iptables e squid .. outlook nao funciona [RESOLVIDO]

tico-tico
(usa Outra)

Enviado em 19/03/2009 - 12:48h

bom dia amigos, gostaria de contar com a ajuda de voces.. pois estou com o seguinte problemas...instalei o configurei o iptables e o squid. os dois estao trabalhando legal mas nao esta enviando nem recebendo email .. vou ficar muito grato a todos se poderem me ajudar..

===============================================================================================

firewall

# Firewall sob STATEFULL, fecha as entradas, encaminhamento e saida
# realizando o tratamento do pacotes com integridade e seguranca.


IPT="/sbin/iptables"
INT_IFACE="eth0"
INT_IP="192.168.1.110"
INT_LAN="192.168.1.0/24"


# INICIA O SCRIPT FIREWALL

firewall_start () {

# Habilita o roteamento entre as interfaces

echo "1" > /proc/sys/net/ipv4/ip_forward



# deny redirections
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
# ignore broadcast pings
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# filter all packets / ataque smurf
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# lower DoS attack's sensibility
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
echo "0" > /proc/sys/net/ipv4/tcp_sack
#echo 1 > /proc/sys/net/ipv4/conf/all/accept_source_route


#==============================================================
# Modulo para nat de ftp
#==============================================================

modprobe ip_nat_ftp


#=============================================================
# iptables DROP ALL NOT DECLARED policy
#=============================================================

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP



#=============================================================
# Negado apenas uma prta espefica
# caso, queria fazer lista aberta
#============================================================
#
#$IPT -A INPUT -p tcp --dport 9099 -j DROP
#$IPT -A INPUT -p tcp --sport 9099 -j DROP
#$IPT -A FORWARD -p tcp --dport 9099 -j DROP
#$IPT -A FORWARD -p tcp --sport 9099 -j DROP
#$IPT -A OUTPUT -p tcp --sport 9099 -j DROP
#$IPT -A OUTPUT -p tcp --dport 9099 -j DROP


#=============================================================
# Cria a chain statefull
#=============================================================
# Descarta contra pacotes danificados, suspeitos ou mal formados.

$IPT -N statefull
$IPT -A statefull -p tcp --syn -m state --state NEW -j ACCEPT
$IPT -A statefull -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A statefull -m state --state INVALID -j DROP
$IPT -A statefull -j DROP

#=============================================================
# Cria a chain icmp_types
#=============================================================

$IPT -N icmp_types
$IPT -A icmp_types -p icmp --icmp-type 3 -j ACCEPT
$IPT -A icmp_types -p icmp --icmp-type 8 -j ACCEPT


#-------------------------------------------------
# Ataque Smurf
$IPT -A INPUT -p icmp --icmp-type 8 -j DROP
#--------------------------------------------------
$IPT -A icmp_packets -p icmp --icmp-type 0 -j ACCEPT
$IPT -A icmp_packets -p icmp --icmp-type 11 -j ACCEPT
$IPT -A icmp_packets -p icmp --icmp-type 30 -j ACCEPT

#---------------------------------------------------
# Contra Ping
#---------------------------------------------------

$IPT -A FORWARD -p icmp --icmp-type echo-request -j DROP

#---------------------------------------------------
#Contra Ping da Morte
#---------------------------------------------------
$IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type echo-request -j DROP

#=============================================================
# Libera o acesso da interface LOOPBACK para qualquer lugar
#=============================================================

$IPT -A INPUT -i lo -j ACCEPT
$IPT -A FORWARD -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

#=============================================================
# localhost
#=============================================================

$IPT -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
$IPT -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT


#=============================================================
# Libera ICMP
#=============================================================

$IPT -A INPUT -p icmp -j icmp_types
$IPT -A FORWARD -p icmp -j icmp_types
$IPT -A OUTPUT -p icmp -j icmp_types

#=============================================================
# Libera o acesso FTP
#=============================================================

PAS_FTP="30000:65535"

$IPT -A INPUT -p tcp --dport 20 -j statefull
$IPT -A FORWARD -p tcp --dport 20 -j statefull
$IPT -A FORWARD -p tcp --sport 20 -j statefull
$IPT -A OUTPUT -p tcp --sport 20 -j statefull
$IPT -A OUTPUT -p tcp --dport 20 -j statefull
$IPT -A INPUT -p tcp --dport 21 -j statefull
$IPT -A FORWARD -p tcp --dport 21 -j statefull
$IPT -A FORWARD -p tcp --sport 21 -j statefull
$IPT -A OUTPUT -p tcp --sport 21 -j statefull
$IPT -A OUTPUT -p tcp --dport 21 -j statefull

$IPT -A INPUT -p tcp --dport $PAS_FTP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -p tcp --dport $PAS_FTP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -p tcp --sport $PAS_FTP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --sport $PAS_FTP -m state --state ESTABLISHED,RELATED -j ACCEPT

#=============================================================
# Libera o acesso SSH
#=============================================================

# Ssh para Todos
#$IPT -A INPUT -p tcp --dport 22 -j statefull
#$IPT -A FORWARD -p tcp --dport 22 -j statefull
#$IPT -A FORWARD -p tcp --sport 22 -j statefull
#$IPT -A OUTPUT -p tcp --sport 22 -j statefull
#$IPT -A OUTPUT -p tcp --dport 22 -j statefull

# Ssh Restrito Interno
$IPT -A INPUT -s 192.168.1.1 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.1 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.1 -p tcp --sport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.1 -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.1 -p tcp --sport 22 -j ACCEPT

# Libera apenas para um IP
$IPT -A INPUT -s 192.168.1.110 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.110 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.110 -p tcp --sport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.110 -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.110 -p tcp --sport 22 -j ACCEPT

$IPT -A INPUT -s 192.168.1.119 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.119 -p tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -s 192.168.1.119 -p tcp --sport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.119 -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -s 192.168.1.119 -p tcp --sport 22 -j ACCEPT


$IPT -A INPUT -s 0.0.0.0/0 -p tcp --dport 22 -j REJECT
$IPT -A OUTPUT -s 0.0.0.0/0 -p tcp --dport 22 -j REJECT

#=============================================================
# Libera o acesso SMTP - ENVIO DE EMAIL
#=============================================================

$IPT -A INPUT -p tcp --dport 25 -j statefull
$IPT -A INPUT -p tcp --sport 25 -j statefull
$IPT -A FORWARD -p tcp --dport 25 -j statefull
$IPT -A FORWARD -p tcp --sport 25 -j statefull
$IPT -A OUTPUT -p tcp --sport 25 -j statefull
$IPT -A OUTPUT -p tcp --dport 25 -j statefull

#=============================================================
# Libera o acesso DNS
#=============================================================

$IPT -A INPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -p udp --sport 53 -j ACCEPT
$IPT -A FORWARD -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -p udp --sport 53 -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53 -j ACCEPT

#=============================================================
# Libera o acesso DHCP
#=============================================================

$IPT -A INPUT -p udp --dport 67 -j ACCEPT
$IPT -A OUTPUT -p udp --sport 67 -j ACCEPT

#=============================================================
# Libera o acesso HTTP
#=============================================================

$IPT -A INPUT -p tcp --dport 80 -j statefull
$IPT -A INPUT -p tcp --sport 80 -j statefull

