Iptables não direciona a porta 80 para ip Expecificos , Ajudem por favor !!

scathainfo
(usa Outra)

Enviado em 01/10/2013 - 00:40h

Amigo Boa Noite,
Sou novato no Linux , mas em pouco tempo , já sinto que logo logo vou largar o Windows para mudar de ares , tinha um cliente, que consegui implantar o Squid em um Windows Server 2008 R2 , mas por não ser completo , mesmo assim tinha falhas na rede ( pessoal burlando ) , então resolvi me dedicar ao linux e estou a 4 meses praticamente testando arduamente todos e possíveis serviços que possa fazer o controle de internet.

Como um bom iniciante , li um artigo no viva o linux , de como montar um servidor com DHCP , IPTABLE , SQUID (http://www.vivaolinux.com.br/artigo/Servidor-Debian-6-DHCP-+-Squid-+-IPtables?pagina=1 ) que aproposito , recomendo a todos os inciantes , pois tem o BABA de como se encantar com este sistema , bem consegui tudo até agora , mas estou com um problema , quero que , na rede que eu vá montar , os ips 192.168.0.1 até o 192.168.0.15 não passe pelo proxy , ou seja , que se conectem direto pela porta 80/443 sem ter que configurar o proxy no navegador , consegui fazer estes mesmos ips navegarem sem ter que colocar usuário , mas tenho que setar no windows para buscar o proxy , vou deixar abaixo o meu squid.conf e o meu firewall.sh para analisarem e se puderem me ajudar , eu agradeço.



SQUID.CONF ( Versão do Squid 3 )




#############################################
# PORTA
#############################################


http_port 3128 transparent



#############################################
# ESQUEMA AUTENTICACAO
#############################################



# ******************************** IP LIBERADO


acl ip_liberados src "/etc/squid3/acls/ip_liberados"
http_access allow ip_liberados




auth_param basic program /usr/lib/squid3/ncsa_auth /etc/squid3/passwd
auth_param basic children 50
auth_param basic realm Scatha Informatica
auth_param basic credentialsttl 2 hour
auth_param basic casesensitive off
visible_hostname Servidor Internet
cache_mgr scathainfo@gmail.com


hierarchy_stoplist cgi-bin ?
cache_mem 1000 MB
maximum_object_size_in_memory 64 KB
maximum_object_size 1000 MB
cache_dir ufs /var/spool/squid3 2040 16 256

refresh_pattern ^ftp: 360 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

access_log /var/log/squid3/access.log


acl usuarios proxy_auth REQUIRED



#############################################
# PAGINA DE ERRO EM PORTUGUES
#############################################



error_directory /usr/share/squid3/errors/pt-br




#############################################
# PADRÃO SQUID
#############################################



acl localhost src 127.0.0.1/32
acl localnet src 192.168.0.0/24

acl purge method PURGE
acl Safe_ports port 21 # ftp
acl Safe_ports port 80 # http
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 443 # https
acl Safe_ports port 563 # mntps
acl Safe_ports port 633 # cups
acl Safe_ports port 22 # SSH
acl Safe_ports port 4899 # RADMIN
acl Safe_ports port 3389 # TERMINAL SERVICE
acl Safe_ports port 5405 # NET SUPORTT
acl Safe_ports port 443 # https
acl Safe_ports port 10000 # WebAdmin
acl Safe_ports port 9090 # Bate Papo Interno
acl Safe_ports port 10000 # WebAdmin


acl connect method CONNECT



#############################################
# ESQUEMA DE CONTROLE POR GRUPOS DE USUARIOS
#############################################





# ******************************** USUARIOS ADMINISTRADORES



acl usr_adm proxy_auth src "/etc/squid3/grupos/adm/usr_adm"




# ********************************* USUARIOS LIMITADO



acl usr_limit proxy_auth src "/etc/squid3/grupos/limit/usr_limit
acl sites_limit url_regex -i src "/etc/squid3/grupos/limit/sites_limit"
acl sites_proib_limit url_regex -i src "/etc/squid3/grupos/limit/sites_proib_limit"



# ******************************** USUARIOS PADRÃO


acl usr_padrao proxy_auth src "/etc/squid3/grupos/padrao/usr_padrao"
acl sites_padrao url_regex -i src "/etc/squid3/grupos/padrao/sites_padrao"




