Fazer Skype Funcionar

ricardoartemis
(usa Outra)

Enviado em 09/11/2016 - 19:07h

Olá,
Estou tendo dificuldades em conectar o Skype. Quando eu utilizo um IP que passa por fora do Squid e desmarco no I.E. "Usar proxy", o Skype conecta. Quando eu uso um IP que passa por dentro do Squid, fica falando que está sem acesso à internet, sendo que eu acesso páginas da web sem problema.
Abaixo nosso Squid.conf:
http_port 3128
icp_port 3130
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
cache_mem 128 MB
maximum_object_size 40 MB
cache_dir ufs /pernalonga/squid/spool 4096 16 256
access_log /pernalonga/squid/logs/access.log squid
cache_log /var/log/squid/cache.log
pid_filename /var/run/squid.pid

auth_param basic program /usr/lib/squid/squid_db_auth
auth_param basic children 90
auth_param basic realm Nilko - Controle de Acesso
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

refresh_pattern ^ftp: 15 20% 1440
refresh_pattern ^gopher: 15 0% 1440
refresh_pattern . 0 20% 1440

acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl webserver src 192.168.0.232
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#acl IpLiberado src "/etc/squid/regras/ipliberado.txt"

# Regras Nilko
acl RedeInterna src 192.168.0.0/22
acl Autenticacao proxy_auth REQUIRED
acl BloqueiaWebmail url_regex -i "/etc/squid/regras/bloqueiowebmail.txt"
acl BloqueiaDominioWebmail dstdomain "/etc/squid/regras/bloqueiowebmail.txt"
acl BloqueiaMsn url_regex -i "/etc/squid/regras/bloqueiomsn.txt"
acl BloqueiaDominioMsn dstdomain "/etc/squid/regras/bloqueiomsn.txt"
acl BloqueiaTudo url_regex -i "/etc/squid/regras/bloqueio.txt"
acl BloqueiaDominio dstdomain "/etc/squid/regras/bloqueio.txt"
acl BloqueiaGTalk url_regex -i "/etc/squid/regras/bloqueiogtalk.txt"
acl BloqueiaOrkut url_regex -i "/etc/squid/regras/bloqueioorkut.txt"
acl BloqueiaDominioOrkut dstdomain -i "/etc/squid/regras/bloqueioorkut.txt"
acl BloqueiaYoutube url_regex -i "/etc/squid/regras/bloqueioyoutube.txt"
acl BloqueiaDominioYoutube dstdomain -i "/etc/squid/regras/bloqueioyoutube.txt"
acl BloqueiaMidiaSocial url_regex -i "/etc/squid/regras/bloqueiomidiasocial.txt"
acl BloqueiaDominioMidiaSocial dstdomain -i "/etc/squid/regras/bloqueiomidiasocial.txt"
acl UsuariosLiberados proxy_auth "/etc/squid/regras/usuarios_liberados.txt"
acl UsuariosVideo proxy_auth "/etc/squid/regras/usuarios_video.txt"
acl UsuariosYoutube proxy_auth "/etc/squid/regras/usuarios_youtube.txt"
acl UsuariosMidiaSocial proxy_auth "/etc/squid/regras/usuarios_midiasocial.txt"
acl UsuariosMsn proxy_auth "/etc/squid/regras/usuarios_msn.txt"
acl UsuariosForaExpediente proxy_auth "/etc/squid/regras/usuarios_fora_expediente.txt"
acl Usuarios11 proxy_auth "/etc/squid/regras/usuarios_almoco_11.txt"
acl Usuarios1115 proxy_auth "/etc/squid/regras/usuarios_almoco_11_15.txt"
acl HorarioLiberado time MTWHFA 12:00-13:00
acl HorarioLiberado11 time MTWHFA 11:00-12:00
acl HorarioLiberado1115 time MTWHFA 11:15-12:15
acl ForaExpediente time MTWHFA 07:00-18:00
acl ExpedienteSemana time MTWHFA 07:00-17:30
acl SitesIrrestritos url_regex -i "/etc/squid/regras/liberado.txt"
acl Mult urlpath_regex .mp3$ .asfv$ .mpeg$ .mpg$ .mov$ .avi$ .asf$ .wmv$ .ra$ .rm$ .ram$ .asx$ .afx$ .divx$ .m3u$ .flv$
acl Mult2 urlpath_regex .pif$ .bat$ .asfv1
acl MimeProibe rep_mime_type "/etc/squid/regras/mimeproibe.txt"
acl MimeProibe2 req_mime_type "/etc/squid/regras/mimeproibe.txt"
acl NoFiles urlpath_regex -i (mp3|avi|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|asfv1|divx|m3u|flv)$
acl BlockExe urlpath_regex -i (pif|bat)($|\?)
acl numeric_IPs urlpath_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
acl Nilko dstdomain .nilko.com.br
acl liberaSkype dstdom_regex skype.com

