[7.460][QUESTION][OPEN] Connection refused on shared resources

Hi All

The issue I am facing is that I am unable to access resources on my media client
It used to work on version 7.404 but after updating to v7.460 is doesn't work.
I am getting the following error via the HTTP log

2009:06:27-16:05:45 Enterprise httpproxy[4075]: [0xa9c538f0] send_request_headers (request.c:171) write: Connection refused 

2009:06:27-16:05:45 Enterprise httpproxy[4075]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="OPTIONS" srcip="192.168.2.31" user="" statuscode="502" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2135" time="2 ms" request="0xa9c538f0" url="172.16.1.2/" exceptions="" error="" category="9998" reputation="neutral" categoryname="Uncategorized"

I am not blocking uncategorized and neutral. PF rules are ok since I can see the traffic logged for the client 172.16.1.2

Any ideas?

Parents

0 BAlfson over 16 years ago

It looks like the HTTP Proxy is blocking traffic with your DMZ. Are you sure you haven't selected the 'Suspicious and uncategorized' checkbox in the middle of the list of categories?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 16 years ago in reply to BAlfson
The DMZ zone only blocks the following:

DMZ Zone filter
-------------------
Anonymizers
Anonymizing Utilities
Parked Domain
Phishing
Spam URLs
Spyware/Adware

It was the exact same config I was using on v7.404. Do you know what is the following:

2009:06:27-16:05:45 Enterprise httpproxy[4075]: [0xa9c538f0] send_request_headers (request.c:171) write: Connection refused
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to wingman

The issue is with the filtering done on the Internal network, not on that done on the DMZ network. What does that cinfig look like?

I dunno, I had assumed that line was part of the blocking.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BAlfson over 16 years ago in reply to wingman

The issue is with the filtering done on the Internal network, not on that done on the DMZ network. What does that cinfig look like?

I dunno, I had assumed that line was part of the blocking.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 wingman over 16 years ago in reply to BAlfson

I was about to edit my previous post cause I accidentally told you about the DMZ. Internal zone blocks the following only:

Zone 1 filter
------------------------
Anonymizers
Anonymizing Utilities
Parked Domain
Phishing
Spam URLs
Spyware/Adware
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 16 years ago in reply to wingman

Routing is probably getting confused since more than likely dmz is allowed to surf via http proxy also. But the error in the logs would indicate that the proxy is blocking it which doesn't make sense. Do you have packet filter rule allow LAN-->http to dmz by any chance?
If you do, as a work around, try putting 172.16.1.2 in transparent skiplist under http/s-->advanced-->Transparent mode skiplist. Also uncheck the box Allow HTTP traffic for listed hosts/nets after you add the IP. I am assuming you are using transparent proxy and see if it works.
It still might be a bug though in http proxy. HTTP proxy was fine in 7.450 but is not the stablest thing in 7.460 in my opinion.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 16 years ago in reply to Billybob

Routing is probably getting confused since more than likely dmz is allowed to surf via http proxy also. But the error in the logs would indicate that the proxy is blocking it which doesn't make sense. Do you have packet filter rule allow LAN-->http to dmz by any chance?
If you do, as a work around, try putting 172.16.1.2 in transparent skiplist under http/s-->advanced-->Transparent mode skiplist. Also uncheck the box Allow HTTP traffic for listed hosts/nets after you add the IP. I am assuming you are using transparent proxy and see if it works.
It still might be a bug though in http proxy. HTTP proxy was fine in 7.450 but is not the stablest thing in 7.460 in my opinion.

i have a rule that only allows specific (netbios,ping etc) trafic to DMZ and is on the top of the rules. When I enable the logging for this rule I can see the traffic allowed but still traffic is blocked by the proxy.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 wingman over 16 years ago in reply to wingman

it seems that https proxy is not stable. I have the same issue with a website and I explicity allowed it on the http proxy

seems strange

2009:06:27-20:42:19 Enterprise httpproxy[8978]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.2.31" user="" statuscode="400" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction=" ()" size="2371" time="0 ms" request="0xa83d4490" url="update.filezilla-project.org/updatecheck.php

