port 80 (#0)

here is squid.conf :

acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10          # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12          # RFC 1918 local private network (LAN)
acl localnet src 192.168.1.0/24         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10              # RFC 4291 link-local (directly plugged) machines
acl localnet src 2a01:xxxx::/56 # IPv6 local prefix
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
include /etc/squid/conf.d/*.conf
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
logformat squid-log      %tl %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
access_log daemon:/var/log/squid/access.log squid-log
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

I try to configure the "forwarded_for" key on delete or off or on, but it doesn't change anything except the private IP address is hidden in "X-Forwarded-For" header.

To be clear, I would like to use IPv6 outgoing address if remote server has IPv6 connectivity. Is there a way to configure squid like this ?

Thanks

47

0 + 0

ipv6

squid

Squid doesn't use IPv6 address

Post an answer