Navegaçao as vezes lenta com Squid e Dansguardian

SK5_RJ
(usa Debian)

Enviado em 17/02/2014 - 20:16h

Olá Amigos recentemente eu implementei o Dansguargian e o Squid3(com a ajuda do VOL) na empresa onde eu trabalho e tive resultado bem positivo, porem em alguns momentos a rede da uma parada repentina e volta depois de um tempo.

Dados:
Cerca de 60 micros, link de 120 Mbps
FAst Ethenert ( Chef ainda nao autorizou a compra de Switches gigabits para aproveitarmos 100% do link para navegar) será que da gargalo com a fast Ethernet? algo como paralisar o acesso por instantes...., creio que nao pois utilizávamos anteriormente e nunca ocorreu isto. mas vamos la, abaixo postarei as confs.

Utilizo uma maquina COm 8gb I5 500 HD MOBO GA-B75M-D3h (sei que nao é um server de verdade mas para o que é tem desempenho de sobra).
Bem amigos, onde trabalho é muito corrido e nao tive tempo ainda de vericar logs por log pois tivemos varios acessos indevidos e varios constrangimentos com clientes visualizando(flagrando)pornografia no pc de funcionários entao implementei as pressas, ate entao eu so utilizava o Squid mas adorei as funcionalidades do DG.

Po pessoal alguem ja passou por algo parecido?


DANSGUARDIAN>>>>

#REPORT
reportinglevel = 3

#IDIOMA
languagedir = '/etc/dansguardian/languages'
language = 'ptbrazilian'

#LOGs
loglevel = 3
logexceptionhits = 2
logfileformat = 3

loglocation = '/var/log/dansguardian/access.log'

# Network Settings
filterip = 
filterport = 8080
proxyip = 127.0.0.1
proxyport = 3128

nonstandarddelimiter = on

#IMAGENS BLOQUEADAS
usecustombannedimage = on
custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'

# Filter groups options
filtergroups = 1
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'

# Authentication files location
bannediplist = '/etc/dansguardian/lists/bannediplist'
exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'

#PALAVRAS - PESO
showweightedfound = on
weightedphrasemode = 2

# Positive (clean) result caching for URLs
urlcachenumber = 1000

# Age before they are stale and should be ignored in seconds
urlcacheage = 900

# Clean cache for content (AV) scan results
scancleancache = on

#Smart, Raw and Meta/Title phrase content filtering options
phrasefiltermode = 2

# Lower casing options / 0 = force lower case (default)
preservecase = 0

# Hex decoding options
hexdecodecontent = off

# Force Quick Search rather than DFA search algorithm
forcequicksearch = off

# Reverse lookups for banned site and URLs.
reverseaddresslookups = off

# Reverse lookups for banned and exception IP lists.
reverseclientiplookups = off

# Perform reverse lookups on client IPs for successful requests.
logclienthostnames = off

# Build bannedsitelist and bannedurllist cache files.
createlistcachefiles = on

# POST protection (web upload and forms)
maxuploadsize = -1

# Max content filter size
maxcontentfiltersize = 256

# Max content ram cache scan size
maxcontentramcachescansize = 2000

# Max content file cache scan size
maxcontentfilecachescansize = 20000

# File cache dir
filecachedir = '/tmp'

# Delete file cache after user completes download
deletedownloadedtempfiles = on

# Initial Trickle delay
initialtrickledelay = 20

# Trickle delay
trickledelay = 10

# Download Managers
downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'
downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'

# Content scanner timeout
contentscannertimeout = 60

# Content scan exceptions
contentscanexceptions = off

# Auth plugins
authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'
authplugin = '/etc/dansguardian/authplugins/ip.conf'

# Re-check replaced URLs
recheckreplacedurls = off

# Misc settings
forwardedfor = off
usexforwardedfor = off
logconnectionhandlingerrors = on

# Fork pool options
logchildprocesshandling = off
maxchildren = 120
minchildren = 8
minsparechildren = 4
preforkchildren = 6
maxsparechildren = 32
maxagechildren = 500

# Sets the maximum number client IP addresses allowed to connect at once.
maxips = 0

# IPC filename
ipcfilename = '/tmp/.dguardianipc'

# URL list IPC filename
urlipcfilename = '/tmp/.dguardianurlipc'

# IP list IPC filename
ipipcfilename = '/tmp/.dguardianipipc'

# PID filename
nodaemon = off

# Disable logging process
nologger = off

# Enable logging of "ADs" category blocks
logadblocks = on

# Enable logging of client User-Agent
loguseragent = off

# Soft restart
softrestart = off
 

SQUID3

#------------------------------------------------------------------
acl manager proto cache_object
acl redelocal src 192.168.0.0/24
acl localhost src 127.0.0.1/32
#------------------------------------------------------------------
dns-nameservers 8.8.8.8
dns-nameservers 8.8.4.4
acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl Safe_ports port 5000 # VPN
#------------------------------------------------------------------
acl CONNECT method CONNECT
acl purge method PURGE
#update--------------------------
#acl permitido url_regex -i "/etc/squid3/permitido.txt"
#acl restrito url_regex -i "/etc/squid3/restrito.txt"

#------------------------------------------------------------------
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
#------------------------------------------------------------------
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