##################################
# ESQUEMA DE CONTROLE DE BLOQUEIO
##################################


# ******************************** LIBERADO


acl liberado url_regex -i src "/etc/squid3/acls/liberado"



# ******************************** SITES LIBERADOS


acl sites_liberados dstdomain src "/etc/squid3/acls/sites_liberados"




# ******************************** SITES BLOQUEADOS


acl sites_bloqueados dstdomain src "/etc/squid3/acls/sites_bloqueados"




# ******************************** PALAVRAS


acl palav_proib url_regex -i src "/etc/squid3/acls/palavras_proibidas"




# ******************************** DOWNLOADS


acl downloads urlpath_regex -i src "/etc/squid3/acls/downloads"




# ******************************** GTALK


acl gtalk dstdomain src "/etc/squid3/acls/gtalk"



# ******************************** STREAMING


acl streaming rep_mime_type src "/etc/squid3/acls/streaming"



# ******************************** VIDEO ONLINE


acl video_online urlpath_regex -i src "/etc/squid3/acls/video_online"



# ******************************** MUSICA ONLINE


acl musica_online urlpath_regex -i src "/etc/squid3/acls/musica_online"



# ************************************************************ MEDIA PLAYER MMS Protocol

acl media rep_mime_type mms
acl mediapr url_regex dvrplayer mediastream ^mms://
acl media rep_mime_type x-ms-asf
acl mediapr1 urlpath_regex \.(afx|asf)(\?.*)?$

# ************************************************************ FLASH VIDEO Format

acl media rep_mime_type video/flv video/x-flv
acl mediapr2 urlpath_regex \.flv(\?.*)?$


# ************************************************************ Others currently unknown

acl media rep_mime_type ms-hdr
acl media rep_mime_type x-fcs




http_access allow usr_adm all
http_access deny mediapr
http_access deny sites_proib_limit
http_access allow liberado
http_access deny mediapr1
http_access allow sites_liberados
http_access deny mediapr2
http_access deny sites_bloqueados
http_access deny gtalk
http_reply_access deny media
http_access deny downloads
http_access deny palav_proib
http_access deny musica_online
http_reply_access deny streaming
http_access deny video_online
http_access allow usr_padrao !palav_proib !downloads !video_online !streaming !musica_online !mediapr !mediapr1 !mediapr2 !media !gtalk !sites_bloqueados
http_access allow liberado !palav_proib !downloads !video_online !streaming !musica_online !mediapr !mediapr1 !mediapr2 !media !sites_bloqueados
http_access deny usr_limit all !sites_limit
http_access deny purge
http_access deny !Safe_ports




IPTABLES ( ARQUIVO FIREWALL.SH )


! /bin/bash



################################################ LIMPANDO REGRAS DO FIREWALL

iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT


################################################ REGRAS PARA FIREWALL

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t mangle -F
iptables -A INPUT
iptables -A OUTPUT
iptables -A FORWARD
iptables -I INPUT
iptables -I OUTPUT
iptables -I FORWARD


################################################ ADICIONANDO MODULO NO KERNEL


modprobe ip_tables
modprobe iptable_nat
modprobe ipt_string



################################################ COMPARTILHANDO A INTERNET


echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE



################################################ IP LIBERADOS DO PROXY



iptables -A FORWARD -p tcp --dport 80 -m iprange --src-range 192.168.0.1-192.168.0.15 -j ACCEPT


iptables -A FORWARD -s 192.168.0.1 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -s 192.168.0.1 -j RETURN

iptables -A FORWARD -s 192.168.0.2 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -s 192.168.0.2 -j RETURN





################################################ PORTAS / PROGRAMAS PADRÕES DA REDE



# NAGIOS ( MONITORAMENTO DE SISTEMAS / MAQUINAS )

iptables -A FORWARD -p tcp --dport 5666 -j ACCEPT
iptables -A FORWARD -p tcp --sport 5666 -j ACCEPT


# DNS

iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp --sport 53 -j ACCEPT


# TERMINAL SERVICE

iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
iptables -A FORWARD -p tcp --sport 3389 -j ACCEPT