# Libera acesso porta 80 direto (Discomente para liberar)
#$IPT -A FORWARD -p tcp --dport 80 -j statefull

$IPT -A FORWARD -p tcp --sport 80 -j statefull
$IPT -A OUTPUT -p tcp --sport 80 -j statefull
$IPT -A OUTPUT -p tcp --dport 80 -j statefull

#=============================================================
# Libera o acesso POP - RECEBIMENTO DE EMAIL
#=============================================================

$IPT -A INPUT -p tcp --dport 110 -j statefull
$IPT -A FORWARD -p tcp --dport 110 -j statefull
$IPT -A FORWARD -p tcp --sport 110 -j statefull
$IPT -A OUTPUT -p tcp --dport 110 -j statefull
$IPT -A OUTPUT -p tcp --sport 110 -j statefull

#=============================================================
# Libera o acesso HTTPS
#=============================================================

$IPT -A INPUT -p tcp --dport 443 -j statefull
$IPT -A INPUT -p tcp --sport 443 -j statefull
$IPT -A FORWARD -p tcp --dport 443 -j statefull
$IPT -A FORWARD -p tcp --sport 443 -j statefull
$IPT -A OUTPUT -p tcp --dport 443 -j statefull
$IPT -A OUTPUT -p tcp --sport 443 -j statefull

#=============================================================
# Libera o acesso SAMBA/NETBIOS
#=============================================================

$IPT -A INPUT -p udp --dport 137 -j statefull
$IPT -A OUTPUT -p udp --sport 137 -j statefull
$IPT -A INPUT -p udp --dport 138 -j statefull
$IPT -A OUTPUT -p udp --sport 138 -j statefull
$IPT -A INPUT -p tcp --dport 139 -j statefull
$IPT -A OUTPUT -p tcp --sport 139 -j statefull
$IPT -A INPUT -p tcp --dport 445 -j statefull
$IPT -A OUTPUT -p tcp --sport 445 -j statefull

#=============================================================
# Libera o acesso de dentro pra fora do MSN
#=============================================================

#$IPT -A FORWARD -p tcp --dport 1863 -j statefull
#$IPT -A FORWARD -p tcp --sport 1863 -j statefull
#$IPT -A OUTPUT -p tcp --dport 1863 -j statefull

#Restricao MSN

#$IPT -A FORWARD -s $INT_IP -p tcp --dport 1863 -j DROP
#$IPT -A FORWARD -s $INT_IP -d 65.54.0.0/24 -j DROP
#$IPT -A FORWARD -s $INT_IP -d loginnet.passport.com -j DROP
#$IPT -A FORWARD -s $INT_IP -d login.passport.net -j DROP
#$IPT -A FORWARD -s $INT_IP -d baym-gw3.msgr.hotmail.com -j DROP

$IPT -A FORWARD -s $INT_IP -d 212.126.0.0/24 -j DROP

#Msn Web
$IPT -A FORWARD -s $INT_IP -d 207.46.110.252 -j DROP
$IPT -A FORWARD -p TCP -d 207.46.104.20 --dport 1863 -j DROP

#Hopster
$IPT -A FORWARD -s $INT_IP -d 62.116.83.62 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp --dport 443 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp --sport 443 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp -d 62.116.83.62 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp --dport 443 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp --sport 443 -j DROP
$IPT -A FORWARD -s 192.168.1.111 -p tcp -d 62.116.83.62 -j DROP


$IPT -A INPUT -p tcp -d 62.116.83.62 --dport 443 -j DROP
$IPT -A INPUT -p tcp -d 62.116.83.62 --sport 443 -j DROP
$IPT -A FORWARD -p tcp -d 62.116.83.62 --dport 443 -j DROP
$IPT -A FORWARD -p tcp -d 62.116.83.62 --sport 443 -j DROP
$IPT -A OUTPUT -p tcp -d 62.116.83.62 --sport 443 -j DROP


#=============================================================
# Libera o acesso SQUID
#=============================================================

$IPT -A INPUT -p tcp --dport 3128 -j statefull
$IPT -A INPUT -p tcp --sport 3128 -j statefull
$IPT -A FORWARD -p tcp --dport 3128 -j statefull
$IPT -A FORWARD -p tcp --sport 3128 -j statefull
$IPT -A OUTPUT -p tcp --dport 3128 -j statefull
$IPT -A OUTPUT -p tcp --sport 3128 -j statefull

#=============================================================
# Libera o acesso MYSQL - BANCO DE DADOS
#=============================================================

$IPT -A INPUT -p tcp --dport 3306 -j ACCEPT
$IPT -A INPUT -p tcp --sport 3306 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 3306 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 3306 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 3306 -j ACCEPT

#=============================================================
# Libera o Apache
#=============================================================

$IPT -A INPUT -p tcp --dport 8181 -j statefull
$IPT -A INPUT -p tcp --sport 8181 -j statefull
$IPT -A FORWARD -p tcp --dport 8181 -j statefull
$IPT -A FORWARD -p tcp --sport 8181 -j statefull
$IPT -A OUTPUT -p tcp --sport 8181 -j statefull
$IPT -A OUTPUT -p tcp --dport 8181 -j statefull

#==============================================================
# Chat da UOL
#==============================================================

PORTAS="8000:8099"

$IPT -A INPUT -p tcp --dport $PORTAS -j statefull
$IPT -A INPUT -p tcp --sport $PORTAS -j statefull
$IPT -A FORWARD -p tcp --dport $PORTAS -j statefull
$IPT -A FORWARD -p tcp --sport $PORTAS -j statefull
$IPT -A OUTPUT -p tcp --sport $PORTAS -j statefull
$IPT -A OUTPUT -p tcp --dport $PORTAS -j statefull


#-------------------------------------------------------------
# Mascara endereco de rede

#$IPT -t nat -A POSTROUTING -s $INT_LAN -j MASQUERADE

############## DEBUG PURPOSES ONLY #######################################
# LOG INPUT/OUPUT/FORWARD

#$IPT -A INPUT -j LOG --log-level notice --log-prefix "INPUT BARRADO:"
#$IPT -A FORWARD -j LOG --log-level notice --log-prefix "FORWARD BARRADO:"
#$IPT -A OUTPUT -j LOG --log-level notice --log-prefix "OUTPUT BARRADO:"

}

firewall_stop () {

$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

$IPT -F
$IPT -t nat -F

$IPT -F statefull
$IPT -X statefull

$IPT -F icmp_types
$IPT -X icmp_types

}

firewall_mask () {

$IPT -t nat -A POSTROUTING -j MASQUERADE

}

case "$1" in

start)
echo "Iniciando Firewall ..."
firewall_start;;
stop)
echo "Parando Firewall ..."
firewall_stop;;
mask)
echo "Mascarando apenas ..."
firewall_stop;;
*)
echo "USO: $0 start | stop | mask"

esac

exit 0


=============================================================================================

squid

#Default:
# minimum_retry_timeout 5 seconds
# By Kleber Silva Rodrigues 200809033
# For Alunos Senac Turma 2008
#Examples:
#acl myexample dst_as 1241
#acl password proxy_auth REQUIRED
#acl fileupload req_mime_type -i ^multipart/form-data$
#acl javascript rep_mime_type -i ^application/x-javascript$

#Default: Porta de Saida
http_port 3128

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
#cache_mem 1 MB
cache_mem 512 KB

auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

#Recommended minimum configuration:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
#
# should be allowed
#acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network


