> estou com problema: tenho um servidor rodando o squid e o iptables que
> recebe o link da internet e repassa para os usuários o ip 192.168.1.0/24mascara 255.255.255.0 gateway 192.168.1.1. Aí
> dentro dessa rede tenho outro servidor que recebe o ip de entrada
> 192.168.1.10 e repassa para os usuários 192.168.2.0/24. Se eu desabilitar
> o iptables der aqueles 3 comandos somente para navegar funciona
> estou quebrando a cabeça e não acho o erro segue meu iptables e meu squid,
> uso as mesmas regras nos dois somente ajustando os ips e interfaces.
>
> auth_param basic children 5
> auth_param basic realm Squid proxy-caching web server
> auth_param basic credentialsttl 2 hours
> #acl chefe src 192.168.2.10/255.255.255.255
> #acl horario2 time SMTWHFA 00:00-24:00
> #http_access allow chefe horario2
> #acl funcionario src 192.168.2.0/24
> #acl horario1 time SMTWHFA 7:30-12:00
> #http_access deny funcionario horario1
> #acl dpc2 src 192.168.2.10/255.255.255.255
> #reply_body_max_size 9999999999 deny dpc2
> #acl tamanho src 192.168.2.0/24
> #reply_body_max_size 20971520 deny tamanho
> acl REDE_CLIENTES src 192.168.1.0/24
> acl DOWNLOADS url_regex -i .zip .exe .bz .bz2 .avi .iso .mp3 .dll .mpg .flv
> .mpeg .mov .asf .rmvb .rm .mpe$
> acl PAGINAS url_regex -i .htm .html .xhtml .gif .jpeg .swf .js .jar .php
> .asp .ccs .jpg .png .ico .swf .aspx .jsp .bmp .cfg .ajs .txt .$
> delay_pools 2
> delay_class 1 2
> delay_parameters 1 -1/-1 -1/-1
> delay_access 1 allow PAGINAS !DOWNLOADS
> delay_class 2 2
> delay_parameters 2 50000/50000 50000/50000
> delay_access 2 allow DOWNLOADS
> acl rede src 192.168.1.0/255.255.255.0
> acl pc1 src 192.168.1.9/255.255.255.255
> acl pc2 src 192.168.1.10/255.255.255.255
> acl pc3 src 192.168.1.20/255.255.255.255
> acl pc4 src 192.168.1.87/255.255.255.255
> acl all src 192.168.1.0/255.255.255.0
> acl manager proto cache_object
> acl localhost src 127.0.0.1/255.255.255.255
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
> #windows update windows xp
> refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200
> reload-into-ims
> refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100%
> 43200 reload-into-ims
> refresh_pattern www.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200
> reload-into-ims
> refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320
> 100% 43200 reload-into-ims
> #windows update windows vista
> refresh_pattern download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100%
> 43200 reload-into-ims
> refresh_pattern update.microsoft.com/.*\.(cab|exe|dll|msi) 4320 100% 43200
> reload-into-ims
> acl negado url_regex "/etc/squid/negado.txt"
> acl liberado url_regex "/etc/squid/liberado.txt"
> http_access allow pc1
> http_access allow pc2
> http_access allow pc3
> http_access allow pc4
> http_access allow liberado rede
> http_access deny negado rede
> http_access allow rede !negado
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localhost
> http_access deny all
> http_reply_access allow all
> icp_access allow localhost
> #icp_access deny all
> icp_access allow all
> http_port 192.168.1.1:3128 transparent
> #zph_mode tos
> #zph_local 0x02
> #zph_parent 0
> #zph_option 136
> acl sem_cache url_regex "/etc/squid/sem_cache.txt" \?
