Ajuda Squid / Iptables com duas placas de rede

edgarrodriguesde
(usa Suse)

Enviado em 03/04/2014 - 15:41h

Boa tarde pessoal, estou tentando rodar um squid transparente com iptables, mais não conseguindo fazer com que o trafego da porta 80 seja redirecionada para a 3128 do squid.

Utilizo o Suse 11 e Squid 2.7.

O squid roda perfeitamente se eu colocar o proxy manual nos navegadores.

Segue meu Squid.conf

http_port 192.168.50.1:3128 transparent

visible_hostname Wirelles
acl all src 0.0.0.0/0.0.0.0
always_direct allow all

acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563 873
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 873 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # swat
acl Safe_ports port 1025-65535 # portas altas
acl purge method PURGE
acl CONNECT method CONNECT


http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports


acl redelocal src 192.168.50.0/24

http_access allow localhost
http_access allow redelocal
http_access deny all


Meu iptables:

#!/bin/sh

# Internet
INET_IP="172.16.8.82"
INET_IFACE="eth0"
INET_BROADCAST="172.16.8.255"

# LAN
WL_IP="192.168.50.1"
WL_IP_RANGE="192.168.50.0/24"
WL_IFACE="eth1"

# localhost
LO_IFACE="lo"
LO_IP="127.0.0.1"

# Pacotes TCP - Entrando
TCP_IN="domain,3128"

# Pacotes UDP - Portas RPC
UDP_RPC="135:139"
TCP_RPC="135:139"

# Pacotes UDP - Entrando e Saindo
UDP_INOUT="domain"

#IPT="/usr/sbin/iptables"
IPT="/sbin/iptables"

/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_REJECT
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc

# Limpeza e Exclusao de regras e chains
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t filter -F
$IPT -t filter -X

# Ativacao do redirecionamento de pacotes
echo 1 > /proc/sys/net/ipv4/ip_forward

# Protecao contra IP Spoofing
for i in /proc/sys/net/ipv4/conf/*/rp_filter;
do echo 1 >$i
done

# Numero maximo de conexoes simultaneas
echo "512" > /proc/sys/net/ipv4/ip_conntrack_max

$IPT -N LOG_DROP
$IPT -A LOG_DROP -j LOG --log-prefix "Firewall: "
$IPT -A LOG_DROP -j DROP

# Inspecao em pacotes TCP (malformados, mal-intencionados)
$IPT -N pct_tcp_mformados

# Protecao contra IP Spoofing - Sequence Number Prediction
$IPT -A pct_tcp_mformados -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j REJECT \
--reject-with tcp-reset

# Tentativa de uma nova conexao numa conexao ja estabelecida
#$IPT -A pct_tcp_mformados -p tcp ! --syn -m state --state NEW -j LOG \
# --log-prefix "Pct Novo - sem SYN "
$IPT -A pct_tcp_mformados -p tcp ! --syn -m state --state NEW -j DROP


# Chain INPUT
$IPT -P INPUT DROP
$IPT -A INPUT -p tcp -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPT -A INPUT -p tcp -i $INET_IFACE -m state --state ! ESTABLISHED,RELATED \
# -j LOG --log-prefix "Tentativa de Invasao"

# Excessos de broadcasts nas portas RPC
$IPT -A INPUT -p tcp --dport $TCP_RPC -j DROP
$IPT -A INPUT -p udp --dport $UDP_RPC -j DROP
$IPT -A INPUT -p tcp -j pct_tcp_mformados

#$IPT -A INPUT -p tcp -i $INET_IFACE --syn -m multiport --dports $TCP_IN -j ACCEPT
#$IPT -A INPUT -p tcp -i $LAN_IFACE --syn -m multiport --dports $TCP_IN -j ACCEPT
$IPT -A INPUT -p tcp -i $INET_IFACE --syn --dport ssh -j ACCEPT
$IPT -A INPUT -p tcp -i $WL_IFACE -s $WL_IP_RANGE -j ACCEPT
$IPT -A INPUT -p all -s $LO_IP -j ACCEPT

# Bloquear Ataques DoS na chain INPUT
$IPT -A INPUT -p icmp -i $INET_IFACE -m limit --limit 1/s -j ACCEPT

$IPT -A INPUT -p udp --dport 53 -j ACCEPT
$IPT -A INPUT -p udp --sport 53 -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT
$IPT -A INPUT -p tcp -d 0/0 -s 0/0 --dport 5666 -j ACCEPT # Porta NRPE - Nagios

# Criar LOG e DROPar tudo que nao foi estabelecido
#$IPT -A INPUT -j LOG_DROP

# Chain FORWARD
$IPT -P FORWARD DROP
$IPT -A FORWARD -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -p tcp -j pct_tcp_mformados
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 172.16.8.1 -j ACCEPT
$IPT -A FORWARD -p udp -s $WL_IP_RANGE -d 172.16.8.1 -j ACCEPT
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 172.16.8.47 -j ACCEPT
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 172.16.8.47 -j ACCEPT
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 172.16.8.43 --dport 8082 -j ACCEPT
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 172.16.8.0/21 -j ACCEPT #DROP
$IPT -A FORWARD -p udp -s $WL_IP_RANGE -d 172.16.8.0/21 -j ACCEPT #DROP
$IPT -A FORWARD -p tcp -s $WL_IP_RANGE -d 0/0 -j ACCEPT
$IPT -A FORWARD -p udp -s $WL_IP_RANGE -d 0/0 -j ACCEPT

# Libera acesso VPN
$IPT -A INPUT -p TCP --dport 1723 -j ACCEPT
$IPT -A OUTPUT -p TCP --dport 1723 -j ACCEPT
$IPT -A FORWARD -p TCP -m multiport --dport 1723,1701 -j ACCEPT
$IPT -A FORWARD -p UDP -m multiport --dport 1723,1701 -j ACCEPT

$IPT -A INPUT -p 47 -j ACCEPT
$IPT -A OUTPUT -p 47 -j ACCEPT
$IPT -A FORWARD -p 47 -j ACCEPT

# Enxergar a rede 172.16.<F3>
$IPT -A FORWARD -i eth1 -s 192.168.50.0/24 -d 172.16.8.0/21 -j ACCEPT
$IPT -A INPUT -p tcp --dport 2084 -j ACCEPT

# Bloquear Ataques DoS na chain FORWARD
$IPT -A FORWARD -p icmp -i $INET_IFACE -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p icmp -i $WL_IFACE -m limit --limit 1/s -j ACCEPT

$IPT -P OUTPUT ACCEPT

# Criar LOG e DROPar tudo que nao foi estabelecido
#$IPT -A FORWARD -j LOG_DROP

# Nat Table
$IPT -t nat -P PREROUTING ACCEPT
#Redirecionando o trafego da porta 80 para o Squid
$IPT -t nat -A PREROUTING -i $WL_IFACE -p tcp --dport 80 -j REDIRECT --to-port 3128

$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

# Mangle Table
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT


Quanto tento acessar via Telnet o proxy na porta 80 ela não esta aberta. Já quanto tento na 3128 ele aceita as conexões. Será o que estou fazendo de errado?