Youtube не работает через squid. Как быть?

Question

[sirtimon]

шлюз freebsd 11.2
прокси squid 4.1 в непрозрачном режиме.
всё работает отлично кроме youtube'а
браузер виснет на "установление безопасного соединения"
а в обход прокси работает.
как быть? у кого какие мысли?

Answer 1

[Дмитрий]

есть что-нибудь в логах сквида?
/var/log/squid/access.log
и
/var/log/squid/cache.log

Сталкивался, что висли соединения по https с облачными сервисами , в случае, если у сервера squid и клиента в локальной сети были указаны разные DNS серверы..

Answer 2

[sirtimon]

запрос на коннект идёт.

1539591607.690  30078 192.168.0.104 TCP_TUNNEL/200 39 CONNECT www.youtube.com:443 - HIER_DIRECT/74.125.131.198 -

но при это в cache.log таймаут:

2018/10/15 11:23:43 kid1| local=37.98.153.251:19537 remote=173.194.73.121:443 FD 478 flags=1: read/write failure: (60) Operation timed out
2018/10/15 11:26:52 kid1| local=37.98.153.251:20483 remote=173.194.73.121:443 FD 59 flags=1: read/write failure: (60) Operation timed out

DNS у всего и у всех один - свой BIND913 с форвадом на яндекс днс (провайдерский/гугловый/саморекурсивный тоже пробовал).

Comments

[sirtimon]

host youtube.com
youtube.com has address 173.194.122.128
youtube.com has address 173.194.122.131
youtube.com has address 173.194.122.137
youtube.com has address 173.194.122.130
youtube.com has address 173.194.122.136
youtube.com has address 173.194.122.129
youtube.com has address 173.194.122.132
youtube.com has address 173.194.122.133
youtube.com has address 173.194.122.135
youtube.com has address 173.194.122.134
youtube.com has address 173.194.122.142

host www.youtube.com
www.youtube.com is an alias for youtube-ui.l.google.com.
youtube-ui.l.google.com is an alias for wide-youtube.l.google.com.
wide-youtube.l.google.com has address 173.194.73.198

[sirtimon]

Не знаю с чем это связанно, но tcpdump ругается на контрольную сумму:

13:44:40.881497 IP (tos 0x0, ttl 128, id 5819, offset 0, flags [DF], proto TCP (6), length 112)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [P.], cksum 0xa500 (correct), seq 2423636681:2423636753, ack 1550414380, win 253, length 72
13:44:40.881510 IP (tos 0x0, ttl 128, id 5820, offset 0, flags [DF], proto TCP (6), length 78)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [P.], cksum 0x26a9 (correct), seq 72:110, ack 1, win 253, length 38
13:44:40.881522 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40, bad cksum 0 (->b819)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [.], cksum 0x82d1 <b>(incorrect -> 0x143d)</b>, ack 110, win 512, length 0
13:44:40.881902 IP (tos 0x0, ttl 128, id 5821, offset 0, flags [DF], proto TCP (6), length 1143)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [P.], cksum 0xbc91 (correct), seq 110:1213, ack 1, win 253, length 1103
13:44:40.951926 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 78, bad cksum 0 (->b7f3)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [P.], cksum 0x82f7 <b>(incorrect -> 0xe98a)</b>, seq 1:39, ack 1213, win 513, length 38
13:44:40.952288 IP (tos 0x0, ttl 128, id 5824, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [.], cksum 0x10cb (correct), ack 39, win 253, length 0
13:44:40.952538 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 107, bad cksum 0 (->b7d6)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [P.], cksum 0x8314 <b>(incorrect -> 0xa39d)</b>, seq 39:106, ack 1213, win 513, length 67
13:44:40.952663 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 70, bad cksum 0 (->b7fb)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [P.], cksum 0x82ef <b>(incorrect -> 0x9d15)</b>, seq 106:136, ack 1213, win 513, length 30
13:44:40.952812 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 78, bad cksum 0 (->b7f3)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [P.], cksum 0x82f7 (incorrect -> 0x6215), seq 136:174, ack 1213, win 513, length 38
13:44:40.953210 IP (tos 0x0, ttl 128, id 5826, offset 0, flags [DF], proto TCP (6), length 40)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [.], cksum 0x1044 (correct), ack 174, win 253, length 0
13:44:40.953745 IP (tos 0x0, ttl 128, id 5827, offset 0, flags [DF], proto TCP (6), length 78)
    192.168.0.104.59493 > 192.168.0.254.3128: Flags [P.], cksum 0x7576 (correct), seq 1213:1251, ack 174, win 253, length 38
13:44:41.054931 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40, bad cksum 0 (->b819)!)
    192.168.0.254.3128 > 192.168.0.104.59493: Flags [.], cksum 0x82d1 (incorrect -> 0x0f1a), ack 1251, win 513, length 0