> no_cache deny sem_cache
> hierarchy_stoplist cgi-bin ? .asp .aspx #.php
> acl QUERY urlpath_regex cgi-bin \? .asp .aspx #.php
> no_cache deny QUERY
> cache_mem 128 MB
> maximum_object_size_in_memory 64 KB
> cache_replacement_policy heap LFUDA
> memory_replacement_policy heap GDSF
> cache_dir ufs /var/spool/squid 4096 16 256
> minimum_object_size 0 KB
> maximum_object_size 200 MB
> cache_swap_low 90
> cache_swap_high 95
> access_log /var/log/squid/access.log squid
> cache_log /var/log/squid/cache.log
> cache_store_log /var/log/squid/store.log
> logfile_rotate 1
> emulate_httpd_log on
> client_netmask 255.255.255.255
> ftp_list_width 32
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
> refresh_pattern (Release|Package(.gz)*)$ 0 20% 2880
> refresh_pattern . 0 0% 0
> quick_abort_min 10 KB
> quick_abort_max 10 KB
> quick_abort_pct 2
> negative_ttl 5 minutes
> positive_dns_ttl 6 hours
> negative_dns_ttl 1 minute
> connect_timeout 2 minutes
> read_timeout 15 minutes
> request_timeout 2 minutes
> acl apache rep_header Server ^Apache
> broken_vary_encoding allow apache
> collapsed_forwarding on
> ie_refresh on
> client_lifetime 1 day
> cache_effective_user proxy
> visible_hostname servidor camara municipal
> detect_broken_pconn on
> #icp_port 0
> #htcp_port 0
> http_port 3128
> icp_port 3130
> error_directory /usr/share/squid/errors/Portuguese
> ipcache_size 1024
> ipcache_low 90
> ipcache_high 95
> fqdncache_size 1024
> memory_pools on
> offline_mode on
> coredump_dir /var/spool/squid
> pipeline_prefetch on
> #dns_nameservers 208.67.222.222 208.67.220.220
> dns_nameservers 189.42.142.75 200.255.212.201
>
> ___________________________________________________________________________________________
>
>
> #!/bin/bash
>
> iniciar(){
>
> modprobe iptable_nat
> echo 1 > /proc/sys/net/ipv4/ip_forward
> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128
> iptables -t nat -A PREROUTING -p udp --dport 80 -j REDIRECT --to-port 3128
> #iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp --dport 53 -j
> REDIRECT --to-port 53
> #saida
> iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 80 -j TOS --set-tos 16
> iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 443 -j TOS --set-tos 16
> iptables -t mangle -A OUTPUT -o eth1 -p udp --dport 53 -j TOS --set-tos 16
> iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 3128 -j TOS --set-tos
> 16
> iptables -t mangle -A OUTPUT -o eth1 -p udp --dport 3128 -j TOS --set-tos
> 16
> #entrada
> iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport 80 -j TOS --set-tos
> 0x10
> iptables -t mangle -A PREROUTING -i eth1 -p udp --sport 53 -j TOS --set-tos
> 0x10
> iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport 443 -j TOS
> --set-tos 0x10
> iptables -t mangle -A PREROUTING -i eth1 -p tcp --sport 3128 -j TOS
> --set-tos 0x10
> iptables -t mangle -A PREROUTING -i eth1 -p udp --sport 3128 -j TOS
> --set-tos 0x10
> echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> iptables -A INPUT -p tcp --syn -s 192.168.1.0/24 -j ACCEPT
> iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s
> -j ACCEPT
> iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit
> 1/s -j ACCEPT
> iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 1935 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 1863 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 1437 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 1126 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 5050 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 2559 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 60139 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 60692 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 3276 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 60923 -j DROP
> iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 3442 -j DROP
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to
> 192.168.1.29
> }
>
> parar(){
> iptables -F
> iptables -t nat -F
> }
>
> case "$1" in
> "start") iniciar ;;
> "stop") parar ;;
> "restart") parar; iniciar ;;
> *) echo "Use os parâtros start ou stop"
> esac
>
>
> __________ Informa�ão do ESET NOD32 Antivirus, versão da vacina 4529
> (20091021) __________
>
> A mensagem foi verificada pelo ESET NOD32 Antivirus.
>
>
http://www.eset.com>
> --
> Site da Comunidade GITEC
>
http://colab.interlegis.gov.br>
> Para pesquisar o histórico da lista visite:
>
http://colab.interlegis.gov.br/wiki/PesquisaListas>
> Para administrar sua conta visite:
>
http://listas.interlegis.gov.br/mailman/listinfo/gitec>
Alexandre
Oct. 21, 2009, 4:45 p.m.estou com problema: tenho um servidor rodando o squid e o iptables que recebe o link da internet e repassa para os usuários o ip 192.168.1.0/24 mascara 255.255.255.0 gateway 192.168.1.1.
Angelo Marcondes
