Acesso remoto ERP - Squid bloqueando

1. Acesso remoto ERP - Squid bloqueando

fradeck
(usa Outra)

Enviado em 09/06/2015 - 13:46h

Bom dia.
Estou com um problema e não sei mais o que fazer para resolver. Já deixei o firewall com tudo liberado e o squid também, a situação é a seguinte:
A filial acessa remoto nosso ERP e parou de funcionar.
Quando para o squid o acesso normaliza se subo ele não consigo mais acessar o ERP (não dá erro, fica carregando e não funciona)
Alguma luz?
Estou em fase de melhorias ainda do firewall
Segue meu firewall e squid



###########################  FIREWALL    #####################

##############################################################

#Interpretador de comandos

#!/bin/bash

# Carrega os moulos

echo Modulos do firewall

modprobe ipt_string

modprobe ip_tables

modprobe iptable_filter

modprobe ip_conntrack

modprobe ip_conntrack_ftp

modprobe iptable_nat

modprobe ip_nat_ftp

modprobe ipt_LOG

modprobe ipt_state

modprobe ipt_MASQUERADE

#zerando as regras;

echo Regras default

iptables -F INPUT

iptables -F OUTPUT

iptables -F FORWARD

iptables -t nat -F

iptables -t mangle -F

#Alterando a politica das Chains

#Alterando a politica das Chains

iptables -P INPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -P OUTPUT ACCEPT

#iptables -t nat -A POSTROUTING -p tcp -m multiport --dport 25,58215,110,465,587,995 -j MASQUERADE

#skype incoming connections

#iptables -A INPUT -p udp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT

#iptables -A INPUT -p tcp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT

#iptables -A FORWARD -p tcp --dport 39856 -j ACCEPT

#iptables -I FORWARD -m string --algo bm --string "skype.com" -j ACCEPT

#Nat da rede

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

#liberando encaminhamento de pacotes;

echo "1" > /proc/sys/net/ipv4/ip_forward



# Libera o acesso SSH de qualquer origem

echo Liberando acesso SSH

iptables -A INPUT -p tcp --dport 7351 -j ACCEPT

# Libera o squid a partir da rede interna

#echo Liberando rede interna

iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

#Acesso externo Cameras

echo "acesso as cameras"

iptables -A INPUT -i eth0 -p tcp --dport 37777 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 37777 -j ACCEPT

iptables -A INPUT -i eth0 -p udp --dport 37777 -j ACCEPT

iptables -A INPUT -i eth1 -p udp --dport 37777 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.219 --dport 37777 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 37777 -j DNAT --to-destination 192.168.10.90:37777

iptables -A FORWARD -p udp -d 192.168.10.219 --dport 37777 -j ACCEPT

iptables -t nat -A PREROUTING -p udp --dport 37777 -j DNAT --to-destination 192.168.10.219:37777



#liberar acesso externo siga

echo Acesso externo Siga

iptables -A INPUT -i eth0 -p tcp --dport 1257 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.90 --dport 1257 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 1257 -j DNAT --to-destination 192.168.10.90:1257



iptables -A INPUT -i eth0 -p tcp --dport 1299 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.90 --dport 1299 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 1299 -j DNAT --to-destination 192.168.10.90:1299





iptables -A INPUT -i eth0 -p tcp --dport 1256 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.90 --dport 1256 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 1256 -j DNAT --to-destination 192.168.10.90:1256







echo Acesso ao Sql Server

iptables -A INPUT -i eth0 -p tcp --dport 9723 -j ACCEPT

iptables -A INPUT -i eth1 -p udp --dport 9723 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.91 --dport 9723 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 9723 -j DNAT --to-destination 192.168.10.91:1433



#acesso aos servidores via TS

echo Liberando acesso via TS

iptables -A INPUT -i eth0 -p tcp --dport 3390 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.90 --dport 3389 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 3390 -j DNAT --to-destination 192.168.10.90:3389



iptables -A INPUT -i eth0 -p tcp --dport 3391 -j ACCEPT

iptables -A FORWARD -p tcp -d 192.168.10.91 --dport 3389 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 3391 -j DNAT --to-destination 192.168.10.91:3389