#update--------------------

#http_access allow permitido
#http_access deny restrito
#------------------------------------------------------------------
http_access allow redelocal
http_access allow localhost
#------------------------------------------------------------------
http_access deny all
#------------------------------------------------------------------
http_port 3128 intercept
#------------------------------------------------------------------
cache_mem 2000 MB
#------------------------------------------------------------------
maximum_object_size_in_memory 512 KB
#------------------------------------------------------------------
memory_replacement_policy heap GDSF
#------------------------------------------------------------------
cache_replacement_policy heap LFUDA
#------------------------------------------------------------------
cache_dir aufs /var/spool/squid3 40048 16 256
#------------------------------------------------------------------
maximum_object_size 4 GB
minimum_object_size 0 KB

#------------------------------------------------------------------
cache_swap_low 93
cache_swap_high 97
#------------------------------------------------------------------
access_log /var/log/squid3/access.log squid
#------------------------------------------------------------------
cache_store_log none
#------------------------------------------------------------------
mime_table /usr/share/squid3/mime.conf
#------------------------------------------------------------------
cache_log /var/log/squid3/cache.log
#------------------------------------------------------------------
coredump_dir /var/spool/squid3
#------------------------------------------------------------------
refresh_pattern ^ftp:            1440   20%   10080
refresh_pattern ^gopher:         1440   0%   1440
refresh_pattern -i (/cgi-bin/|\?)        0   0%   0
refresh_pattern (Release|Packages(.gz)*)$   0   20%     2880
refresh_pattern .             0   20%   4320
refresh_pattern -i \.(gif|png|jpg|jpeg|ico|bmp)$ 260000 90% 260009 override-expire
refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv|mpg|wma|ogg|wmv|asx|asf)$ 260000 90% 260009  override-expire
refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff|pdf|uxx)$ 260000 90% 260009 override-expire
refresh_pattern -i \.index.(html|htm)$ 1440 90% 40320
refresh_pattern -i \.(html|htm|css|js)$ 1440 90% 40320

#fazer cache do windows update
refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern www.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims
refresh_pattern msgruser.dlservice.microsoft.com/.*.(cab|exe|msi) 10080 100% 43200 reload-into-ims 
refresh_pattern download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims
refresh_pattern update.microsoft.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims
#_______________________
cache_mgr ti_01@canadense.com.br
#_______________________
visible_hostname Debianserver
#_______________________
detect_broken_pconn on
#_______________________
global_internal_static on
#_______________________
error_directory /usr/share/squid3/errors/Portuguese
#_______________________
memory_pools on
memory_pools_limit 32 MB
#_______________________
pipeline_prefetch on
#_______________________

 

Parte do IPTABLES

#! /bin/bash
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t mangle -F
modprobe ip_tables
modprobe iptable_nat
modprobe ipt_string

echo "1" > /proc/sys/net/ipv4/ip_forward
#iptables -I FORWARD -m string --algo bm --string "facebook.com" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "facebook.com" -j DROP
#iptables -I FORWARD -m string --algo bm --string "login.live.com" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "login.live.com" -j DROP
#iptables -I FORWARD -m string --algo bm --string "twitter.com" -j DROP
#iptables -I OUTPUT -m string --algo bm --string "twitter.com" -j DROP

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j REDIRECT --to-port 8080
#iptables -A INPUT -p tcp --dport 3128 -i eth2 -j ACCEPT #Proxy
#iptables -A INPUT -p tcp --dport 80 -i eth2 -j ACCEPT #HTTP
#iptables -A INPUT -p tcp --dport 21 -i eth2 -j ACCEPT #FTP
#iptables -A INPUT -p tcp --dport 53 -i eth2 -j ACCEPT #DNS
#iptables -A INPUT -p udp --dport 53 -i eth2 -j ACCEPT #DNS
#iptables -A INPUT -p tcp --dport 25 -i eth2 -j ACCEPT #SMTP
#iptables -A INPUT -p tcp --dport 110 -i eth2 -j ACCEPT #SSL
#iptables -A INPUT -p udp --dport 110 -i eth2 -j ACCEPT #SSL
#iptables -A INPUT -p tcp --dport 80 -i eth2 -j ACCEPT #SSL
##iptables -A INPUT -p udp --dport 80 -i eth2 -j ACCEPT #SSL
#iptables -A INPUT -p tcp --dport 443 -i eth2 -j ACCEPT #SSL
#iptables -A INPUT -p udp --dport 443 -i eth2 -j ACCEPT #SSL

#(tentativa de corrigir o Dansguardian)  iptables -t nat -A PREROUTING -p tcp -m multiport -s 192.168.0.0/24 --dport 3128 -j REDIRECT --to-ports 8080


#iptables -t nat -A PREROUTING -s 192.168.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -s 192.168.0.0/24 -p udp --dport 80 -j REDIRECT --to-port 3128

#iptables -t nat -A PREROUTING -p tcp -m multiport -s 192.168.0.0/24 --dport 3128 -j REDIRECT --to-ports 8080

iptables -A INPUT -i eth2 -p tcp --dport 8080 -j ACCEPT

#iptables -A INPUT -p tcp --dport 10000 -j ACCEPT
iptables -A INPUT -p tcp --dport 4363 -j ACCEPT
 
iptables -A OUTPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -d 192.168.0.0/24 -j ACCEPT
 

#iptables -t filter -A FORWARD -p tcp --dport 8443 -j ACCEPT
#iptables -t filter -A FORWARD -p tcp --dport 443 -j ACCEPT