http_access allow manager localhost
http_access allow manager webserver
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

always_direct allow Nilko

http_access allow localhost
http_access allow SitesIrrestritos
http_access allow RedeInterna UsuariosLiberados
http_access allow BloqueiaMsn UsuariosMsn
http_access allow BloqueiaYoutube UsuariosYoutube
http_access allow BloqueiaOrkut UsuariosMidiaSocial
http_access allow liberaSkype

http_access deny BloqueiaMsn
http_access deny BloqueiaOrkut
http_access deny BloqueiaYoutube
http_access deny BloqueiaGTalk
http_access deny BloqueiaWebmail
http_access deny BloqueiaTudo

http_access allow RedeInterna UsuariosForaExpediente ForaExpediente
http_access allow RedeInterna Autenticacao ExpedienteSemana
http_access deny all

http_reply_access allow all
icp_access allow all
cache_mgr informatica@nilko.com.br
cache_effective_user squid
cache_effective_group squid
httpd_suppress_version_string off
visible_hostname nilko.com.br
log_icp_queries on
error_directory /usr/share/squid/errors/pt-br
coredump_dir /var/spool/squid

E nosso Iptables:

#!/bin/bash

IF_EXT=eth3
IF_INT=eth1

# Zera regras
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle

# Definindo a politica das chains
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Filtros - DROP nos pacotes
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn:"
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

# Libera pacotes de retorno da Internet
iptables -A INPUT ! -i $IF_EXT -j ACCEPT
#iptables -A INPUT -i $IF_EXT -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

# Liberando Samba
#iptables -I INPUT -p tcp -s 192.168.0.0/22 -d 192.168.0.240 --dport 137 -j ACCEPT
#iptables -I INPUT -p tcp -s 192.168.0.0/22 -d 192.168.0.240 --dport 138 -j ACCEPT
#iptables -I INPUT -p tcp -s 192.168.0.0/22 -d 192.168.0.240 --dport 139 -j ACCEPT
#iptables -I INPUT -p tcp -s 192.168.0.0/22 -d 192.168.0.240 --dport 445 -j ACCEPT


# Libera Conectividade Social
#iptables -t nat -A PREROUTING -p tcp -d 200.201.173.68 --dport 80 -j DNAT --to 200.201.173.68:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.201.173.68/32 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 200.201.166.200 --dport 80 -j DNAT --to 200.201.166.200:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.201.166.200/32 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 200.201.174.207 --dport 80 -j DNAT --to 200.201.174.207:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.201.174.207/32 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 200.201.174.204 --dport 80 -j DNAT --to 200.201.174.204:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.201.174.204/32 --dport 80 -j ACCEPT
#iptables -I FORWARD -p all -s 200.201.174.0/24 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 200.201.174.0/24 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 200.201.174.0/24 -d 192.168.0.0/22 -j ACCEPT

