Squid/Iptables Autentica mas não navega.
1. Squid/Iptables Autentica mas não navega.
paulinhooo
(usa CentOS)
Enviado em 16/02/2016 - 13:05h
Ola amigos.Uso Squid/iptables a anos, porém recentemente venho encontrando o mesmo problema nos meus Servidores Proxy.
Sem nenhuma alteração, os servidores que estavam funcionando, param, posso formatar, reinstalar do zero e não funciona.
Pede autenticação, coloco usuário e senha e ai ele não navega. fica tentando navegar e não sai dali, os únicos sites que ele abriu, foi o da Receita federal e do Logmein.
Já fiz de tudo, mas não consigo resolver.
Quando libero o IP de uma determinada maquina no iptables, ela navega sem problemas, mas quando coloco para autenticar, não navega. Após alguns segundos.. Ele mostra "esperando-pelo-tunel-de-proxy" e ali fica ate retornar com timeout.
Versão do SQUID: squid-3.2.13-1
S.O. CENTOS6.5 ou FEDORA18
Versão IPTABLES: iptables-1.4.16.2-5
ALGUÉM... PELO AMOR DE DEUS.. ME AJUDA!!!
ABSSS
Meu Squid:
#Host
visible_hostname "proxy.cliente.com.br"
#Auth Basic
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/password/passwd
auth_param basic children 5
auth_param basic realm Cliente Proxy Server
auth_param basic credentialsttl 2 hour
auth_param basic casesensitive off
#Autenticacao requerida
acl ncsa_users proxy_auth REQUIRED
acl SSL_ports port 443 563 442
acl Safe_ports port 83 # prefeitura
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 442 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl muser max_user_ip -s 1
acl ip_liberado src 10.0.0.1
acl squidprefetch src 127.0.0.1
#
# Recommended minimum Access Permission configuration:
acl p1 proxy_auth "/etc/squid/users/p1_usuarios"
acl p2 proxy_auth "/etc/squid/users/p2_usuarios"
acl p3 proxy_auth "/etc/squid/users/p3_usuarios"
acl p4 proxy_auth "/etc/squid/users/p4_usuarios"
#acl p6 proxy_auth "/etc/squid/users/p6_usuarios"
#Regras de Acesso
acl geral_liberado url_regex "/etc/squid/regras/geral_liberado"
acl geral_proibido url_regex "/etc/squid/regras/geral_proibido"
acl p1_proibido url_regex "/etc/squid/regras/p1_proibido"
acl p2_proibido url_regex "/etc/squid/regras/p2_proibido"
acl p3_proibido url_regex "/etc/squid/regras/p3_proibido"
acl p4_proibido url_regex "/etc/squid/regras/p4_proibido"
#acl p6_permtido url_regex "/etc/squid/regras/p6_permitido"
acl webproxies url_regex "/etc/squid/regras/webproxies"
acl semcache url_regex -i "/etc/squid/regras/semcache"
acl msn_dst dstdomain loginnet.passport.com
#Sites que passam por fora do Proxy
acl msn_url url_regex -i tjsp.jus.br receita.fazenda.gov.br indisponibilidade.org.br http://scim.geometrus.com.br:83/mctm_isti/add">http://scim.geometrus.com.br:83/mctm_isti/add scim.geometrus.com.br safebrowsing.google.com clients2.google.com google.com verisign.com ocsp.verisign.com csc3-2009-2-crl.verisign.com javadl-esd.sun.com sun.com java.com windowsupdate.com www.extrajudicial.tjsp.jus.br:443 dnl-01.geo.kaspersky.com www.santandernet.com.br:443 www.bancoreal.com.br http://www.santander.com.br http://sqm.microsoft.com/sqm/ie/sqmserver.dll http://www010.dataprev.gov.br http://cdn1.certified-apps.com http://loading.widdit.com aplicacao2.jt.jus.br gateway.dll http://www.r2learning.com.br http://streaming05.maxcast.com.br/player/ticomachado streaming05.maxcast.com.br mail.yahoo.com br.yahoo.com www4.prefeitura.sp.gov.br/certidao/certidao.asp secure.logmein.com http://www.terra.com.br/portal http://p2.trrsf.com.br p1.trrsf.com.br trrsf.com.br s1.trrsf.com.br scim.geometrus.com.br:83/ct98 scim.geometrus.com.br http://scim.geometrus.com.br ad.doubleclick.net http://mail.mailig.ig.com.br/mail/? mail.mailig.ig.com.br/mail http://obsupgdp.caixa.gov.br/cns/empresa">http://obsupgdp.caixa.gov.br/cns/empresa obsupgdp.caixa.gov.br/cns/empresa http://obsupgdp.caixa.gov.br kaspersky.com http://control.app02-10.logmein.com:443/ control.app02-10.logmein.com:443/ logmein.com:443/ secure.logmein.com content.logmein.com:443 control.app02.logmein.com:443 logmein.com http://bb.cruzeirodosulvirtual.com.br/webapps/portal/frameset.jsp
acl receita url_regex ^www.receita.fazenda.gov.br/$ globo.com ^www.globo.com/$
no_cache deny receita
acl msn_mim req_mime_type -i ^application/x-msn-messenger$
acl msn_mim req_mime_type -i ^application/x-msn-messenger$
acl p5 proxy_auth "/etc/squid/users/p5a_usuarios"
acl p5_liberado url_regex "/etc/squid/regras/p5_liberado"
acl p6_permitido url_regex "/etc/squid/regras/p6_liberado"
#Gerenciando Regras
http_access allow msn_url
http_access allow p1 !geral_proibido !p1_proibido
http_access allow p2 !geral_proibido !p2_proibido
http_access allow p4 !p4_proibido
http_access allow p3
http_access allow ip_liberado p3 !p3_proibido
#
# Only allow cachemgr access from localhost
#http_access allow p6 p6_permitido
http_access allow localhost manager
# Deny requests to certain unsafe ports
http_access deny manager
# Deny CONNECT to other than secure SSL ports
http_access deny !Safe_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access deny CONNECT !SSL_ports
#http_access allow ncsa_users
# And finally deny all other access to this proxy
http_access allow localhost
http_access deny all
# Squid normally listens to port 3128
http_port 3128
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_effective_user squid
cache_effective_group squid
Meu Iptables:
