viniciuspedra
(usa Debian)
Enviado em 28/06/2013 - 10:56h
segue meu squid.conf e o firewall
squid.conf
# ---- Cache do Windows Update ----
refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern
www.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims
# ----
http_port 3128 transparent
visible_hostname server.internet
cache_mem 128 MB
maximum_object_size_in_memory 200 KB
maximum_object_size 300 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid/cache1 5000 16 256
cache_dir ufs /var/spool/squid/cache2 5000 16 256
cache_dir ufs /var/spool/squid/cache3 5000 16 256
cache_dir ufs /var/spool/squid/cache4 5000 16 256
cache_dir ufs /var/spool/squid/cache5 5000 16 256
cache_dir ufs /var/spool/squid/cache6 5000 16 256
cache_dir ufs /var/spool/squid/cache7 5000 16 256
cache_dir ufs /var/spool/squid/cache8 5000 16 256
cache_dir ufs /var/spool/squid/cache9 5000 16 256
cache_dir ufs /var/spool/squid/cache10 5000 16 256
cache_access_log /var/log/squid/access.log
error_directory /usr/share/squid/errors/Portuguese/
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
acl all src 0.0.0.0/0.0.0.0
acl lan src 192.168.120.0/24
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443
acl SSL_ports port 563
acl Safe_ports port 80 # http
acl Safe_ports port 53 # dns
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 #https
acl Safe_ports port 563 # snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl Safe_ports port 25 # Email
acl Safe_ports port 110 # Email
acl Safe_ports port 143 # Imap
acl Safe_ports port 2096 # Webmail
acl Safe_ports port 8001 # IRC
acl Safe_ports port 6667 # IRC
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
#http_access allow Safe_ports
http_access deny CONNECT !SSL_ports
# URL BLOQUEADOS
acl bloqueados url_regex -i "/etc/squid/palavras/bloqueados.txt"
# URL LIBERADOS
acl desbloqueados url_regex -i "/etc/squid/palavras/desbloqueados.txt"
# URL COM MALWARE
acl malware url_regex -i "/etc/squid/palavras/malware.txt"
# CONTROLE POR MAC - LIBERADOS
acl macliberado arp "/etc/squid/mac/liberados.txt"
# C0NTROLE DE BANDA
acl 512k arp "/etc/squid/velocidade/512k.txt"
acl 1024k arp "/etc/squid/velocidade/1024k.txt"
acl 1536k arp "/etc/squid/velocidade/1536k.txt"
acl 2048k arp "/etc/squid/velocidade/2048k.txt"
acl 2560k arp "/etc/squid/velocidade/2560k.txt"
acl 3072k arp "/etc/squid/velocidade/3072k.txt"
delay_pools 6
delay_class 1 2
delay_access 1 allow 512k
delay_class 2 2
delay_access 2 allow 1024k
delay_class 3 2
delay_access 3 allow 1536k
delay_class 4 2
delay_access 4 allow 2048k
delay_class 5 2
delay_access 5 allow 2560k
delay_class 6 2
delay_access 6 allow 3072k
delay_access 2 allow lan
delay_parameters 1 -1/-1 51200/51200
delay_parameters 2 -1/-1 102400/102400
delay_parameters 3 -1/-1 153600/153600
delay_parameters 4 -1/-1 204800/204800
delay_parameters 5 -1/-1 256000/256000
delay_parameters 6 -1/-1 307200/307200
#########################################
http_access deny malware
http_access deny bloqueados !desbloqueados
http_access deny all !macliberado !desbloqueados
# REDES INTERNAS QUE TEM ACESSO A INTERNET
acl redelocal src 192.168.120.0/24
http_access allow redelocal
http_access allow localhost
# BLOQUEIA A NAVEGACAO. SOMENTE LISTADOS ACIMA QUE PODEM NAVEGAR
http_access deny all
firewall.sh
#!/bin/bash
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "==== : Compartilhando a conexao: OK!"
iptables -F
iptables -t nat -F
iptables -t mangle -F
echo "==== : Limpando as regras existentes: OK!"
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 192.168.120.0/255.255.0.0 -o eth1 -j MASQUERADE
echo "==== : Compartilhamento de internet atrav�s de mascaramento: OK!"
iptables -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 443 -j ACCEPT
echo "==== : Liberando acesso HTTPS: OK!"
iptables -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
echo "==== : Liberando DNS: OK!"
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "==== : Redirecionando trafego da 80 para a 3128: OK!"
