Portas liberadas falham e não redireciona squid [RESOLVIDO]
1. Portas liberadas falham e não redireciona squid [RESOLVIDO]
kakashi963
(usa Debian)
Enviado em 15/04/2011 - 17:25h
Boa tarde!Gente meu iptables está louco!
Redireciono tudo da porta 80 para 3128, e adicionei a linha "transparent" no meu squid, mas ainda preciso colocar o ip do servidor no navegador, senão a internet não funciona!
E as portas que libero, elas não ficam liberadas mesmo....
Abaixo as minhas configurações:
iniciar(){
##### Carregando modulos
modprobe iptable_nat
echo "LEVANTANDO FIREWALL"
##### Compartilhando a conexao
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -i lo -j ACCEPT
##### Portas abertas
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 10081 -j ACCEPT
iptables -A INPUT -p tcp --dport 10009 -j ACCEPT
iptables -A INPUT -p tcp --dport 10060 -j ACCEPT
iptables -A INPUT -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp --dport 137 -j ACCEPT
iptables -A INPUT -p tcp --dport 9100 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
##### Regras gerais para output
iptables -P OUTPUT -j ACCEPT
##### Abre para rede local
iptables -A INPUT -p tcp --syn -s 192.168.0.0/255.255.255.0 -j ACCEPT
##### Mantendo conexao
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
##### regra forward
iptables -A FORWARD -s 0/0 -d 0/0 -m tcp -m multiport -p tcp --dports 135,445 -j REJECT
##### Fechando ICMP
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
##### Fechando origens desconhecidas
iptables -I INPUT -p ALL -s 109.230.220.33 -j DROP
iptables -I INPUT -p ALL -s 118.160.210.106 -j DROP
iptables -I INPUT -p ALL -s 94.178.94.147 -j DROP
iptables -I INPUT -p ALL -s 122.124.157.157 -j DROP
iptables -I INPUT -p ALL -s 93.63.185.90 -j DROP
iptables -I INPUT -p ALL -s 210.216.169.105 -j DROP
iptables -I INPUT -p ALL -s 175.180.183.42 -j DROP
iptables -I OUTPUT -p ALL -s 109.230.220.33 -j DROP
iptables -I OUTPUT -p ALL -s 210.216.169.105 -j DROP
iptables -I OUTPUT -p ALL -s 93.63.185.90 -j DROP
iptables -I OUTPUT -p ALL -s 118.160.210.106 -j DROP
iptables -I OUTPUT -p ALL -s 94.178.94.147 -j DROP
iptables -I OUTPUT -p ALL -s 122.124.157.157 -j DROP
iptables -I OUTPUT -p ALL -s 175.180.183.42 -j DROP
iptables -A INPUT -p ALL -s 200.205.146.54 -j ACCEPT
iptables -A OUTPUT -p ALL -s 200.205.146.54 -j ACCEPT
##### Fechando portas UDP
iptables -A INPUT -p udp --dport 0:1023 -j DROP
##### Fecha todo o resto
iptables -A INPUT -p tcp --syn -j DROP
}
parar(){
iptables -F
iptables -F -t nat
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start, stop ou restart"
--------------------------Configuração squid
http_port 3128 transparent
visible_hostname servTemp
cache_mem 400 MB
maximum_object_size_in_memory 300 KB
maximum_object_size 100 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 2048 16 256
cache_access_log /var/log/squid/access.log
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 901 # swat
acl Safe_ports port 25 # email
acl Safe_ports port 1025-65535 # portas altas
acl purge method PURGE
acl CONNECT method CONNECT
acl palavrasBloqueadas dstdom_regex "/etc/squid/palavrasBloqueadas"
acl sitesLiberados url_regex -i "/etc/squid/tudolinha.txt"
acl ipsLiberados src "/etc/squid/ipsLiberados"
acl ipsLiberadosRestritos src "/etc/squid/ipsLiberadosRestritos"
acl sitesBloqueados url_regex -i "/etc/squid/sitesBloqueados"
acl epharma src 200.205.146.54
#http_access deny extban
http_access allow epharma
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# delay_pools 1
# delay_class 1 2
# delay_parameters 1 200000/200000 20384/20348
http_access allow ipsLiberados
http_access deny palavrasBloqueadas
http_access deny sitesBloqueados
http_access allow ipsLiberadosRestritos
http_access allow sitesLiberados
http_access deny all