Ajuda no Squid 3!!

cartman2
(usa Debian)

Enviado em 25/06/2011 - 14:41h

E ai pessoal!

Sou novo em linux, e preciso de uma ajuda.
Criei um firewall para compartilhar a internet, e preciso ativar o Squid, porem o iptables funciona normalmente, mas quando ativo o proxu transparente o computador que se conecta ao firewall para de navegar.
Tenho 2 placas de rede, a ETH0 é minha rede interna, e a ETH1 está ligada ao modem.
Estou utilizando o Debian Lenny 6 e Squid3.
Se eu tentar tirar o proxy transparente e colocá-lo manualmente no navegador também nao funciona.

segue o meu script

#------------------------inicio---------------------------

#!/bin/bash

iniciar(){

#carregando modulo no kernel
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat

#compartilhando a conexao
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE

#proxy transparente
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-p ort 3128

#redirecionado para os servidores
#servidor web tomcat
#iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 8080 -j DNAT --to-dest 192.168.1.2
#iptables -A FORWARD -p tcp -i eth2 --dport 8080 -d 192.168.1.2 -j ACCEPT
#servidor web apache
#iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j DNAT --to-dest 1 92.168.1.1
#iptables -A FORWARD -p tcp -i eth2 --dport 80 -d 192.168.1.1 -j ACCEPT

# Acesso TS

iptables -t nat -A PREROUTING -i eth2 -p tcp -m tcp --dport 3389 -j DNAT --t o-destination 192.168.254.1:3389



#permitindo as conexoes na interfce de rede e na porta 22, 21, 80 e 53 deste computador
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth2 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

# Bloqueando MSN
#iptables -A FORWARD -s 192.168.1.0 -p tcp --dport 1863 -j REJECT
#iptables -A FORWARD -s 192.168.1.0 -d loginnet.passport.com -j REJECT


# Protecao diversas
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
iptables -A INPUT -t filter -p icmp --icmp-type echo-reply -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -t filter -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags ALL SYN,ACK,FIN -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A INPUT -m state --state INVALID -j DROP

#Esta regra e a + importante deste firewall,
#bloqueia tudo que nao tenha sido liberado acima
iptables -A INPUT -p tcp --syn -j DROP

echo " "
echo " "
echo "##################################################################"
echo "# Compartilhamento de Internet e Firewall Carregados #"
echo "##################################################################"

}

parar(){
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/tcp_syncookies
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo " "
echo "#############################################################"
echo "# Compartilhamento de Internet e Firewall Parados #"
echo "# Firewall Desativado #"
echo "#-----------------------------------------------------------#"
echo "#############################################################"
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start, stop ou restart"
esac
#------------------------------------fim-------------------------------


E agora o meu Squid:

1 http_port 3128 transparent
2 visible_hostname flexxosrv
3
4 # Configuraç do cache
5 cache_mem 32 MB
6 maximum_object_size_in_memory 64 KB
7 maximum_object_size 380 MB
8 minimum_object_size 0 KB
9 cache_swap_low 90
10 cache_swap_high 95
11 cache_dir ufs /var/spool/squid 2048 16 256
12
13 # Localizaç do log de acessos do Squid
14 cache_access_log /var/log/squid/access.log
15
16 refresh_pattern ^ftp: 15 20% 2280
17 refresh_pattern ^gopher: 15 0% 2280
18 refresh_pattern . 15 20% 2280
19
20 acl all src 0.0.0.0/0.0.0.0
21 acl manager proto cache_object
22 acl localhost src 127.0.0.1/255.255.255.255
23 acl SSL_ports port 443 563
24 acl Safe_ports port 80 # http
25 acl Safe_ports port 21 # ftp
26 acl Safe_ports port 443 563 # https, snews
27 acl Safe_ports port 70 # gopher
28 acl Safe_ports port 210 # wais
29 acl Safe_ports port 1025-65535 # unregistered ports
30 acl Safe_ports port 280 # http-mgmt
31 acl Safe_ports port 488 # gss-http
32 acl Safe_ports port 591 # filemaker
33 acl Safe_ports port 777 # multiling http
34 acl Safe_ports port 901 # SWAT
35 acl purge method PURGE
36 acl CONNECT method CONNECT
37
38 ### Teste ###
39
40 #acl diretoria proxy_auth "/etc/squid/permissoes/diretoria"
41 acl relacionamento url_regex "/etc/squid/permissoes/relacionamento"
42 acl sites_liberados url_regex "/etc/squid/permissoes/sites_liberados"
43 acl sites_bloqueados url_regex "/etc/squid/permissoes/sites_bloqueados"
44 acl palavras_negadas url_regex "/etc/squid/permissoes/palavras_negadas"
45 acl extensoes_liberadas url_regex "/etc/squid/permissoes/extensoes_liberadas"
46 acl extensoes_bloqueadas url_regex "/etc/squid/permissoes/extensoes_bloqueadas"
47 acl dominios_bloqueados dstdom_regex -i "/etc/squid/permissoes/dominios_bloqueados"
48 acl dominios_liberados dstdom_regex -i "/etc/squid/permissoes/dominios_liberados"
49 #acl usuarios_bloqueados proxy_auth "/etc/squid/permissoes/usuarios_bloqueados"
50 acl [*****] url_regex "/etc/squid/permissoes/[*****]"
51
52 ########### RESTRIÃES DE PROXY ######################
53
54 http_access allow manager localhost
55 http_access deny manager
56 http_access allow purge localhost
57 http_access deny purge
58 http_access allow CONNECT
59 http_access allow !SSL_ports !Safe_ports
60 http_access allow localhost
61
62 #http_access allow diretoria
63 http_access allow sites_liberados
64 http_access allow extensoes_liberadas
65 http_access allow dominios_liberados
66 http_access deny relacionamento
67 http_access deny sites_bloqueados
68 http_access deny palavras_negadas
69 http_access deny extensoes_bloqueadas
70 http_access deny dominios_bloqueados
71 #http_access deny usuarios_bloqueados
72 http_access deny [*****]
73 #http_access allow ProxyUsers ..> ACL de usuario autenticados no AD
74 http_access deny all
75
76 #icp_access allow localnet
77 #icp_access deny all
78
79 ###########################################################################
80
81 access_log /var/log/squid/access.log squid
82 logfile_rotate 10
83 error_directory /usr/share/squid/errors/Portuguese
84 hosts_file /etc/hosts
85 coredump_dir /var/spool/squid
86 dns_nameservers 192.168.254.1
87
88 ### FINAL Teste ###
89
90
91 #http_access allow manager localhost
92 #http_access deny manager
93 #http_access allow purge localhost
94 #http_access deny purge
95 #http_access deny !Safe_ports
96 #http_access deny CONNECT !SSL_ports
97
98 # Libera acessos na hora do almoçacl almoco time 12:00-14:00
99 #acl almoco time 19:00-21:00
100 #http_access allow almoco
101
102 # Libera acessos na hora do almoçacl almoco time 12:00-14:00
103 # http_access allow almoco
104
105 # Filtros por palavras e por dominios
106 #acl proibidos dstdom_regex "/etc/squid/permissoes/proibidos"
107 #http_access deny proibidos
108 #acl bloqueados dstdomain orkut.com www.orkut.com playboy.abril.com.br
109 #http_access deny bloqueados
110
111
112
113 # Libera para a rede local
114 #acl redelocal src 192.168.5.0/24
115 #http_access allow localhost
116 #http_access allow redelocal
117
118 # Bloqueia acessos externos
119 http_access deny all



Se puderem me dar alguma dica ficarei muito agradecido!

Abraço!