#Libera para o IP
#acl kleber src 192.168.1.110


## Host Liberados
#http_access allow kleber

##

#Libera Somente MSN
#acl msnchefe dstdomain loginnet.passport.com
#acl msngateway url_regex -i gateway.dll
#acl MSNXP req_mime_type -i ^application/x-msn-messenger$
#acl ips src 192.168.1.110


#=============================================================
#Bloqueando IP
acl negaips src 66.90.125.152
http_access deny negaips

#Bloqueando Msn

acl msn dstdomain loginnet.passport.com
http_access deny msn
acl hop dstdomain login.passport.net
http_access deny hop
acl msnmessenger url_regex -i gateway.dll
acl radmessenger url_regex -i ADSAdClient31.dll
#acl MSN req_mime_type -i ^application/x-msn-messenger$
http_access deny msnmessenger
#http_access deny MSN
http_access deny radmessenger



#Bloqueado WebMessenger

acl webmsn dstdomain webmessenger.msn.com
acl MSNWEB url_regex messenger
http_access deny webmsn
http_access deny MSNWEB

#Bloqueado Icq

acl webicq dstdomain login.icq.com
acl ICQ url_regex icq
http_access deny webicq
http_access deny ICQ

#Bloqueando Spyware

acl GATOR url_regex gator
http_access deny GATOR


#Portas Utilizadas

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 110 # pop3
acl Safe_ports port 25 # smtp
acl Safe_ports port 1863 # MSN
acl Safe_ports port 22 # SSH
acl Safe_ports port 3306 # MYSQL
acl CONNECT method CONNECT


### Regras de bloqueio
acl arquivosex url_regex arquivosex
acl acontececg url_regex www.acontececg.com.br
acl orkut url_regex www.orkut.com
acl gazzag url_regex www.gazzag.com
acl msn2n url_regex www.msn2go.com
acl emsn3 url_regex www.e-messenger.net
acl msn4 url_regex iloveim
acl file url_regex www.fileplanet.com
acl playboy url_regex playboy
acl sexo url_regex sexo
acl sexy url_regex sexy
acl batepapo url_regex batepapo
acl chat url_regex chat
acl icq url_regex icq
acl wbmsn url_regex www.wbmsn.net
acl freeproxy url_regex www.publicproxyservers.com
acl proxy url_regex proxy
acl hopSter url_regex hopster
acl radmsn url_regex rad.msn.com
acl ircd url_regex ircd
#acl meebo url_regex www.meebo.com
###

### Bloqueando as Regras
http_access deny arquivosex
http_access deny acontececg
http_access deny orkut
http_access deny gazzag
http_access deny msn2n
http_access deny emsn3
http_access deny msn4
http_access deny file
http_access deny playboy
http_access deny sexo
http_access deny sexy
http_access deny batepapo
http_access deny chat
http_access deny icq
http_access deny wbmsn
http_access deny freeproxy
http_access deny proxy
http_access deny hopSter
http_access deny radmsn
http_access deny ircd
#http_access deny meebo
####

## Bloqueando Hopster

#acl iphopster src 192.168.1.182
#acl HopsterPort port 443
#acl outraporta port 403
#acl Hopster dst 62.116.83.62
#http_access deny Hopster HopsterPort iphopster outraporta


### Regras liberando
##


### Bloqueio do MSN
#http_access deny msn
#http_access deny msn2

#Default:
#http_access deny all
#http_access allow senac

http_access allow manager localhost
http_access deny manager

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
############################
http_access allow localnet
############################

# And finally deny all other access to this proxy
#http_access allow localhost
#http_access deny all



# Deny requests to unknown ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow Safe_ports localhost
#http_access allow Safe_ports net
#http_access allow localhost
#visible_hostname proxy
#http_access deny all

#http_reply_access allow localnet

#icp_access allow localnet


http_access allow localhost
http_access deny all


icp_access allow localnet
icp_access deny all


# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
#
cache_effective_user squid
cache_effective_group squid
#
#Default:
# cache_effective_user squid
# cache_effective_group squid

#Default:

#httpd_accel_port 80
#httpd_accel_host virtual

#Default:
#httpd_accel_with_proxy on

#
#Default:
#httpd_accel_uses_host_header on


# MISCELLANEOUS
# -----------------------------------------------------------------------------

# TAG: dns_testnames
# The DNS tests exit as soon as the first site is successfully looked up
#
# This test can be disabled with the -D command line option.
#
#Default:
# dns_testnames netscape.com internic.net nlanr.net microsoft.com

# TAG: logfile_rotate
# Specifies the number of logfile rotations to make when you
# type 'squid -k rotate'. The default is 10, which will rotate
# with extensions 0 through 9. Setting logfile_rotate to 0 will
# disable the rotation, but the logfiles are still closed and
# re-opened. This will enable you to rename the logfiles
# yourself just before sending the rotate signal.
#
# Note, the 'squid -k rotate' command normally sends a USR1
# signal to the running squid process. In certain situations
# (e.g. on Linux with Async I/O), USR1 is used for other
# purposes, so -k rotate uses another signal. It is best to get
# in the habit of using 'squid -k rotate' instead of 'kill -USR1
# <pid>'.
#
#logfile_rotate 0
#
#Default:
# logfile_rotate 0

# TAG: append_domain
# Appends local domain name to hostnames without any dots in
# them. append_domain must begin with a period.
#
# Be warned that there today is Internet names with no dots in
# them using only top-domain names, so setting this may
# cause some Internet sites to become unavailable.
#
#Example:
# append_domain .yourdomain.com
#
#Default:
# none

# TAG: tcp_recv_bufsize (bytes)
# Size of receive buffer to set for TCP sockets. Probably just
# as easy to change your kernel's default. Set to zero to use
# the default buffer size.
#
#Default:
# tcp_recv_bufsize 0 bytes

# TAG: err_html_text
# HTML text to include in error messages. Make this a "mailto"
# URL to your admin address, or maybe just a link to your
# organizations Web page.
#
# To include this in your error messages, you must rewrite
# the error template files (found in the "errors" directory).
# Wherever you want the 'err_html_text' line to appear,
# insert a %L tag in the error template file.
#
#Default:
# none

# TAG: deny_info
# Usage: deny_info err_page_name acl
# Example: deny_info ERR_CUSTOM_ACCESS_DENIED bad_guys
#
# This can be used to return a ERR_ page for requests which
# do not pass the 'http_access' rules. A single ACL will cause
# the http_access check to fail. If a 'deny_info' line exists
# for that ACL then Squid returns a corresponding error page.
#
# You may use ERR_ pages that come with Squid or create your own pages
# and put them into the configured errors/ directory.
#
# Alternatively you can tell Squid to reset the TCP connection
# by specifying TCP_RESET.
#
#Default:
# none

# TAG: memory_pools on|off
# If set, Squid will keep pools of allocated (but unused) memory
# available for future use. If memory is a premium on your
# system and you believe your malloc library outperforms Squid
# routines, disable this.
#
#Default:
# memory_pools on