# TERMINAL SERVICE / ALTERNATIVO

#iptables -A FORWARD -p tcp --dport 3388 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 3388 -j ACCEPT



# POP / IMAP

iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 993 -j ACCEPT
iptables -A FORWARD -p tcp --sport 993 -j ACCEPT


# SMTP

iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 587 -j ACCEPT
iptables -A FORWARD -p tcp --sport 587 -j ACCEPT
iptables -A FORWARD -p tcp --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp --sport 465 -j ACCEPT


# RADMIN

iptables -A FORWARD -p tcp --dport 4899 -j ACCEPT
iptables -A FORWARD -p tcp --sport 4899 -j ACCEPT

#iptables -A FORWARD -p tcp --dport 4898 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 4898 -j ACCEPT


# VNC

#iptables -A FORWARD -p tcp --dport 5900 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 5900 -j ACCEPT


# CUPS ( SERVIDOR DE IMPRESSÃO )

iptables -A FORWARD -p tcp --dport 631 -j ACCEPT
iptables -A FORWARD -p tcp --sport 631 -j ACCEPT


# OPEN FIRE ( BATE PAPO INTERNO )

iptables -A FORWARD -p tcp --dport 9090 -j ACCEPT
iptables -A FORWARD -p tcp --sport 9090 -j ACCEPT


# WEB ADMIN

iptables -A FORWARD -p udp --dport 10000 -j ACCEPT
iptables -A FORWARD -p tcp --sport 10000 -j ACCEPT


# SSH

iptables -A INPUT -p tcp --dport 22 -j ACCEPT


# SQUID

iptables -A FORWARD -p tcp --dport 3128 -j ACCEPT
iptables -A FORWARD -p udp --sport 3128 -j ACCEPT


# INTERNET

iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT



################################################ ENCAMINHAMENTO DE PORTAS / IP



#************ Abre para uma faixa de endereços da rede local

iptables -A INPUT -s 192.168.0.0/255.255.255.0 -j ACCEPT


# Ignora pings

#iptables -A INPUT -p icmp --icmp-type echo-request -j DROP


#************ Contra IP spoofing

echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter


#************ Descarta pacotes malformados


iptables -A INPUT -m state --state INVALID -j DROP



#************ Abre para a interface de loopback

iptables -A INPUT -i lo -j ACCEPT


#************ Impede a abertura de novas conexões, efetivamente bloqueando o acesso
# externo ao seu servidor, com exceção das portas e faixas de endereços
# manualmente especificadas anteriormente. Bloqueia tudo.


iptables -A INPUT -p tcp --syn -j DROP



#************ ENCAMINHAMENTO DE PORTAS PARA UM IP


iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3389 -j DNAT --to-dest 192.168.0.2:3389





################################################ BLOQUEIO DE SITES / DOMINIOS




####### FACEBOOK


#iptables -I FORWARD -m string --algo bm --string "facebook.com" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "facebook.com" -j DROP
#iptables -I FORWARD -m string --algo bm --string "facebook.com.br" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "facebook.com.br" -j DROP
#iptables -I FORWARD -m string --algo bm --string "pt-br.facebook.com" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "pt-br.facebook.com" -j DROP



################################################ ATIVA O PROXY TRANSPARENT




iptables -t nat -A PREROUTING -s eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128


################################################ BLOQUEIO TODO O RESTANTE NÃO CONFIGURADO


iptables -A FORWARD -j REJECT




Amigos , desde já eu agradeço , só consegui chegar até aqui com ajuda de TODOS , meu muito obrigado , e espero um dia poder tambem postar experiencias de como ajudar alguem,

removido
(usa Nenhuma)

Enviado em 01/10/2013 - 02:00h

iptables -t nat -A PREROUTING -d 192.168.0.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:3128

iptables -t nat -A PREROUTING -d 192.168.0.0/24 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.1:3128

scathainfo
(usa Outra)

Enviado em 01/10/2013 - 12:14h

Amigo , devo adicionar estas duas linhas , ou substituir pela :

################################################ ATIVA O PROXY TRANSPARENT




iptables -t nat -A PREROUTING -s eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128


Obrigado

removido
(usa Nenhuma)

Enviado em 01/10/2013 - 18:03h

Substituir!!

192.168.0.1:3128 tem que ser o IP do servidor proxy.