# Rais
#iptables -A FORWARD -s 192.168.0.0/22 -d 161.148.173.128 -p tcp -m multiport --dport 80,443 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -d 161.148.173.128 -p tcp --dport 443 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -d 161.148.174.240 -p tcp -m multiport --dport 80,443 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -d 161.148.174.241 -p tcp -m multiport --dport 80,443 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp -d 161.148.173.128 --dport 80 -j DNAT --to 161.148.173.128:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.173.128 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 161.148.173.128 --dport 443 -j DNAT --to 161.148.173.128:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.173.128 --dport 443 -j ACCEPT
#iptables -I FORWARD -p all -s 161.148.173.128 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 161.148.173.128 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 161.148.173.128 -d 192.168.0.0/22 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp -d 161.148.174.240 --dport 80 -j DNAT --to 161.148.174.240:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.174.240 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 161.148.174.240 --dport 443 -j DNAT --to 161.148.174.240:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.174.240 --dport 443 -j ACCEPT
#iptables -I FORWARD -p all -s 161.148.174.240 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 161.148.174.240 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 161.148.174.240 -d 192.168.0.0/22 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp -d 161.148.174.241 --dport 80 -j DNAT --to 161.148.174.241:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.174.241 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 161.148.174.241 --dport 443 -j DNAT --to 161.148.174.241:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 161.148.174.241 --dport 443 -j ACCEPT
#iptables -I FORWARD -p all -s 161.148.174.241 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 161.148.174.241 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 161.148.174.241 -d 192.168.0.0/22 -j ACCEPT

#Libera consulta Extranet - Migrate
#iptables -t nat -A PREROUTING -p tcp -d extranet.migrate.com.br --dport 80 -j RETURN
#iptables -t nat -A PREROUTING -p tcp -d extranet.migrate.com.br --dport 443 -j RETURN
#iptables -t nat -A PREROUTING -p tcp -d licencas.gnfe.com.br --dport 80 -j RETURN
#iptables -t nat -A PREROUTING -p tcp -d licencas.gnfe.com.br --dport 443 -j RETURN
#iptables -t nat -A PREROUTING -d fazenda.pr.gov.br -p tcp -m multiport --dport 80,443 -j ACCEPT
#iptables -t nat -A PREROUTING -d extranet.migrate.com.br -p tcp -m multiport --dport 80,443 -j ACCEPT
#iptables -t nat -A PREROUTING -d licencas.gnfe.com.br -p tcp -m multiport --dport 80,443 -j ACCEPT

#iptables -t nat -A PREROUTING -d nfe.fazenda.pr.gov.br -p tcp -m multiport --dport 80,443 -j ACCEPT
# Libera Ativacao do windows e do office
#iptables -t nat -A PREROUTING -p tcp -d 207.46.19.190 --dport 80 -j DNAT --to 207.46.19.190:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 207.46.19.190 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 207.46.19.190 --dport 443 -j DNAT --to 207.46.19.190:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 207.46.19.190 --dport 443 -j ACCEPT
#iptables -I FORWARD -p all -s 207.46.19.190 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 207.46.19.190 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 207.46.19.190 -d 192.168.0.0/22 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp -d 207.46.245.222 --dport 80 -j DNAT --to 207.46.245.222:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 207.46.245.222 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 207.46.245.222 --dport 443 -j DNAT --to 207.46.245.222:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 207.46.245.222 --dport 443 -j ACCEPT
#iptables -I FORWARD -p all -s 207.46.245.222 -d 192.168.0.0/22 -j ACCEPT
#iptables -I OUTPUT -p all -s 207.46.245.222 -d 192.168.0.0/22 -j ACCEPT
#iptables -I INPUT -p all -s 207.46.245.22 -d 192.168.0.0/22 -j ACCEPT

# Libera Bradesco
#iptables -t nat -A PREROUTING -p tcp -d 200.155.84.59 --dport 80 -j DNAT --to 200.155.84.59:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.155.84.59 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 209.155.84.59 --dport 443 -j DNAT --to 200.155.84.59:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.155.84.59 --dport 443 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 200.155.80.59 --dport 80 -j DNAT --to 200.155.80.59:80
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.155.80.59 --dport 80 -j ACCEPT
#iptables -t nat -A PREROUTING -p tcp -d 209.155.80.59 --dport 443 -j DNAT --to 200.155.80.59:443
#iptables -I FORWARD -p tcp -s 192.168.0.0/22 -d 200.155.80.59 --dport 443 -j ACCEPT