# TAG: memory_pools_limit (bytes)
# Used only with memory_pools on:
# memory_pools_limit 50 MB
#
# If set to a non-zero value, Squid will keep at most the specified
# limit of allocated (but unused) memory in memory pools. All free()
# requests that exceed this limit will be handled by your malloc
# library. Squid does not pre-allocate any memory, just safe-keeps
# objects that otherwise would be free()d. Thus, it is safe to set
# memory_pools_limit to a reasonably high value even if your
# configuration will use less memory.
#
# If not set (default) or set to zero, Squid will keep all memory it
# can. That is, there will be no limit on the total amount of memory
# used for safe-keeping.
#
# To disable memory allocation optimization, do not set
# memory_pools_limit to 0. Set memory_pools to "off" instead.
#
# An overhead for maintaining memory pools is not taken into account
# when the limit is checked. This overhead is close to four bytes per
# object kept. However, pools may actually _save_ memory because of
# reduced memory thrashing in your malloc library.
#
#Default:
# none

# TAG: forwarded_for on|off
# If set, Squid will include your system's IP address or name
# in the HTTP requests it forwards. By default it looks like
# this:
#
# X-Forwarded-For: 192.1.2.3
#
# If you disable this, it will appear as
#
# X-Forwarded-For: unknown
#
#Default:
# forwarded_for on

# TAG: log_icp_queries on|off
# If set, ICP queries are logged to access.log. You may wish
# do disable this if your ICP load is VERY high to speed things
# up or to simplify log analysis.
#
#Default:
# log_icp_queries on

# TAG: icp_hit_stale on|off
# If you want to return ICP_HIT for stale cache objects, set this
# option to 'on'. If you have sibling relationships with caches
# in other administrative domains, this should be 'off'. If you only
# have sibling relationships with caches under your control, then
# it is probably okay to set this to 'on'.
# If set to 'on', then your siblings should use the option "allow-miss"
# on their cache_peer lines for connecting to you.
#
#Default:
# icp_hit_stale off

# TAG: minimum_direct_hops
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many hops away.
#
#Default:
# minimum_direct_hops 4

# TAG: minimum_direct_rtt
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many rtt milliseconds away.
#
#Default:
# minimum_direct_rtt 400

# TAG: cachemgr_passwd
# Specify passwords for cachemgr operations.
#
# Usage: cachemgr_passwd password action action ...
#
# Some valid actions are (see cache manager menu for a full list):
# 5min
# 60min
# asndb
# authenticator
# cbdata
# client_list
# comm_incoming
# config *
# counters
# delay
# digest_stats
# dns
# events
# filedescriptors
# fqdncache
# histograms
# http_headers
# info
# io
# ipcache
# mem
# menu
# netdb
# non_peers
# objects
# pconn
# peer_select
# redirector
# refresh
# server_list
# shutdown *
# store_digest
# storedir
# utilization
# via_headers
# vm_objects
#
# * Indicates actions which will not be performed without a
# valid password, others can be performed if not listed here.
#
# To disable an action, set the password to "disable".
# To allow performing an action without a password, set the
# password to "none".
#
# Use the keyword "all" to set the same password for all actions.
#
#Example:
# cachemgr_passwd secret shutdown
# cachemgr_passwd lesssssssecret info stats/objects
# cachemgr_passwd disable all
#
#Default:
# none

# TAG: store_avg_object_size (kbytes)
# Average object size, used to estimate number of objects your
# cache can hold. See doc/Release-Notes-1.1.txt. The default is
# 13 KB.
#
#Default:
# store_avg_object_size 13 KB

# TAG: store_objects_per_bucket
# Target number of objects per bucket in the store hash table.
# Lowering this value increases the total number of buckets and
# also the storage maintenance rate. The default is 50.
#
#Default:
# store_objects_per_bucket 20

# TAG: client_db on|off
# If you want to disable collecting per-client statistics, then
# turn off client_db here.
#
#Default:
# client_db on

# TAG: netdb_low
# TAG: netdb_high
# The low and high water marks for the ICMP measurement
# database. These are counts, not percents. The defaults are
# 900 and 1000. When the high water mark is reached, database
# entries will be deleted until the low mark is reached.
#
#Default:
# netdb_low 900
# netdb_high 1000

# TAG: netdb_ping_period
# The minimum period for measuring a site. There will be at
# least this much delay between successive pings to the same
# network. The default is five minutes.
#
#Default:
# netdb_ping_period 5 minutes

# TAG: query_icmp on|off
# If you want to ask your peers to include ICMP data in their ICP
# replies, enable this option.
#
# If your peer has configured Squid (during compilation) with
# '--enable-icmp' then that peer will send ICMP pings to origin server
# sites of the URLs it receives. If you enable this option then the
# ICP replies from that peer will include the ICMP data (if available).
# Then, when choosing a parent cache, Squid will choose the parent with
# the minimal RTT to the origin server. When this happens, the
# hierarchy field of the access.log will be
# "CLOSEST_PARENT_MISS". This option is off by default.
#
#Default:
# query_icmp off

# TAG: test_reachability on|off
# When this is 'on', ICP MISS replies will be ICP_MISS_NOFETCH
# instead of ICP_MISS if the target host is NOT in the ICMP
# database, or has a zero RTT.
#
#Default:
# test_reachability off

# TAG: buffered_logs on|off
# cache.log log file is written with stdio functions, and as such
# it can be buffered or unbuffered. By default it will be unbuffered.
# Buffering it can speed up the writing slightly (though you are
# unlikely to need to worry unless you run with tons of debugging
# enabled in which case performance will suffer badly anyway..).
#
#Default:
# buffered_logs off

# TAG: reload_into_ims on|off
# When you enable this option, client no-cache or `reload''
# requests will be changed to If-Modified-Since requests.
# Doing this VIOLATES the HTTP standard. Enabling this
# feature could make you liable for problems which it
# causes.
#
# see also refresh_pattern for a more selective approach.
#
#Default:
# reload_into_ims off

# TAG: always_direct
# Usage: always_direct allow|deny [!]aclname ...
#
# Here you can use ACL elements to specify requests which should
# ALWAYS be forwarded directly to origin servers. For example,
# to always directly forward requests for local servers use
# something like:
#
# acl local-servers dstdomain my.domain.net
# always_direct allow local-servers
#
# To always forward FTP requests directly, use
#
# acl FTP proto FTP
# always_direct allow FTP
#
# NOTE: There is a similar, but opposite option named
# 'never_direct'. You need to be aware that "always_direct deny
# foo" is NOT the same thing as "never_direct allow foo". You
# may need to use a deny rule to exclude a more-specific case of
# some other rule. Example:
#
# acl local-external dstdomain external.foo.net
# acl local-servers dstdomain .foo.net
# always_direct deny local-external
# always_direct allow local-servers
#
# This option replaces some v1.1 options such as local_domain
# and local_ip.
#
#Default:
# none

# TAG: never_direct
# Usage: never_direct allow|deny [!]aclname ...
#
# never_direct is the opposite of always_direct. Please read
# the description for always_direct if you have not already.
#
# With 'never_direct' you can use ACL elements to specify
# requests which should NEVER be forwarded directly to origin
# servers. For example, to force the use of a proxy for all
# requests, except those in your local domain use something like:
#
# acl local-servers dstdomain .foo.net
# acl all src 0.0.0.0/0.0.0.0
# never_direct deny local-servers
# never_direct allow all
#
# or if squid is inside a firewall and there is local intranet
# servers inside the firewall then use something like:
#
# acl local-intranet dstdomain .foo.net
# acl local-external dstdomain external.foo.net
# always_direct deny local-external
# always_direct allow local-intranet
# never_direct allow all
#
# This option replaces some v1.1 options such as inside_firewall
# and firewall_ip.
#
#Default:
# none

