acesso do serpro na rede interna

tiagofrancisco23
(usa CentOS)

Enviado em 19/05/2013 - 17:07h

boa tarde amigos!
gostaria muito da ajuda de vocês para que eu consiga acessar o serpro na rede interna, ja fiz de tudo mas nada adiantou. Segue abaixo o squid.conf e iptables:

############squid.conf#############
http_port 3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
pid_filename /var/run/squid.pid
cache_mem 800 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 40960 KB
maximum_object_size_in_memory 800 KB
cache_dir ufs /var/spool/squid 6000 16 256
dns_nameservers 8.8.8.8
dns_nameservers 8.8.4.4
auth_param basic program /usr/lib64/squid/ncsa_auth /etc/squid/shadow
auth_param basic realm Digite seu usuario e senha do email do CSGC
auth_param basic credentialsttl 24 hour
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
acl senha proxy_auth REQUIRED
acl all src 192.168.0.0/24
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl dia2 time MTWHF 07:30-11:30
acl dia3 time MTWHF 13:30-17:30
acl dia4 time SA 00:01-00:02
acl liberar_usuario proxy_auth "/etc/squid/user"
http_access allow liberar_usuario
acl bloquear_usuario proxy_auth "/etc/squid/user2"
http_access deny bloquear_usuario
#teste
acl bloquear_site url_regex -i "/etc/squid/listabloq.txt"
http_access deny dia2 bloquear_site
http_access deny dia3 bloquear_site
http_access deny dia4 bloquear_site
#
#acl liberar_site url_regex -i "/etc/squid/listaliberada.txt"
#http_access allow liberar_site
# Define as portas conhecidas e liberadas
#
#########################################################################
acl Deny_ports port 2745
acl Deny_ports port 2475
acl Deny_ports port 4001
acl Deny_ports port 6543
acl Deny_ports port 6544
acl Deny_ports port 7544
acl SSL_ports port 443
acl SSL_ports port 995
acl SSL_ports port 7443
acl SSL_ports port 5005
acl SSL_ports port 563
acl SSL_ports port 1741
acl SSL_ports port 23000
acl SSL_ports port 8999
acl SSL_ports port 1352
acl SSL_ports port 7000
acl SSL_ports port 1024
acl SSL_ports port 65535
acl SSL_ports port 10000
acl SSL_ports port 563
acl SSL_ports port 873 # rsync
acl SSL_ports port 23 # telnet
acl SSL_ports port 1863 # telnet
acl SSL_ports port 19226 # telnet
acl Safe_ports port 80
acl Safe_ports port 8080
acl Safe_ports port 443
acl Safe_ports port 8999
acl Safe_ports port 3000 # http
acl Safe_ports port 8900 # Funiber
acl Safe_ports port 20 # ftp
acl Safe_ports port 21 # ftp
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
#acl Safe_ports port 1025 - 65535 # unregistered ports
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups acl Safe_ports port 873 # rsync
acl Safe_ports port 3001
acl Safe_ports port 10000
acl Safe_ports port 8004
acl Safe_ports port 7779
acl Safe_ports port 1494 # Sigov
acl Safe_ports port 1521 # Siafi Gerencial
acl Safe_ports port 3460 # Serpro EDM
acl Safe_ports port 102 # X400
acl Safe_ports port 16000 # Siscon
acl Safe_ports port 23000 # SerproWeb
acl ip_serpro dst 161.148.40.200
acl Safe_ports port 2631 # Sefip
acl Safe_ports port 12010 # Cnpq Curriculo Lates
acl Safe_ports port 2000 # CNPQ -
acl Safe_ports port 2008 # SIGA
acl Safe_ports port 2001 # CNPQ -
acl Safe_ports port 2002 # CNPQ -
acl Safe_ports port 1025 # CNPQ -
acl Safe_ports port 5222 # Google
acl Safe_ports port 8085 # FSDB -
acl Safe_ports port 8088 # FSDB -
acl Safe_ports port 8081 # SVN -
acl Safe_ports port 5080 # SVN -
acl Safe_ports port 8000 # SVN -
acl Safe_ports port 9080 # SVN -
acl Safe_ports port 60 # SIGA -
acl Safe_ports port 81 # SIGA -
acl Safe_ports port 82 # SIGA -
acl Safe_ports port 83 # SIGA -
acl Safe_ports port 84 # SIGA -
acl Safe_ports port 85 # SIGA -
acl Safe_ports port 4000 # SBAM
acl Safe_ports port 8991 # CVS teste -
acl Safe_ports port 1935 # Astor
acl Safe_ports port 7777 # TSE
acl Safe_ports port 1723 # andreteste
acl Safe_ports port 2082 # Cpanel
acl Safe_ports port 2095 # Cpanel2
acl Safe_ports port 3690 # Gauss IFF
acl Safe_ports port 7778 # Gauss IFF
acl Safe_ports port 11371 # Ubuntu Key Server
acl virus url_regex -i /osa6.gif$
acl virus url_regex -i /5.php$
acl virus url_regex -i .vbs$
acl virus url_regex -i .pif$
acl virus url_regex -i .lnk$
acl virus url_regex -i .cpl$
acl virus url_regex -i .scr$
acl virus url_regex -i xxx3.php$
acl virus url_regex -i blst.php$
#########################################################################
acl purge method PURGE
acl CONNECT method CONNECT
acl http proto HTTP
acl ftp proto FTP
acl ssl proto SSL
acl Safe_ports port 4030
http_access allow ip_serpro
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports !SSL_ports
http_access allow SSL_ports
#http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow senha
http_access allow http
http_access allow ssl
http_access allow ftp
http_access deny all
http_reply_access allow all
icp_access allow all
coredump_dir /var/cache/squid/
visible_hostname CTI
cache_mgr gti@ifam.edu.br
authenticate_ip_ttl 12 hour
httpd_suppress_version_string on
error_directory /usr/share/squid/errors/Portuguese/

