Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 15 replies
  • Subscribers 1 subscriber
  • Views 4455 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTP Proxy and DNS

burtoncarl
I've recently upgraded from 7.011 to 7.104
I use the HTTP Proxy(transparent) and the Content filter
After upgrading it doesn't appear that the http proxy is able to get DNS resolution.
When I turn off the proxy the requests go through fine.  When it is on though I receive an error page saying: 

While trying to retrieve the URL: 	http://google.com/

Error message: 	DNS resolution timeout

Your cache administrator is: 


ANY help will be appreciated!

Here is a copy of the LiveLog for the  

2008:05:12-13:11:29 (none) httpproxy[9474]: Integrated HTTP-Proxy (c) 2007 Astaro AG

2008:05:12-13:11:29 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="read_config" file="httpproxy.c" line="429" message="loading httpproxy.ini"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs01.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs02.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs03.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs04.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs05.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs06.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs07.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs08.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="scr_reload" file="scr_scanner.c" line="331" message="called"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs01.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs02.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs03.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs04.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs05.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs06.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs07.astaro.com: Temporary failure in name resolution"

2008:05:12-13:11:33 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs08.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:01 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs01.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:01 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs02.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:02 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs03.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:02 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs04.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:02 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_resolve_server" file="scr_scanner.c" line="390" message="DNS: cffs05.astaro.com: Temporary failure in name resolution"

2008:05:12-13:12:02 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x81e7c18" function="sc_categorize_url" file="scr_scanner.c" line="932" message="no categorization received for url: http://google.com/"

2008:05:12-13:12:09 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x81e7c18" function="dns_expire" file="dns.c" line="761" message="dns query timed out, retransmitting (retry 1)"

2008:05:12-13:12:14 (none) httpproxy[9474]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x81e7c18" function="dns_expire" file="dns.c" line="761" message="dns query timed out, retransmitting (retry 2)"

2008:05:12-13:12:19 (none) httpproxy[9474]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request could not be delivered due to an error" action="block" method="GET" srcip="172.16.1.50" user="" statuscode="500" cached="0" profile="profile_1" filteraction="action_REF_DefaultHTTPCFFAction" size="2119" time="17998 ms" request="0x81e7c18" url="google.com/" error="DNS resolution timeout" category="1720" categoryname="Categorization Failed" 


This thread was automatically locked due to age.
Parents
  • 0
    Sorry for not being so specific, I was referring to the error code and identical issue:

    "I've recently upgraded from 7.011 to 7.104
    I use the HTTP Proxy(transparent) and the Content filter
    After upgrading it doesn't appear that the http proxy is able to get DNS resolution.
    When I turn off the proxy the requests go through fine. When it is on though I receive an error page saying":

    While trying to retrieve the URL:  Google
    Error message:  DNS resolution timeout
    Your cache administrator is:

    However, performing the changes to the HTTP Proxy settings are producing the same result - being able to browse the web. 

    This is not the same hardware, as this is a new, smaller computer than the desktop I was running this on.  The backup was my latest from my previous machine for 7.505.  My installation was install 7.504 (that is the latest ISO available), do a quick setup, upgrade to 7.505 using the .gpg file, and then restoring my 7.505 .abf file.

    I can post my logs when I get back home (at work currently).  the logs were showing 'disabling EDNS' on the end of the lines if I remember correctly.

    XG 19.5 GA 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | GB Ethernet x5

  • 0 in reply to Amodin
    After all these years, DNS is still one of the best ways ever invented to kill a network...

    Keep in mind that in transparent mode, the clients (NOT the Astaro) are responsible for DNS.  In authenticated or standard proxy mode, Astaro does the DNS lookups.

    Is the checkbox for "Use  Forwarders Assigned by ISP" checked? (under Network Services > DNS > Forwarders tab).  If so, please uncheck that.
  • 0 in reply to Jack Daniel
    Yes it is checked by default I believe and I have not ever changed that.  I will try that to see if it fixes the Transparent/Standard differences.  However, I think I like Astaro doing the DNS lookups instead.  [:)]

    XG 19.5 GA 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | GB Ethernet x5

Reply
  • 0 in reply to Jack Daniel
    Yes it is checked by default I believe and I have not ever changed that.  I will try that to see if it fixes the Transparent/Standard differences.  However, I think I like Astaro doing the DNS lookups instead.  [:)]

    XG 19.5 GA 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | GB Ethernet x5

Children
  • 0 in reply to Amodin
    The forwarders tab defines the DNS servers the Astaro uses, so if the ASG has DNS issues, that's the place to look.

    I should have been more clear on my last statement.  In transparent mode, the clients do their own DNS lookups, if the Astaro is their DNS server, that's where they get their DNS resolution- but if the clients are configured to use other systems for DNS, that's where they will get their resolution.

    If the proxy is in standard or an authenticated mode, the proxy performs the DNS lookups, not the client.

    As far as clients, just make sure the internal network(s) are listed in the allowed networks field on the DNS global tab, and that the Astaro is assigned as the DNS server for your client systems.

    Note, if the Astaro is not the DNS server for the clients, they (or the internal DNS server they point to) will need a packet filter rule allowing DNS queries out to the Internet DNS servers (UDP 53).