# TAG: header_access
# Usage: header_access header_name allow|deny [!]aclname ...
#
# WARNING: Doing this VIOLATES the HTTP standard. Enabling
# this feature could make you liable for problems which it
# causes.
#
# This option replaces the old 'anonymize_headers' and the
# older 'http_anonymizer' option with something that is much
# more configurable. This new method creates a list of ACLs
# for each header, allowing you very fine-tuned header
# mangling.
#
# You can only specify known headers for the header name.
# Other headers are reclassified as 'Other'. You can also
# refer to all the headers with 'All'.
#
# For example, to achieve the same behaviour as the old
# 'http_anonymizer standard' option, you should use:
#
# header_access From deny all
# header_access Referer deny all
# header_access Server deny all
# header_access User-Agent deny all
# header_access WWW-Authenticate deny all
# header_access Link deny all
#
# Or, to reproduce the old 'http_anonymizer paranoid' feature
# you should use:
#
# header_access Allow allow all
# header_access Authorization allow all
# header_access Cache-Control allow all
# header_access Content-Encoding allow all
# header_access Content-Length allow all
# header_access Content-Type allow all
# header_access Date allow all
# header_access Expires allow all
# header_access Host allow all
# header_access If-Modified-Since allow all
# header_access Last-Modified allow all
# header_access Location allow all
# header_access Pragma allow all
# header_access Accept allow all
# header_access Accept-Charset allow all
# header_access Accept-Encoding allow all
# header_access Accept-Language allow all
# header_access Content-Language allow all
# header_access Mime-Version allow all
# header_access Retry-After allow all
# header_access Title allow all
# header_access Connection allow all
# header_access Proxy-Connection allow all
# header_access All deny all
#
# By default, all headers are allowed (no anonymizing is
# performed).
#
#Default:
# none

# TAG: header_replace
# Usage: header_replace header_name message
# Example: header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
#
# This option allows you to change the contents of headers
# denied with header_access above, by replacing them with
# some fixed string. This replaces the old fake_user_agent
# option.
#
# By default, headers are removed if denied.
#
#Default:
# none

# TAG: icon_directory
# Where the icons are stored. These are normally kept in
# /usr/share/squid/icons
#
#Default:
# icon_directory /usr/share/squid/icons

# TAG: error_directory
# Directory where the error files are read from.
# /usr/lib/squid/errors contains sets of error files
# in different languages. The default error directory
# is /etc/squid/errors, which is a link to one of these
# error sets.
#
# If you wish to create your own versions of the error files,
# either to customize them to suit your language or company,
# copy the template English files to another
# directory and point this tag at them.
#
error_directory /etc/squid/errors
#
#Default:
# error_directory /usr/share/squid/errors

# TAG: minimum_retry_timeout (seconds)
# This specifies the minimum connect timeout, for when the
# connect timeout is reduced to compensate for the availability
# of multiple IP addresses.
#
# When a connection to a host is initiated, and that host has
# several IP addresses, the default connection timeout is reduced
# by dividing it by the number of addresses. So, a site with 15
# addresses would then have a timeout of 8 seconds for each
# address attempted. To avoid having the timeout reduced to the
# point where even a working host would not have a chance to
# respond, this setting is provided. The default, and the
# minimum value, is five seconds, and the maximum value is sixty
# seconds, or half of connect_timeout, whichever is greater and
# less than connect_timeout.
#

# TAG: maximum_single_addr_tries
# This sets the maximum number of connection attempts for a
# host that only has one address (for multiple-address hosts, # By Kleber Silva Rodrigues 200809033
# For Alunos Senac Turma 2008
#Examples:
#acl myexample dst_as 1241
#acl password proxy_auth REQUIRED
#acl fileupload req_mime_type -i ^multipart/form-data$
#acl javascript rep_mime_type -i ^application/x-javascript$

#Default: Porta de Saida
http_port 3128

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
#cache_mem 1 MB
cache_mem 512 KB

auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

#Recommended minimum configuration:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
#
# should be allowed
#acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network


#Libera para o IP
#acl kleber src 192.168.1.110


## Host Liberados
#http_access allow kleber

##

#Libera Somente MSN
#acl msnchefe dstdomain loginnet.passport.com
#acl msngateway url_regex -i gateway.dll
#acl MSNXP req_mime_type -i ^application/x-msn-messenger$
#acl ips src 192.168.1.110


#=============================================================
#Bloqueando IP
acl negaips src 66.90.125.152
http_access deny negaips

#Bloqueando Msn

acl msn dstdomain loginnet.passport.com
http_access deny msn
acl hop dstdomain login.passport.net
http_access deny hop
acl msnmessenger url_regex -i gateway.dll
acl radmessenger url_regex -i ADSAdClient31.dll
#acl MSN req_mime_type -i ^application/x-msn-messenger$
http_access deny msnmessenger
#http_access deny MSN
http_access deny radmessenger



#Bloqueado WebMessenger

acl webmsn dstdomain webmessenger.msn.com
acl MSNWEB url_regex messenger
http_access deny webmsn
http_access deny MSNWEB

#Bloqueado Icq

acl webicq dstdomain login.icq.com
acl ICQ url_regex icq
http_access deny webicq
http_access deny ICQ

#Bloqueando Spyware

acl GATOR url_regex gator
http_access deny GATOR


#Portas Utilizadas

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 110 # pop3
acl Safe_ports port 25 # smtp
acl Safe_ports port 1863 # MSN
acl Safe_ports port 22 # SSH
acl Safe_ports port 3306 # MYSQL
acl CONNECT method CONNECT


### Regras de bloqueio
acl arquivosex url_regex arquivosex
acl acontececg url_regex www.acontececg.com.br
acl orkut url_regex www.orkut.com
acl gazzag url_regex www.gazzag.com
acl msn2n url_regex www.msn2go.com
acl emsn3 url_regex www.e-messenger.net
acl msn4 url_regex iloveim
acl file url_regex www.fileplanet.com
acl playboy url_regex playboy
acl sexo url_regex sexo
acl sexy url_regex sexy
acl batepapo url_regex batepapo
acl chat url_regex chat
acl icq url_regex icq
acl wbmsn url_regex www.wbmsn.net
acl freeproxy url_regex www.publicproxyservers.com
acl proxy url_regex proxy
acl hopSter url_regex hopster
acl radmsn url_regex rad.msn.com
acl ircd url_regex ircd
#acl meebo url_regex www.meebo.com
###

### Bloqueando as Regras
http_access deny arquivosex
http_access deny acontececg
http_access deny orkut
http_access deny gazzag
http_access deny msn2n
http_access deny emsn3
http_access deny msn4
http_access deny file
http_access deny playboy
http_access deny sexo
http_access deny sexy
http_access deny batepapo
http_access deny chat
http_access deny icq
http_access deny wbmsn
http_access deny freeproxy
http_access deny proxy
http_access deny hopSter
http_access deny radmsn
http_access deny ircd
#http_access deny meebo
####

## Bloqueando Hopster

#acl iphopster src 192.168.1.182
#acl HopsterPort port 443
#acl outraporta port 403
#acl Hopster dst 62.116.83.62
#http_access deny Hopster HopsterPort iphopster outraporta


### Regras liberando
##


### Bloqueio do MSN
#http_access deny msn
#http_access deny msn2

#Default:
#http_access deny all
#http_access allow senac

http_access allow manager localhost
http_access deny manager

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
############################
http_access allow localnet
############################