#acesso ao BI

echo Liberando Acesso ao BI

iptables -A INPUT -i eth0 -p tcp --dport 7980 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 7980 -j ACCEPT



iptables -A INPUT -i eth0 -p udp --dport 7980 -j ACCEPT

iptables -A INPUT -i eth1 -p udp --dport 7980 -j ACCEPT



iptables -A FORWARD -p tcp -d 192.168.10.91 --dport 7980 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 7980 -j DNAT --to-destination 192.168.10.91:8080



iptables -A FORWARD -p udp -d 192.168.10.91 --dport 7980 -j ACCEPT

iptables -t nat -A PREROUTING -p udp --dport 7980 -j DNAT --to-destination 192.168.10.91:8080



iptables -t nat -A PREROUTING -d 0/0 -p tcp --dport 7980 -j DNAT --to 192.168.10.91:7980



#*************************** BLOQUEIO DO FACEBOOK ***********************************************************

echo "Acesso Facebook"

#BLOQUEIOS FACEBOOK:

hora=`/bin/date +%H%M`

if `[ "$hora" -gt "0759" ] && [ "$hora" -lt "1229" ] || [ "$hora" -gt "1329" ] && [ "$hora" -lt "2359" ] `; then

    op=1;

else

    op=2;

fi

permitidos=$(egrep -v "(^#|^$)" /etc/squid3/regras/ips_fb)  

##BLOQUEIO DO FACEBOOK

FACEBOOK_IP_RANGE="31.13.64.0-31.13.127.255 31.13.24.0-31.13.31.255 74.119.76.0-74.119.79.255 69.63.176.0-69.63.191.255 69.171.224.0-69.171.255.255 66.220.144.0-66.220.159.255 204.15.20.0-204.15.23.255 173.252.64.0-173.252.127.255"

iptables -N FACEBOOK



## FACEBOOK DENY

for face in $FACEBOOK_IP_RANGE; do

    iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range $face --dport 443 -j FACEBOOK

    iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range $face --dport 80 -j FACEBOOK

done



FACEBOOK_ALLOW="$permitidos" #MSR_LIBERADO  #Aqui libera os permitidos.



for MSR_LIBERADO in $FACEBOOK_ALLOW; do

    iptables -I FACEBOOK -s $MSR_LIBERADO -j ACCEPT

done



if [ $op -eq "1" ]; then  

    echo "Bloqueando"

    iptables -A FACEBOOK -j REJECT

fi



if [ $op -eq "2" ]; then  #E caso esteja fora do horÃ¡o de serviÃ§Ã©iberado

    echo "Liberando"

    iptables -A FACEBOOK -j ACCEPT

fi

#****************************************************************************************************************