0 wingman over 16 years ago in reply to wingman

strangely enough ,one of the vista clients can connect with no issues to the shared resources and there is no log when they try to connect on the HTTP log. the two clients are in the same proxy filter and have the exact same proxy settings.However, I am getting the below error:

2009:06:27-23:00:20 Enterprise httpproxy[4028]: [0xa8c75808] send_request_headers (request.c:171) write: Connection refused

2009:06:27-23:00:20 Enterprise httpproxy[4028]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="OPTIONS" srcip="192.168.2.31" user="" statuscode="502" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_KvAnposSQm (Zone 1 Filter)" size="2135" time="2 ms" request="0xa8c75808" url="172.16.1.2/" exceptions="" error="" category="9998" reputation="neutral" categoryname="Uncategorized

and the vista client isn't

0 Astaro Beta Bot over 16 years ago in reply to wingman

Astaro Beta Report
--------------------------------
Version: 7.460
Type: QUESTION
State: OPEN
Reporter: wingman
Contributor: 
MantisID: 
--------------------------------

0 andyk007 over 16 years ago in reply to Astaro Beta Bot

could you please tell us witch OS are you using in which SP state? Further we need the version of your browser and example URL to reproduce it

Greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 16 years ago in reply to Astaro Beta Bot

I am still facing the same issue. Vista client can connect to the vista box and the connection is not appearing on the http log
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 16 years ago in reply to wingman

Could you please break it down for us. What media server are you running and which client are you using to connect.
As you have noticed https proxy is not behaving as it should (I have a whole thread on it somewhere). I now have a packet filter rule that allows https access via packet filter since I don't like installing a million certificates at home for https proxy for ssl traffic.

Try connecting multiple times to the server and include a longer log for http and packet filter if anything is being dropped.
Thanks.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 wingman over 16 years ago in reply to Billybob

I have a client that is running xp home. The media center is on vista. When the user tries to connect to that box via \172.16.1.2 (start>>run) I am getting the output on the http log(above posts). When another client with vista box does exactly the same, he is able to connect and no relevant logs exist on the log

I didn't have that issue on v7.404. I am pretty sure that it's related to the http proxy since I can see the relavant pf allowing the traffic
Not sure if it will help but as xp home client tries to connect I can see the relevant blocks on astaro

XP home and vista clients are zone 1 (192.168.x.x)
media box (vista) is on the DMZ (172.16.1.x)
traffic is allowed from zone 1 to DMZ

strangely enough , the connection was made and 2 minutes later I saw the relevant entry that it was blocked

2009:07:03-00:18:04 stuffman httpproxy[7574]: [0xb0b49c98] sc_categorize_url (scr_scanner.c:940) no categorization received for url: www.astaro.org/ajax.php

2009:07:03-00:18:16 stuffman httpproxy[7574]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.2.31" user="wingman" statuscode="200" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_KvAnposSQm (Zone 1 Filter)" size="13961" time="3369 ms" request="0xb0be30b0" url="www.astaro.org/editpost.php

2009:07:03-00:18:20 stuffman httpproxy[7574]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.2.31" user="wingman" statuscode="500" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_KvAnposSQm (Zone 1 Filter)" size="2219" time="12447 ms" request="0xb0b49c98" url="www.astaro.org/ajax.php

....

2009:07:03-00:20:18 stuffman httpproxy[7574]: [0xb0b49c98] send_request_headers (request.c:171) write: Connection refused 

2009:07:03-00:20:18 stuffman httpproxy[7574]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="OPTIONS" srcip="192.168.2.31" user="wingman" statuscode="502" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_KvAnposSQm (Zone 1 Filter)" size="2135" time="2 ms" request="0xb0b49c98" url="172.16.1.2/" exceptions="" error="" category="9998" reputation="neutral" categoryname="Uncategorized" 

2009:07:03-00:20:41 stuffman httpproxy[7574]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.

Let me know if you still require me to provide the logs from the pf and http
Thanks