# And finally deny all other access to this proxy
#http_access allow localhost
#http_access deny all



# Deny requests to unknown ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow Safe_ports localhost
#http_access allow Safe_ports net
#http_access allow localhost
#visible_hostname proxy
#http_access deny all

#http_reply_access allow localnet

#icp_access allow localnet


http_access allow localhost
http_access deny all


icp_access allow localnet
icp_access deny all


# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
#
cache_effective_user squid
cache_effective_group squid
#
#Default:
# cache_effective_user squid
# cache_effective_group squid

#Default:

#httpd_accel_port 80
#httpd_accel_host virtual

#Default:
#httpd_accel_with_proxy on

#
#Default:
#httpd_accel_uses_host_header on


# MISCELLANEOUS
# -----------------------------------------------------------------------------

# TAG: dns_testnames
# The DNS tests exit as soon as the first site is successfully looked up
#
# This test can be disabled with the -D command line option.
#
#Default:
# dns_testnames netscape.com internic.net nlanr.net microsoft.com

# TAG: logfile_rotate
# Specifies the number of logfile rotations to make when you
# type 'squid -k rotate'. The default is 10, which will rotate
# with extensions 0 through 9. Setting logfile_rotate to 0 will
# disable the rotation, but the logfiles are still closed and
# re-opened. This will enable you to rename the logfiles
# yourself just before sending the rotate signal.
#
# Note, the 'squid -k rotate' command normally sends a USR1
# signal to the running squid process. In certain situations
# (e.g. on Linux with Async I/O), USR1 is used for other
# purposes, so -k rotate uses another signal. It is best to get
# in the habit of using 'squid -k rotate' instead of 'kill -USR1
# <pid>'.
#
#logfile_rotate 0
#
#Default:
# logfile_rotate 0

# TAG: append_domain
# Appends local domain name to hostnames without any dots in
# them. append_domain must begin with a period.
#
# Be warned that there today is Internet names with no dots in
# them using only top-domain names, so setting this may
# cause some Internet sites to become unavailable.
#
#Example:
# append_domain .yourdomain.com
#
#Default:
# none

# TAG: tcp_recv_bufsize (bytes)
# Size of receive buffer to set for TCP sockets. Probably just
# as easy to change your kernel's default. Set to zero to use
# the default buffer size.
#
#Default:
# tcp_recv_bufsize 0 bytes

# TAG: err_html_text
# HTML text to include in error messages. Make this a "mailto"
# URL to your admin address, or maybe just a link to your
# organizations Web page.
#
# To include this in your error messages, you must rewrite
# the error template files (found in the "errors" directory).
# Wherever you want the 'err_html_text' line to appear,
# insert a %L tag in the error template file.
#
#Default:
# none

# TAG: deny_info
# Usage: deny_info err_page_name acl
# Example: deny_info ERR_CUSTOM_ACCESS_DENIED bad_guys
#
# This can be used to return a ERR_ page for requests which
# do not pass the 'http_access' rules. A single ACL will cause
# the http_access check to fail. If a 'deny_info' line exists
# for that ACL then Squid returns a corresponding error page.
#
# You may use ERR_ pages that come with Squid or create your own pages
# and put them into the configured errors/ directory.
#
# Alternatively you can tell Squid to reset the TCP connection
# by specifying TCP_RESET.
#
#Default:
# none

# TAG: memory_pools on|off
# If set, Squid will keep pools of allocated (but unused) memory
# available for future use. If memory is a premium on your
# system and you believe your malloc library outperforms Squid
# routines, disable this.
#
#Default:
# memory_pools on

# TAG: memory_pools_limit (bytes)
# Used only with memory_pools on:
# memory_pools_limit 50 MB
#
# If set to a non-zero value, Squid will keep at most the specified
# limit of allocated (but unused) memory in memory pools. All free()
# requests that exceed this limit will be handled by your malloc
# library. Squid does not pre-allocate any memory, just safe-keeps
# objects that otherwise would be free()d. Thus, it is safe to set
# memory_pools_limit to a reasonably high value even if your
# configuration will use less memory.
#
# If not set (default) or set to zero, Squid will keep all memory it
# can. That is, there will be no limit on the total amount of memory
# used for safe-keeping.
#
# To disable memory allocation optimization, do not set
# memory_pools_limit to 0. Set memory_pools to "off" instead.
#
# An overhead for maintaining memory pools is not taken into account
# when the limit is checked. This overhead is close to four bytes per
# object kept. However, pools may actually _save_ memory because of
# reduced memory thrashing in your malloc library.
#
#Default:
# none

# TAG: forwarded_for on|off
# If set, Squid will include your system's IP address or name
# in the HTTP requests it forwards. By default it looks like
# this:
#
# X-Forwarded-For: 192.1.2.3
#
# If you disable this, it will appear as
#
# X-Forwarded-For: unknown
#
#Default:
# forwarded_for on

# TAG: log_icp_queries on|off
# If set, ICP queries are logged to access.log. You may wish
# do disable this if your ICP load is VERY high to speed things
# up or to simplify log analysis.
#
#Default:
# log_icp_queries on

# TAG: icp_hit_stale on|off
# If you want to return ICP_HIT for stale cache objects, set this
# option to 'on'. If you have sibling relationships with caches
# in other administrative domains, this should be 'off'. If you only
# have sibling relationships with caches under your control, then
# it is probably okay to set this to 'on'.
# If set to 'on', then your siblings should use the option "allow-miss"
# on their cache_peer lines for connecting to you.
#
#Default:
# icp_hit_stale off

# TAG: minimum_direct_hops
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many hops away.
#
#Default:
# minimum_direct_hops 4

# TAG: minimum_direct_rtt
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many rtt milliseconds away.
#
#Default:
# minimum_direct_rtt 400

# TAG: cachemgr_passwd
# Specify passwords for cachemgr operations.
#
# Usage: cachemgr_passwd password action action ...
#
# Some valid actions are (see cache manager menu for a full list):
# 5min
# 60min
# asndb
# authenticator
# cbdata
# client_list
# comm_incoming
# config *
# counters
# delay
# digest_stats
# dns
# events
# filedescriptors
# fqdncache
# histograms
# http_headers
# info
# io
# ipcache
# mem
# menu
# netdb
# non_peers
# objects
# pconn
# peer_select
# redirector
# refresh
# server_list
# shutdown *
# store_digest
# storedir
# utilization
# via_headers
# vm_objects
#
# * Indicates actions which will not be performed without a
# valid password, others can be performed if not listed here.
#
# To disable an action, set the password to "disable".
# To allow performing an action without a password, set the
# password to "none".
#
# Use the keyword "all" to set the same password for all actions.
#
#Example:
# cachemgr_passwd secret shutdown
# cachemgr_passwd lesssssssecret info stats/objects
# cachemgr_passwd disable all
#
#Default:
# none

# TAG: store_avg_object_size (kbytes)
# Average object size, used to estimate number of objects your
# cache can hold. See doc/Release-Notes-1.1.txt. The default is
# 13 KB.
#
#Default:
# store_avg_object_size 13 KB

# TAG: store_objects_per_bucket
# Target number of objects per bucket in the store hash table.
# Lowering this value increases the total number of buckets and
# also the storage maintenance rate. The default is 50.
#
#Default:
# store_objects_per_bucket 20