############iptables#############
# Generated by iptables-save v1.3.5 on Tue Dec 6 06:45:56 2011
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 80 -j DROP
-A INPUT -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 443 -j DROP
-A INPUT -p tcp -m tcp -s 192.168.0.1 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.0.1 --dport 443 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 80 -j DROP
-A FORWARD -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 443 -j DROP
# Bloqueio do MSN (Alex)
-A FORWARD -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 1863 -j DROP
-A OUTPUT -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 80 -j DROP
-A OUTPUT -p tcp -m tcp -s 192.168.0.0/255.255.0.0 --dport 443 -j DROP
-A OUTPUT -p tcp -m tcp -s 192.168.0.1 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -s 192.168.0.1 --dport 443 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.0.1 --dport 80 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.0.1 --dport 443 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 110 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 25 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 587 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 587 -j ACCEPT

# ---------configurando o siafi
-A FORWARD -p tcp --dport 80 -j ACCEPT
-A FORWARD -p tcp --dport 433 -j ACCEPT
-A FORWARD -p tcp --dport 8999 -j ACCEPT
-A FORWARD -p tcp --dport 23000 -j ACCEPT
-A FORWARD -p tcp --dport 7000 -j ACCEPT
-A FORWARD -p tcp --dport 259 -j ACCEPT
-A FORWARD -p tcp --dport 264 -j ACCEPT
-A FORWARD -p tcp --dport 500 -j ACCEPT
-A FORWARD -p tcp --dport 663 -j ACCEPT
-A FORWARD -p tcp --dport 1521 -j ACCEPT
-A FORWARD -p tcp --dport 2809 -j ACCEPT
-A FORWARD -p tcp --dport 23000 -d 161.148.40.0/24 -j ACCEPT
-A FORWARD -p tcp --dport 23000 -d 161.148.0.0/16 -j ACCEPT
##################################################
#### " Liberação de Acesso a Sites Funcionais"###

# www.serpro.gov.br
-A FORWARD -s 161.148.40.200 -j ACCEPT
-A FORWARD -d 161.148.40.200 -j ACCEPT
-A FORWARD -s 161.148.40.0/24 -j ACCEPT
-A FORWARD -d 161.148.40.0/24 -j ACCEPT
-A FORWARD -s 161.148.1.80 -j ACCEPT
-A FORWARD -d 161.148.1.80 -j ACCEPT
-A FORWARD -s 200.19.138.9 -j ACCEPT
-A FORWARD -d 200.19.138.9 -j ACCEPT
#
# www.comprasnet.gov.br
-A FORWARD -s 161.148.173.66 -j ACCEPT
-A FORWARD -d 161.148.173.66 -j ACCEPT
#
# www.correios.com.br
-A FORWARD -s 200.252.60.80 -j ACCEPT
-A FORWARD -d 200.252.60.80 -j ACCEPT
# ----------------------------------------
-A OUTPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 587 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --destination-port 443 -j ACCEPT
-A INPUT -p tcp --destination-port 23000 -j ACCEPT
-A FORWARD -p tcp -m tcp --sport 3080 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 3080 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 3080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3080 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3080 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3080 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 200.129.168.182 --sport 3080 -j ACCEPT
COMMIT
# Completed on Tue Dec 6 06:45:56 2011
# Generated by iptables-save v1.3.5 on Tue Dec 6 06:45:56 2011
*nat
:PREROUTING ACCEPT [1779:132861]
:POSTROUTING ACCEPT [1035:74629]
:OUTPUT ACCEPT [1035:74629]
-A POSTROUTING -s 192.168.0.0/255.255.0.0 -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Dec 6 06:45:56 2011
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
-A FORWARD -s 161.148.40.200 -j TOS --set-tos 8
-A FORWARD -d 161.148.40.200 -j TOS --set-tos 8
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-A PREROUTING -s 161.148.40.200 -j TOS --set-tos 8
-A PREROUTING -d 161.148.40.200 -j TOS --set-tos 8
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed


Desde ja agraceço a colaboração!