não navegam mais que 3 usuários na Squid/Iptables

Marcelo_Reis
(usa Slackware)

Enviado em 06/10/2008 - 18:38h

Olá Amigos

Estou enfrentando dificuldades no meu servidor Iptables/Squid, pois quando está em funcionamento permite algumas poucas maquinas navegando, e se uma nova consegue navegar, outra é derrubada.

Minha rede está (estava) assim:

(((Internet)))<--->|Modem Bridge|<--->|FwPx|<--->|hosts|



meu squid conf está assim:

________________________________________________________________
#***********Porta Padrão*********************
http_port 3128 transparent
#
#
#
#**************Cache em RAM*****************
cache_mem 64 MB
maximum_object_size_in_memory 10 MB
maximum_object_size 10 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
#
#Pastas de cache em disco
cache_dir ufs /home/hospital/squid/cache/squid1 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid2 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid3 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid4 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid5 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid6 3000 16 256
cache_dir ufs /home/hospital/squid/cache/squid7 3000 16 256
#
#
#
#*************log dos acessos***************
cache_access_log /home/hospital/squid/logs/access.log
#
#log para informações sobre o webproxy e eventuais falhas
cache_log /home/hospital/squid/logs/cache.log
#
#Log sobre quais objetos entraram e sairam e quanto esteve armazenado
cache_store_log /home/hospital/squid/logs/store.log
#
#Numero do processo Squid no sistema
pid_filename /home/hospital/squid/logs/squid.pid
#
#Menssagens de erro
error_directory /usr/share/squid/errors/pt-br
#icones
icon_directory /usr/share/squid/icons
#
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
#
#
#
#**************Nome do host ***DSD*** *************
visible_hostname firewall
#
#
#**********ACL Listas de Controle de Acesso*****************
#
#rede
acl localhost src 127.0.0.1/255.255.255.255
acl redelocal src 10.0.0.0/255.255.255.0
#acl all src 0.0.0.0/0.0.0.0
#
#ip
acl lista_ip_1 src 10.0.0.10-10.0.0.49
acl lista_ip_2 src 10.0.0.50-10.0.0.99
acl lista_ip_3 src 10.0.0.100-10.0.0.254
# acl aclname src ip-address/netmask ... # clients IP address
# acl aclname src addr1-addr2/netmask ... # range of addresses
#
#paginas, extenção de arquivo e palavras chave
acl blocked_url url_regex -i "/home/hospital/squid/list/blocked_url.txt"
acl unblocked_url url_regex -i "/home/hospital/squid/list/unblocked_url.txt"
# acl aclname dst ip-address/netmask ... # URL host's IP address
#
#
#HOTMAIL e MSN
#
#MSN
acl msn dstdomain loginnet.passport.com
acl msnmessenger url_regex -i gateway.dll
acl gate req_mime_type -i ^application/x-msn-messenger$
#
#Hotmail
acl hotmail url_regex -i "/home/hospital/squid/list/hotmail.urls"
#
#
#portas
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
#Controle por horas especificas
acl manha_acl time SMTWHFA 08:00-08:30
acl tarde_acl time SMTWHFA 17:50-18:00
acl noite_acl time SMTWHFA 20:00-20:30
#
#
#
#******* Permissões de Acesso**********
http_access allow hotmail
http_access allow msn
http_access allow gate
http_access allow msnmessenger
http_access allow unblocked_url
http_access allow localhost
http_access allow lista_ip_3
http_access deny blocked_url !unblocked_url !msn !gate !msnmessenger
http_access allow lista_ip_2 !blocked_url !msn !gate !msnmessenger
#http_access allow lista_ip_1 manha_acl
#http_access allow lista_ip_1 tarde_acl
#http_access allow lista_ip_1 noite_acl
http_access deny lista_ip_1 !unblocked_url
#!manha_acl !tarde_acl !noite_acl
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow redelocal
http_access deny all
________________________________________________________________


E meu Iptables não está bloquendo nada além de redirecionar os pacotes da porta 80 para 3128 (squid)

________________________________________________________________
rc.firewall

# Generated by iptables-save v1.4.0 on Sat Oct 4 16:37:11 2008
*nat
:PREROUTING ACCEPT [286:35812]
:POSTROUTING ACCEPT [99:6119]
:OUTPUT ACCEPT [107:6620]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i eth1 -p udp -m udp --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -s 10.0.0.0/24 -o ppp0 -j MASQUERADE
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Sat Oct 4 16:37:11 2008
# Generated by iptables-save v1.4.0 on Sat Oct 4 16:37:11 2008
*filter
:INPUT ACCEPT [3151:899797]
:FORWARD DROP [67:2928]
:OUTPUT ACCEPT [1783:827005]
-A INPUT -i ppp+ -p udp -m udp --dport 0:1023 -j LOG
-A INPUT -i ppp+ -p tcp -m tcp --dport 0:1023 -j LOG
-A INPUT -i ppp+ -p udp -m udp --dport 0:1023 -j DROP
-A INPUT -i ppp+ -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT -i ppp+ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j LOG
-A INPUT -i ppp+ -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -i ppp+ -p icmp -m icmp --icmp-type 8 -j DROP
-A FORWARD -s 10.0.0.0/24 -d 201.10.120.2/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 201.10.128.3/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -s 201.10.120.2/32 -d 10.0.0.0/24 -p udp -m udp --sport 53 -j ACCEPT
-A FORWARD -s 201.10.128.3/32 -d 10.0.0.0/24 -p udp -m udp --sport 53 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 25 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 587 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 110 -j ACCEPT
COMMIT
# Completed on Sat Oct 4 16:37:11 2008
________________________________________________________________


efetuei conexão via PPP (ADSL)


se alguém tiver alguma resposta ficarei grato!