Proxy Transparente não bloqueia [RESOLVIDO]

1. Proxy Transparente não bloqueia [RESOLVIDO]

xlinux
(usa Ubuntu)

Enviado em 02/10/2013 - 10:21h

Bom dia Pessoal,

Aqui de novo rsrsr....

Mas o seguinte não consigo fazer o squid barrar o sites bloqueados vou postar aí minhas regras....

Firewall

#!/bin/sh
# Start/stop/restart the iptables.

# Start firewall:
firewall_start() {
echo "Starting iptables"

## CARREGAR MODULOS DE FIREWALL ##

modprobe ip_nat_ftp
modprobe ip_tables

## LIMPANDO TABELAS ##

/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT

/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT

/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F INPUT
/sbin/iptables -t mangle -F FORWARD
/sbin/iptables -t mangle -F OUTPUT
/sbin/iptables -t mangle -F POSTROUTING

## DEFININDO POLITICA PADRÃO ##

/sbin/iptables -t filter -P INPUT DROP
/sbin/iptables -t filter -P FORWARD DROP
/sbin/iptables -t filter -P OUTPUT ACCEPT

/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT

/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT

# REGRAS ##

IPTABLES="/sbin/iptables"

IFNET="eth0"
IFLAN="eth1"
#IFVPN="tun0"

## LIBERA LOOPBACK ##

$IPTABLES -t filter -A INPUT -j ACCEPT -i lo

## LIBERA RETORNO DE PACOTES ##

$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFNET -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED

## LIBERA PARA LAN O ENVIO DE PING PARA WAN ##

$IPTABLES -t filter -A FORWARD -j ACCEPT -i $IFLAN -o $IFNET -p icmp

## LIBERA ACESSO AO DNS SERVER PARA LAN##

$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.8.8 -p udp --dport 53
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.4.4 -p udp --dport 53

# LIBERA O ACESSO A CLIENTES DE EMAIL,POP E SMTP
iptables -A FORWARD -p tcp -m multiport --dports 25,110,143,993,995 -j ACCEPT

# LIBERA O ACESSO AO http https FTP
iptables -A FORWARD -p tcp -m multiport --dports 21,80,443,8080 -j ACCEPT

$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

}
# Stop firewall:
firewall_stop() {
/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT

/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT

/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
}

# Restart firewall:
firewall_restart() {
firewall_stop
sleep 1
firewall_start
}

case "$1" in
'start')
firewall_start
;;
'stop')
firewall_stop
;;
'restart')
firewall_restart
;;
*)
echo "usage $0 start|stop|restart"
esac

Squid

http_port 3128 transparent
visible_hostname atenas
error_directory /usr/share/squid/errors/Portuguese
#--Tamanho do cache da RAM usado pelo squid
cache_dir ufs /var/cache/squid 4096 16 256

#Log
cache_access_log /var/log/squid/access.log

#Porcentagem de atualizacao do cache -limpo ao atingir o maximo
cache_swap_low 85
cache_swap_high 90

#Memória do cache
cache_mem 512 MB

#Usar o máximo de memória possível
memory_pools on
memory_pools_limit 2048 MB

#Tamanho máximo de arquivos alocados na RAM
maximum_object_size_in_memory 2048 KB
maximum_object_size 4096 KB

#Maximo e Minimo armazenados no disco
maximum_object_size 512 MB
minimum_object_size 0 KB

#CONFIGURAÇÃO MÍNIMA##
acl manager proto cache_object
acl localnet src 127.0.0.1/255.255.255.255
acl to_localnet dst 127.0.0.0/8
acl all src 0.0.0.0/0.0.0.0
acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 81 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 1443 1494 11090 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 1433 # sql
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # [*****]
acl Safe_ports port 5432
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

##ACLS

acl bloqueados url_regex -i "/etc/squid/bloqueados/block.txt"
http_access deny bloqueados
acl redelocal src 192.168.1.0/24
#acl hora_manha time MTWHF 07:00-11:30
#acl hora_tarde time MTWHF 14:00-19:00
#acl hosts_macaddress arp "/etc/squid3/"

##Controle de acesso

http_access allow localnet
http_access allow localnet
http_access allow all
# Email do ADM Cache Squid
#cache_mgr webmaster usuario@dominio.com.br

No meu arquivo block.txt coloco os sites assim:

www.globo.com
www.terra.com.br

É a nomeclatura certa para se colocar????
Obrigado

0 0

Quote