SQUID

# Portas padrao

acl SSL_ports port 443

acl Safe_ports port 443

#acl Safe_ports port 8080

acl Safe_ports port 80          # http

acl Safe_ports port 21          # ftp

acl Safe_ports port 443         # https

acl Safe_ports port 70          # gopher

acl Safe_ports port 210         # wais

acl Safe_ports port 1025-65535  # unregistered ports

acl Safe_ports port 280         # http-mgmt

acl Safe_ports port 488         # gss-http

acl Safe_ports port 591         # filemaker

acl Safe_ports port 777         # multiling http

acl CONNECT method CONNECT





http_access allow connect SSL_Ports



http_access deny !Safe_ports



http_access deny CONNECT !SSL_ports



#http_access allow localhost manager

#http_access deny manager

acl redelocal src 192.168.10.0/24

#http_access allow redelocal

#http_access deny all



#controle de cache do proxy

cache_mem 32 MB

maximum_object_size_in_memory 64 KB

minimum_object_size 0 KB

maximum_object_size 4096 MB



cache_swap_low 85

cache_swap_high 90

cache_dir ufs /var/spool/squid3 2048 16 256

cache_access_log /var/log/squid3/access.log

#Controle do arquivo de Log

logfile_rotate 10

ftp_user Squid@

#protocolos

refresh_pattern ^ftp: 15 20% 2280

refresh_pattern ^gopher: 15 0% 2280

refresh_pattern . 15 20% 2280

######Block Video and Audio Streaming##############

acl media rep_mime_type video/flv video/x-flv

acl media rep_mime_type -i ^video/

acl media rep_mime_type -i ^video\/

acl media rep_mime_type ^application/x-shockwave-flash

acl media rep_mime_type ^application/vnd.ms.wms-hdr.asfv1

acl media rep_mime_type ^application/x-fcs

acl media rep_mime_type ^application/x-mms-framed

acl media rep_mime_type ^video/x-ms-asf

acl media rep_mime_type ^audio/mpeg

acl media rep_mime_type ^audio/x-scpls

acl media rep_mime_type ^video/x-flv

acl media rep_mime_type ^video/mpeg4

acl media rep_mime_type ms-hdr

acl media rep_mime_type x-fcs

acl mediapr urlpath_regex \.flv(\?.*)?$

acl mediapr urlpath_regex -i \.(avi|mp4|mov|m4v|mkv|flv)(\?.*)?$

acl mediapr urlpath_regex -i \.(mpg|mpeg|avi|mov|flv|wmv|mkv|rmvb)(\?.*)?$









#********************************* GERAL *****************************************

acl ips_geral src "/etc/squid3/regras/geral/ips_liberados"

acl sites_liberados_geral url_regex -i "/etc/squid3/regras/geral/sites_liberados_geral"

acl palavras_bloqueadas url_regex -i "/etc/squid3/regras/geral/palavras_bloqueadas"

acl sites_bloqueados_geral url_regex -i "/etc/squid3/regras/geral/sites_bloqueados_geral"

#************************************************************************************



#********************************* COMERCIAL *****************************************

acl comercial src "/etc/squid3/regras/comercial/ips_comercial"

acl sites_comercial url_regex -i "/etc/squid3/regras/comercial/sites_liberados"



#********************************* COMPRAS *****************************************

acl compras src "/etc/squid3/regras/compras/ips_compras"

acl sites_compras url_regex -i "/etc/squid3/regras/compras/sites_liberados"



#********************************* CTP *****************************************

acl ctp src "/etc/squid3/regras/ctp/ips_ctp"

acl sites_ctp url_regex -i "/etc/squid3/regras/ctp/sites_liberados"



#********************************* FINANCEIRO *****************************************

acl financeiro src "/etc/squid3/regras/financeiro/ips_financeiro"

acl sites_financeiro url_regex -i "/etc/squid3/regras/financeiro/sites_liberados"



#********************************* INSPECAO *****************************************

acl inspecao src "/etc/squid3/regras/inspecao/ips_inspecao"

acl sites_inspecao url_regex -i "/etc/squid3/regras/inspecao/sites_liberados"



#********************************* PRODUCAO *****************************************

acl producao src "/etc/squid3/regras/producao/ips_producao"

acl sites_producao url_regex -i "/etc/squid3/regras/producao/sites_liberados"

#********************************* PCP *****************************************

acl pcp src "/etc/squid3/regras/pcp/ips_pcp"

acl sites_pcp url_regex -i "/etc/squid3/regras/pcp/sites_liberados"



#********************************* RH *****************************************

acl rh src "/etc/squid3/regras/rh/ips_rh"

acl sites_rh url_regex -i "/etc/squid3/regras/rh/sites_liberados"

#********************************* TI *****************************************

acl TI src "/etc/squid3/regras/TI/ips_TI"



acl ips_gestores  src "/etc/squid3/regras/geral/ips_gestores"





acl almoco time MTWHF 12:30-13:30



#CONFIGURACAO DAS ACLS

http_access allow TI

http_access allow ips_geral

http_access allow almoco

http_access allow rh

http_access deny sites_bloqueados_geral

http_access deny mediapr

http_reply_access deny media !TI

http_access allow financeiro

http_access allow compras

http_access allow ctp

http_access allow sites_liberados_geral

http_access allow ips_gestores

http_access allow comercial sites_comercial

http_access allow inspecao sites_inspecao

http_access allow producao sites_producao

http_access allow pcp sites_pcp

#http_access allow redelocal

http_access deny all





log_mime_hdrs on

http_port 3128

#coredump_dir /var/spool/squid3

#refresh_pattern ^ftp:           1440    20%     10080

#refresh_pattern ^gopher:        1440    0%      1440

#refresh_pattern -i (/cgi-bin/|\?) 0     0%      0

#refresh_pattern .               0       20%     4320