slackware 13.1 + squid + iptables (firewall) [RESOLVIDO]
1. slackware 13.1 + squid + iptables (firewall) [RESOLVIDO]
marvinoliveiras
(usa Slackware)
Enviado em 25/11/2011 - 10:58h
Bom dia, estou aqui tentando aprender sobre como usar o squid como proxy transparente e acontece que o squid está rodando assim como o meu arquivo rc.firewall mas não consigo navegar. O conteúdo do meu squid. conf é esse:http_port 3128 transparent
visible_hostname casa
cache_mgr marvinoliveiras@dominio
error_directory /usr/share/squid/errors/pt-br
hierarchy_stoplist cgi-bin ?
cache_mem 32 MB
maximum_object_size_in_memory 2048 KB
maximum_object_size 100 MB
cache_dir ufs /var/log/squid/cache 2048 16 256
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localnet src 192.168.2.0/24
refresh_pattern ^ftp: 360 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
access_log /var/log/squid/access.log
acl Safe_ports port 21 #ftp
acl Safe_ports port 70 #gopher
acl Safe_ports port 80 #http
acl Safe_ports port 210
acl Safe_ports port 280
acl Safe_ports port 443
acl Safe_ports port 488
acl Safe_ports port 563
acl Safe_ports port 591
acl Safe_ports port 631
acl Safe_ports port 777
acl Safe_ports port 873
acl Safe_ports port 901
acl Safe_ports port 1025-65535
acl connect method CONNECT
acl SSL_ports port 443
acl SSL_ports port 563
acl SSL_ports port 873
http_access deny connect !SSL_ports
acl autenticados proxy_auth REQUIRED
acl permitidos src 192.168.2.0/24
http_access allow permitidos
http_access deny all
acl domains dstdomain "/etc/squid/domains"
http_access deny domains
acl words url_regex -i "/etc/squid/words"
http_access deny words
acl extensions urlpath_regex -i "/etc/squid/extensions"
http_access deny extensions
e o meu arquivo rc.firewall:
##!bin/bash
echo 1 > /proc/sys/net/ipv4/ip_forward
#
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -m limit --limit 1/s -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -i eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.2.0/255.255.255.0 -o -eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
desde já agradeço a atenção de todos