[8.940][CLOSED] Http proxy timeouts again

I had enabled ipv6 when this came up yet again. dual stack still not working right?

now that i've disabled ipv6 I now get things like this:

2012:05:01-07:18:38 firewall httpproxy[27864]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.255.51" dstip="72.21.91.19" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2661" request="0x93f85d8" url="www.wnd.com/.../for-self-defense-22-beats-45" exceptions="av,content,url,cache" error="Timeout while reading response from Server"
2012:05:01-07:20:20 firewall httpproxy[27864]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.255.51" dstip="23.13.181.55" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="3617" request="0x9367338" url="p.twitter.com/t.gif
2012:05:01-07:20:20 firewall httpproxy[27864]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.255.51" dstip="199.59.150.12" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="3325" request="0x95f7600" url="r.twimg.com/jot
2012:05:01-07:20:20 firewall httpproxy[27864]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.255.51" dstip="72.21.91.19" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2709" request="0x93fca18" url="www.wnd.com/.../twitter-small.png" exceptions="av,content,url,cache" error="Timeout while reading response from Server"

if i disable the proxy it of course works fine. So now even though i have turned off ipv6 i still get timeouts on various sites. Any ideas?

0 William Warren over 13 years ago

btw this occurs with cloudy based proxy and local mem based proxy databases.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Billybob over 13 years ago in reply to William Warren

I have this problem really bad also.


2012:05:01-09:55:12 gatekeeper httpproxy[17469]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.0.10" dstip="85.115.22.9" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2689" request="0xa906b80" url="www.astaro.org/.../Business Forums"

2012:05:01-09:55:13 gatekeeper httpproxy[17469]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xaa17458" function="send_response_body" file="response.c" line="597" message="send: Broken pipe"

2012:05:01-09:55:13 gatekeeper httpproxy[17469]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xaa9dcb0" function="send_response_body" file="response.c" line="597" message="send: Broken pipe"

2012:05:01-09:55:13 gatekeeper httpproxy[17469]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xa8cea28" function="send_response_body" file="response.c" line="597" message="send: Broken pipe"


2012:05:01-09:55:13 gatekeeper httpproxy[17469]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.0.10" dstip="85.115.22.9" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" request="0xaa9dcb0" url="www.astaro.org/.../Business Forums"

2012:05:01-09:55:13 gatekeeper httpproxy[17469]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.0.10" dstip="85.115.22.9" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" request="0xa8cea28" url="www.astaro.org/.../Business Forums"

As soon as I bypass proxy, the website starts working no problem. Interestingly I notice the problem on astaro website the most[:$] The workaround for me has been clearing the http proxy cache (although I am not using proxy caching). Restarting the proxy doesn't fix it but clearing the cache does[:S] But clearing proxy only works for a little while and then back to errors again[:(]

By the way I have had this problem since the beginning of 8.940013

Regards
Bill

P.S i am running the proxy in transparent mode.

0 traxxus_01 over 13 years ago

Same here. If the transparent proxy is enabled, i can surf only "on the top" of a page. Depper links goes into a timeout.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 William Warren over 13 years ago

the list of sites is spreading..facebook is unusable right now..i think i'm heading to back to 8.30x.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 13 years ago in reply to William Warren
I do have a vm of 8.301 sitting there but I enjoy testing the newer versions. However this timeout error is kinda hard to live with. Speaking of facebook...
2012:05:02-00:05:02 gatekeeper httpproxy[17469]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.0.11" dstip="66.220.151.88" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2845" request="0xa8a9a38" url="0-202.channel.facebook.com/pull

I have also noticed that the proxy seems to be extra slow and not as fast as usual even with the local content database. I wish I had time to do a real benchmark but I don't and for some reason astaro seems to have trouble getting the "Core" functionality working flawlessly. Granted this is beta code and fairly stable this time around, but I was hoping for steps forward in performance of core daemons like IPS and proxy, the things that everyone uses and pretty much bases their opinions about the performance of a UTM. I know they are tuning IPS, hopefully http proxy will get some help also.

My QoS with app control is acting strangely too but I will open a new thread for that if I get a chance to test it further.

Regards
Bill
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 William Warren over 13 years ago

I figured this was going to be a bumpy version since this is the first sophosized astaro.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 13 years ago

Do all of you have IPS enabled? If so, do you see anything in the logs?

Cheers,
Kai
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 William Warren over 13 years ago

Do all of you have IPS enabled? If so, do you see anything in the logs?

Cheers,
Kai

Yes and no...disabling ips does not fix the issue

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 13 years ago

Hi all,

I would like to have a more detailed look on your proxy installation by enabling debug logging. If you want to help me with this, please send me a private message with login credentials. My public SSH key is also available on request.

Regards,
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 13 years ago in reply to mle

PM sent. I am really busy with work lately so please excuse the delayed feedback.

The easiest way to reproduce the error on my box is visit astaro.org and after a couple of links you will hit the timeout every time.

Regards,
Bill.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[8.940][CLOSED] Http proxy timeouts again

Submitted a Tech Support Case lately from the Support Portal?