# TAG: client_db on|off
# If you want to disable collecting per-client statistics, then
# turn off client_db here.
#
#Default:
# client_db on

# TAG: netdb_low
# TAG: netdb_high
# The low and high water marks for the ICMP measurement
# database. These are counts, not percents. The defaults are
# 900 and 1000. When the high water mark is reached, database
# entries will be deleted until the low mark is reached.
#
#Default:
# netdb_low 900
# netdb_high 1000

# TAG: netdb_ping_period
# The minimum period for measuring a site. There will be at
# least this much delay between successive pings to the same
# network. The default is five minutes.
#
#Default:
# netdb_ping_period 5 minutes

# TAG: query_icmp on|off
# If you want to ask your peers to include ICMP data in their ICP
# replies, enable this option.
#
# If your peer has configured Squid (during compilation) with
# '--enable-icmp' then that peer will send ICMP pings to origin server
# sites of the URLs it receives. If you enable this option then the
# ICP replies from that peer will include the ICMP data (if available).
# Then, when choosing a parent cache, Squid will choose the parent with
# the minimal RTT to the origin server. When this happens, the
# hierarchy field of the access.log will be
# "CLOSEST_PARENT_MISS". This option is off by default.
#
#Default:
# query_icmp off

# TAG: test_reachability on|off
# When this is 'on', ICP MISS replies will be ICP_MISS_NOFETCH
# instead of ICP_MISS if the target host is NOT in the ICMP
# database, or has a zero RTT.
#
#Default:
# test_reachability off

# TAG: buffered_logs on|off
# cache.log log file is written with stdio functions, and as such
# it can be buffered or unbuffered. By default it will be unbuffered.
# Buffering it can speed up the writing slightly (though you are
# unlikely to need to worry unless you run with tons of debugging
# enabled in which case performance will suffer badly anyway..).
#
#Default:
# buffered_logs off

# TAG: reload_into_ims on|off
# When you enable this option, client no-cache or `reload''
# requests will be changed to If-Modified-Since requests.
# Doing this VIOLATES the HTTP standard. Enabling this
# feature could make you liable for problems which it
# causes.
#
# see also refresh_pattern for a more selective approach.
#
#Default:
# reload_into_ims off

# TAG: always_direct
# Usage: always_direct allow|deny [!]aclname ...
#
# Here you can use ACL elements to specify requests which should
# ALWAYS be forwarded directly to origin servers. For example,
# to always directly forward requests for local servers use
# something like:
#
# acl local-servers dstdomain my.domain.net
# always_direct allow local-servers
#
# To always forward FTP requests directly, use
#
# acl FTP proto FTP
# always_direct allow FTP
#
# NOTE: There is a similar, but opposite option named
# 'never_direct'. You need to be aware that "always_direct deny
# foo" is NOT the same thing as "never_direct allow foo". You
# may need to use a deny rule to exclude a more-specific case of
# some other rule. Example:
#
# acl local-external dstdomain external.foo.net
# acl local-servers dstdomain .foo.net
# always_direct deny local-external
# always_direct allow local-servers
#
# This option replaces some v1.1 options such as local_domain
# and local_ip.
#
#Default:
# none

# TAG: never_direct
# Usage: never_direct allow|deny [!]aclname ...
#
# never_direct is the opposite of always_direct. Please read
# the description for always_direct if you have not already.
#
# With 'never_direct' you can use ACL elements to specify
# requests which should NEVER be forwarded directly to origin
# servers. For example, to force the use of a proxy for all
# requests, except those in your local domain use something like:
#
# acl local-servers dstdomain .foo.net
# acl all src 0.0.0.0/0.0.0.0
# never_direct deny local-servers
# never_direct allow all
#
# or if squid is inside a firewall and there is local intranet
# servers inside the firewall then use something like:
#
# acl local-intranet dstdomain .foo.net
# acl local-external dstdomain external.foo.net
# always_direct deny local-external
# always_direct allow local-intranet
# never_direct allow all
#
# This option replaces some v1.1 options such as inside_firewall
# and firewall_ip.
#
#Default:
# none

# TAG: header_access
# Usage: header_access header_name allow|deny [!]aclname ...
#
# WARNING: Doing this VIOLATES the HTTP standard. Enabling
# this feature could make you liable for problems which it
# causes.
#
# This option replaces the old 'anonymize_headers' and the
# older 'http_anonymizer' option with something that is much
# more configurable. This new method creates a list of ACLs
# for each header, allowing you very fine-tuned header
# mangling.
#
# You can only specify known headers for the header name.
# Other headers are reclassified as 'Other'. You can also
# refer to all the headers with 'All'.
#
# For example, to achieve the same behaviour as the old
# 'http_anonymizer standard' option, you should use:
#
# header_access From deny all
# header_access Referer deny all
# header_access Server deny all
# header_access User-Agent deny all
# header_access WWW-Authenticate deny all
# header_access Link deny all
#
# Or, to reproduce the old 'http_anonymizer paranoid' feature
# you should use:
#
# header_access Allow allow all
# header_access Authorization allow all
# header_access Cache-Control allow all
# header_access Content-Encoding allow all
# header_access Content-Length allow all
# header_access Content-Type allow all
# header_access Date allow all
# header_access Expires allow all
# header_access Host allow all
# header_access If-Modified-Since allow all
# header_access Last-Modified allow all
# header_access Location allow all
# header_access Pragma allow all
# header_access Accept allow all
# header_access Accept-Charset allow all
# header_access Accept-Encoding allow all
# header_access Accept-Language allow all
# header_access Content-Language allow all
# header_access Mime-Version allow all
# header_access Retry-After allow all
# header_access Title allow all
# header_access Connection allow all
# header_access Proxy-Connection allow all
# header_access All deny all
#
# By default, all headers are allowed (no anonymizing is
# performed).
#
#Default:
# none

# TAG: header_replace
# Usage: header_replace header_name message
# Example: header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
#
# This option allows you to change the contents of headers
# denied with header_access above, by replacing them with
# some fixed string. This replaces the old fake_user_agent
# option.
#
# By default, headers are removed if denied.
#
#Default:
# none

# TAG: icon_directory
# Where the icons are stored. These are normally kept in
# /usr/share/squid/icons
#
#Default:
# icon_directory /usr/share/squid/icons

# TAG: error_directory
# Directory where the error files are read from.
# /usr/lib/squid/errors contains sets of error files
# in different languages. The default error directory
# is /etc/squid/errors, which is a link to one of these
# error sets.
#
# If you wish to create your own versions of the error files,
# either to customize them to suit your language or company,
# copy the template English files to another
# directory and point this tag at them.
#
error_directory /etc/squid/errors
#
#Default:
# error_directory /usr/share/squid/errors

# TAG: minimum_retry_timeout (seconds)
# This specifies the minimum connect timeout, for when the
# connect timeout is reduced to compensate for the availability
# of multiple IP addresses.
#
# When a connection to a host is initiated, and that host has
# several IP addresses, the default connection timeout is reduced
# by dividing it by the number of addresses. So, a site with 15
# addresses would then have a timeout of 8 seconds for each
# address attempted. To avoid having the timeout reduced to the
# point where even a working host would not have a chance to
# respond, this setting is provided. The default, and the
# minimum value, is five seconds, and the maximum value is sixty
# seconds, or half of connect_timeout, whichever is greater and
# less than connect_timeout.
#