#!/bin/sh
#
# iptables Start iptables firewall
#
# chkconfig: 2345 08 92
# description: Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
#
### BEGIN INIT INFO
# Provides: iptables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop iptables firewall
# Description: Start, stop and save iptables firewall
### END INIT INFO
# Source function library.
. /etc/init.d/functions
#Liberando encaminhamento de conexao
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
modprobe ipt_mac
#Definicao de Variaveis
WAN_NIC='p3p1'
LAN_NIC='p1p1'
#Setando IPs da rede
WAN_IP=`ifconfig $WAN_NIC | grep -F "inet " | awk -F " " '{ print $2}' | awk -F " " '{ print $1 }'`
LAN_IP=`ifconfig $LAN_NIC | grep -F "inet " | awk -F " " '{ print $2}' | awk -F " " '{ print $1 }'`
LAN_IP_NET_A=$LAN_IP'/255.255.255.0'
#Resgatando os DNS setados
RESOLVS=`cat /etc/resolv.conf | grep nameserver | awk -F " " '{ print $2 }'`
DNS_A=`echo $RESOLVS | awk -F " " '{ print $ 1 }'`
DNS_B=`echo $RESOLVS | awk -F " " '{ print $ 2 }'`
echo "Rede Externa: $WAN_IP em $WAN_NIC"
echo "Rede Interna: $LAN_IP em $LAN_NIC"
echo "Rede Distribuida: $LAN_IP_NET_A"
echo "DNS Primario: $DNS_A"
echo "DNS Secundario: $DNS_B"
#Limpando Regras Anteriores
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F
#Alterando politica padrao de dados
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#Bloqueando redes suspeitas
iptables -A INPUT -s 84.0.0.0/255.0.0.0 -j DROP
iptables -A INPUT -s 62.0.0.0/255.0.0.0 -j DROP
iptables -A INPUT -s 24.0.0.0/255.0.0.0 -j DROP
iptables -A INPUT -s 83.0.0.0/255.0.0.0 -j DROP
iptables -A INPUT -s 70.0.0.0/255.0.0.0 -j DROP
#Liberando portas padroes de uso e ips de consultas
iptables -A INPUT -j ACCEPT -s $DNS_A #DNS
iptables -A INPUT -j ACCEPT -s $DNS_B #DNS
iptables -A INPUT -j ACCEPT -p tcp --dport 10022 # SSH
iptables -A INPUT -j ACCEPT -p tcp --dport 10000 # Webmin
iptables -A INPUT -s $LAN_IP_NET_A -j ACCEPT
iptables -A INPUT -s 127.0.0.0/255.255.255.0 -j ACCEPT
iptables -A INPUT -j ACCEPT -p tcp --dport 9090 # Jabber
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $WAN_NIC -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -i $WAN_NIC -m state --state ESTABLISHED,RELATED -j ACCEPT
#Redirecionamentos
####################
#portas liberadas
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 587 -j ACCEPT
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 465 -j ACCEPT
iptables -A FORWARD -s $LAN_IP_NET_A -p tcp --dport 993 -j ACCEPT
#Usuarios que terao acesso de servicos bloqueados abaixo
#Exemplo por IP
#Liberado IP Virtualserver
iptables -A FORWARD -s 192.168.200.6 -p tcp -j ACCEPT
#Liberar Atualizacao A.V.
iptables -t filter -I INPUT 1 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
iptables -t filter -I INPUT 2 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
iptables -t filter -I FORWARD 1 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
iptables -t filter -I FORWARD 2 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
iptables -t filter -I OUTPUT 1 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
iptables -t filter -I OUTPUT 2 -p tcp -d 216.52.233.197 --dport 443 -j ACCEPT
#Bloqueio da porta 80 (HTTP) e 443 (HTTPD)
iptables -A FORWARD -s $LAN_IP_NET_A -j DROP -p tcp --dport 80 # HTTP
iptables -A FORWARD -s $LAN_IP_NET_A -j ACCEPT -p tcp --dport 443 # HTTP
#Bloqueando acesso ao IRC
#iptables -A FORWARD -s $LAN_IP_NET_A -j DROP -p tcp --dport 6660:6669
#Redirecionando a internet e permitindo acesso das redes internas
iptables -t nat -A POSTROUTING -s $LAN_IP_NET_A -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET_A
#Log e bloqueio de pacotes invalidos
iptables -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "New not syn:"
iptables -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
#Permissao de ping
iptables -A INPUT -p icmp -j ACCEPT