#iptables -A FORWARD -s 192.168.0.0/22 -p tcp -d extranet.migrate.com.br --dport 80 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -p tcp -d extranet.migrate.com.br --dport 443 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -p tcp -d licencas.gnfe.com.br --dport 80 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -p tcp -d licencas.gnfe.com.br --dport 443 -j ACCEPT
#iptables -A FORWARD -s 192.168.0.0/22 -p tcp -d nfe.fazenda.pr.gov.br --dport 443 -j ACCEPT


# Redirecionamentos
iptables -I INPUT -p tcp -s 0/0 -d 187.32.212.49 --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -d 187.32.212.49 -p tcp --dport 3389 -j DNAT --to-destination 192.168.0.141:3389
# Liberando Portas (Forward)
# Portas: (25-Smtp 110-Pop3 8017-ValidaPr 5017-Cat 2631-Conectividade Social 3456-ReceitaNet)
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 587 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 211 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 3121 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 8017 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 5017 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 2631 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 3007 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 3389 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 3456 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 8543 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp --dport 18241 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/22 -p tcp -j DROP

# Liberando micro sem proxy
iptables -t nat -A PREROUTING -s 192.168.0.182 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.29 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.27 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.180 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.3.51 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.243 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.1.80 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.1.249 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.1.253 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.110 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.1.46 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.17 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.2.255 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.1.244 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.67 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.36 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.182 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.3.205 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.3.102 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.3.35 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.2.5 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.28 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.143 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.19 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.249 -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -t nat -A PREROUTING -i $IF_INT ! -s 192.168.0.141 -p tcp -m multiport --dport 80,443 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -s 192.168.0.141 -o $IF_EXT -j MASQUERADE

# Redirecionamento do SQUID
#iptables -t nat -A PREROUTING -s 192.168.0.0/22 -p tcp -m multiport --dport 80,443 -j REDIRECT --to-ports 3128


#iptables -t nat -A PREROUTING -i $IF_EXT -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.141:3389
# Liberando portas (via nat)
#iptables -t nat -A POSTROUTING -s 192.168.0.0/22 -d 0/0 -p tcp --dport 110 -j MASQUERADE

# Mascarando a rede e liberando Forward
iptables -A POSTROUTING -t nat -o $IF_EXT -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward

stefaniobrunhara
(usa CentOS)

Enviado em 09/11/2016 - 21:39h

Estou com este problema no Skype, porém meu squid é 3 com certificado, estou chegando na conclusão que o squid3 não funciona 100% somente com o squid, vou precisar da NAT para algumas rede da Microsoft.



Tente colocar o connect primeiro de tudo

http_access deny CONNECT !SSL_ports
http_access allow manager localhost
http_access allow manager webserver
http_access deny manager
http_access deny !Safe_ports

ricardoartemis
(usa Outra)

Enviado em 10/11/2016 - 10:32h

Será que colocando o CONNECT por primeiro não vai acabar liberando tudo na porta 443? Eu gostaria de liberar só o Skype nesta porta e bloquear o resto. Sou iniciante no Squid. Para as alterações entrarem em vigor devo dar o comando "service squid restart"?

drferumbras
(usa CentOS)

Enviado em 11/11/2016 - 13:55h

Aqui estava com o mesmo problema na questão de portas.
Optei por abandonar todos os clientes de skype e utilizar o Skype for Web.
Adicionei o domínio na ACL e sem dor de cabeças, além de poupar recurso da máquina, pois o cliente do Skype é muito lagado.

stefaniobrunhara
(usa CentOS)

Enviado em 11/11/2016 - 18:14h

não, a linha http_access deny CONNECT !SSL_ports vai negar todas as conexões exceto as porta SSL_port, mas a sugestão e como teste, primeiro você faz funcionar, depois você confere a seguração.