# each address is tried once).
#
# The default value is three tries, the (not recommended)
# maximum is 255 tries. A warning message will be generated
# if it is set to a value greater than ten.
#
#Default:
# maximum_single_addr_tries 3

# TAG: snmp_port
# Squid can now serve statistics and status information via SNMP.
# A value of "0" disables SNMP support. If you wish to use SNMP,
# set this to "3401" to use the normal SNMP support.
#
#Default:
# snmp_port 0

# TAG: snmp_access
# Allowing or denying access to the SNMP port.
#
# All access to the agent is denied by default.
# usage:
#
# snmp_access allow|deny [!]aclname ...
#
#Example:
# snmp_access allow snmppublic localhost
# snmp_access deny all
#
#Default:
# snmp_access deny all

# TAG: snmp_incoming_address
# TAG: snmp_outgoing_address
# Just like 'udp_incoming_address' above, but for the SNMP port.
#
# snmp_incoming_address is used for the SNMP socket receiving
# messages from SNMP agents.
# snmp_outgoing_address is used for SNMP packets returned to SNMP
# agents.
#
# The default snmp_incoming_address (0.0.0.0) is to listen on all
# available network interfaces.
#
# If snmp_outgoing_address is set to 255.255.255.255 (the default)
# then it will use the same socket as snmp_incoming_address. Only
# change this if you want to have SNMP replies sent using another
# address than where this Squid listens for SNMP queries.
#
# NOTE, snmp_incoming_address and snmp_outgoing_address can not have
# the same value since they both use port 3401.
#
#Default:
# snmp_incoming_address 0.0.0.0
# snmp_outgoing_address 255.255.255.255

# TAG: as_whois_server
# WHOIS server to query for AS numbers. NOTE: AS numbers are
# queried only when Squid starts up, not for every request.
#
#Default:
# as_whois_server whois.ra.net
# as_whois_server whois.ra.net

# TAG: wccp_router
# Use this option to define your WCCP `home'' router for
# Squid. Setting the 'wccp_router' to 0.0.0.0 (the default)
# disables WCCP.
#
#Default:
# wccp_router 0.0.0.0

# TAG: wccp_version
# According to some users, Cisco IOS 11.2 only supports WCCP
# version 3. If you're using that version of IOS, change
# this value to 3.
#
#Default:
# wccp_version 4

# TAG: wccp_incoming_address
# TAG: wccp_outgoing_address
# wccp_incoming_address Use this option if you require WCCP
# messages to be received on only one
# interface. Do NOT use this option if
# you're unsure how many interfaces you
# have, or if you know you have only one
# interface.
#
# wccp_outgoing_address Use this option if you require WCCP
# messages to be sent out on only one
# interface. Do NOT use this option if
# you're unsure how many interfaces you
# have, or if you know you have only one
# interface.
#
# The default behavior is to not bind to any specific address.
#
# NOTE, wccp_incoming_address and wccp_outgoing_address can not have
# the same value since they both use port 2048.
#
#Default:
# wccp_incoming_address 0.0.0.0
# wccp_outgoing_address 255.255.255.255


# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
# -----------------------------------------------------------------------------

# TAG: delay_pools
# This represents the number of delay pools to be used. For example,
# if you have one class 2 delay pool and one class 3 delays pool, you
# have a total of 2 delay pools.
#
#Default:
# delay_pools 0

# TAG: delay_class
# This defines the class of each delay pool. There must be exactly one
# delay_class line for each delay pool. For example, to define two
# delay pools, one of class 2 and one of class 3, the settings above
# and here would be:
#
#Example:
# delay_pools 2 # 2 delay pools
# delay_class 1 2 # pool 1 is a class 2 pool
# delay_class 2 3 # pool 2 is a class 3 pool
#
# The delay pool classes are:
#
# class 1 Everything is limited by a single aggregate
# bucket.
#
# class 2 Everything is limited by a single aggregate
# bucket as well as an "individual" bucket chosen
# from bits 25 through 32 of the IP address.
#
# class 3 Everything is limited by a single aggregate
# bucket as well as a "network" bucket chosen
# from bits 17 through 24 of the IP address and a
# "individual" bucket chosen from bits 17 through
# 32 of the IP address.
#
# NOTE: If an IP address is a.b.c.d
# -> bits 25 through 32 are "d"
# -> bits 17 through 24 are "c"
# -> bits 17 through 32 are "c * 256 + d"
#
#Default:
# none

# TAG: delay_access
# This is used to determine which delay pool a request falls into.
# The first matched delay pool is always used, i.e., if a request falls
# into delay pool number one, no more delay are checked, otherwise the
# rest are checked in order of their delay pool number until they have
# all been checked. For example, if you want some_big_clients in delay
# pool 1 and lotsa_little_clients in delay pool 2:
#
#Example:
# delay_access 1 allow some_big_clients
# delay_access 1 deny all
# delay_access 2 allow lotsa_little_clients
# delay_access 2 deny all
#
#Default:
# none

# TAG: delay_parameters
# This defines the parameters for a delay pool. Each delay pool has
# a number of "buckets" associated with it, as explained in the
# description of delay_class. For a class 1 delay pool, the syntax is:
#
#delay_parameters pool aggregate
#
# For a class 2 delay pool:
#
#delay_parameters pool aggregate individual
#
# For a class 3 delay pool:
#
#delay_parameters pool aggregate network individual
#
# The variables here are:
#
# pool a pool number - ie, a number between 1 and the
# number specified in delay_pools as used in
# delay_class lines.
#
# aggregate the "delay parameters" for the aggregate bucket
# (class 1, 2, 3).
#
# individual the "delay parameters" for the individual
# buckets (class 2, 3).
#
# network the "delay parameters" for the network buckets
# (class 3).
#
# A pair of delay parameters is written restore/maximum, where restore is
# the number of bytes (not bits - modem and network speeds are usually
# quoted in bits) per second placed into the bucket, and maximum is the
# maximum number of bytes which can be in the bucket at any time.
#
# For example, if delay pool number 1 is a class 2 delay pool as in the
# above example, and is being used to strictly limit each host to 64kbps
# (plus overheads), with no overall limit, the line is:
#
#delay_parameters 1 -1/-1 8000/8000
#
# Note that the figure -1 is used to represent "unlimited".
#
# And, if delay pool number 2 is a class 3 delay pool as in the above
# example, and you want to limit it to a total of 256kbps (strict limit)
# with each 8-bit network permitted 64kbps (strict limit) and each
# individual host permitted 4800bps with a bucket maximum size of 64kb
# to permit a decent web page to be downloaded at a decent speed
# (if the network is not being limited due to overuse) but slow down
# large downloads more significantly:
#
#delay_parameters 2 32000/32000 8000/8000 600/64000
#
# There must be one delay_parameters line for each delay pool.
#
#Default:
# none

# TAG: delay_initial_bucket_level (percent, 0-100)
# The initial bucket percentage i

pelo
(usa Debian)

Enviado em 19/03/2009 - 23:23h

Qualquer coisa também de uma olhada nesse script

http://www.vivaolinux.com.br/etc/rc.firewall-pelo

Sérgio Abrantes

junior
(usa Ubuntu)

Enviado em 26/03/2009 - 14:10h

Então amigo, fico feliz de saber que seu problema foi resolvido!

Pode nos contar o que fez? Se apenas seguiu as dicas ou fez algo mais??

Um abraço!