Squid 2.6 Transparent

edmeneghel
(usa Debian)

Enviado em 17/06/2011 - 17:22h

Boa noite pessoal, eu queria uma ajuda para vocês, estou tentando configurar o squid transparente mas ele não funciona!!! abaixo as regras de IPTABLES e a configuracao do squid... o que pode estar errado

OBS: Se eu configuro manualmente funciona normal!


Regras do SQUID
------------------------------------------------------------------------------------------------------
authenticate_ttl 1 hour
authenticate_ip_ttl 0 seconds


################
# Autenticacao #
################
#auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd
#auth_param basic children 5
#auth_param basic realm Digite Seu Usuario e senha




#####################
# Regras do Sistema #
#####################
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 #https
acl SSL_ports port 333 # nat RHM
acl SSL_ports port 21 # ftp
acl SSL_ports port 3001 # imprensa nacional
acl SSL_ports port 8004 # imprensa nacional
acl SSL_ports port 8000 # radio itaguacu
acl SSL_ports port 8443 # http
acl Safe_ports port 8080 # http
acl Safe_ports port 8000 # radio itaguacu
acl Safe_ports port 80 # http
acl Safe_ports port 8001 # http
acl Safe_ports port 8443 # http
acl Safe_ports port 333 # nat RHM
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 3001 # imprensa nacional
acl Safe_ports port 8004 # imprensa nacional
acl Safe_ports port 7003 # vivo
acl Safe_ports port 11438 # tecsystem
acl Safe_ports port 110 # pop
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT






#################
# Minhas Regras #
#################
#bloqueios
acl blkPorno url_regex -i "/etc/squid/bloqueios/blkPorno.txt"
#/fim bloqueios###########################################################






####################
# Acoes do Sistema #
####################
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost





################
# Minhas Acoes #
################
#bloqueia arquivos maiores que 30mb
reply_body_max_size 30000000 allow all
#bloqueio de sites [*****]
http_access deny blkPorno






##########################
# Configuracoes do squid #
##########################
http_access allow all
icp_access allow all
http_port 3128 transparent
#ftp em modo passivo
ftp_passive on
hierarchy_stoplist cgi-bin ?
cache_mem 100 MB
maximum_object_size_in_memory 8 KB
cache_dir ufs /var/spool/squid 5000 16 256
minimum_object_size 0 KB
maximum_object_size 4096 KB
cache_swap_low 90
cache_swap_high 95
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
logfile_rotate 0
mime_table /etc/squid/mime.conf
pid_filename /var/run/squid.pid
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
negative_ttl 5 minutes
positive_dns_ttl 6 hours
negative_dns_ttl 1 minute
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
ie_refresh off
mail_program mail
snmp_incoming_address 0.0.0.0
snmp_outgoing_address 255.255.255.255
error_directory /usr/share/squid/errors/Portuguese
coredump_dir /var/spool/squid
visible_hostname Server
------------------------------------------------------------------------------------------------------
fim das regras do SQUID

------------------------------------------------------------------------------------------------------
REGRAS DO IPTABLES
------------------------------------------------------------------------------------------------------
#!/bin/bash

clear

##############
# Constantes #
##############
IPT=`which iptables` #pega o caminho do iptables (diretorio + arquivo)
REDELOCAL="10.0.0.0/24"
IF_EXT="eth1"
IF_INT="eth0"
FW="10.0.0.1"

# Funcao para exibir mensagem
exibemsg(){
printf %s" " $msg;
for i in $(seq 15) ; do
printf "."
done
echo " [OK]"
}

# Habilida o repasse de pacote no kernel (/etc/sysctl.conf melhor opcao)
echo "1" > /proc/sys/net/ipv4/ip_forward
#exibe mensagem na tela
msg="Habilitando o repasse de pacote"
exibemsg
#fim mensagem

########################################
# INICIO DAS CONFIGURACOES DO FIREWALL #
########################################

# inicio ##########################################
# Limpa o conteudos das tabelas
$IPT -F -t filter
$IPT -F -t nat
$IPT -F -t mangle
#exibe mensagem na tela
msg="Limpando os pacotes"
exibemsg
#fim mensagem
# fim ##########################################

# inicio ##########################################
# Zera os Contadores de Acesso das tabelas
$IPT -Z -t filter
$IPT -Z -t nat
$IPT -Z -t mangle
#exibe mensagem na tela
msg="Zerando os pacotes"
exibemsg
#fim mensagem
# fim ##########################################

# inicio #########################################################
# Muda a opcao padrao da tabela INPUT de ACCEPT para DROP
$IPT -t filter -P INPUT DROP
$IPT -t filter -P FORWARD DROP
#exibe mensagem na tela
msg="alterando policy das tabelas para DROP"
exibemsg
#fim mensagem
# fim #########################################################

# Levanta Modulos
#modprobe ipt_layer7
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
#exibe mensagem na tela
msg="Levantando modulos do iptables"
exibemsg
#fim mensagem

# /modulos

# inicio #########################################################

###########################
# Regra para mascaramento #
###########################
#o que chegar pela interface eth0 sera mascarado
$IPT -t nat -A POSTROUTING -s $REDELOCAL -o $IF_EXT -j MASQUERADE

#exibe mensagem na tela
msg="Ativando o mascaramento (libera net)"
exibemsg
#fim mensagem
# fim ##########################################################

# inicio ##########################################################

######################
# proxy transparente #
######################
$IPT -t nat -A PREROUTING -i $IF_INT -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPT -t nat -A PREROUTING -s $REDELOCAL -p tcp --dport 443 -j REDIRECT --to-port 3128
$IPT -t nat -A PREROUTING -s $REDELOCAL -p tcp --dport 8080 -j REDIRECT --to-port 3128
$IPT -t filter -A INPUT -s $REDELOCAL -p tcp --dport 3128 -j ACCEPT
# libera Consulta DNS
$IPT -A FORWARD -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 53 -j ACCEPT

#exibe mensagem na tela
msg="Ativando proxy transparente"
exibemsg
#fim mensagem
# fim ##########################################################

# inicio ###################################################

###################
# Regras Servicos #
###################

# liberando pacotes de retorno (repasse)
$IPT -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#exibe mensagem na tela
msg="Liberando repasse de pacote"
exibemsg
#fim mensagem

# Liberar Loopback
$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A OUTPUT -o lo -j ACCEPT
$IPT -t filter -A FORWARD -i lo -j ACCEPT
#exibe mensagem na tela
msg="Liberando loopback -> FW"
exibemsg
#fim mensagem

# Regra para Liberar SSH
$IPT -t filter -A INPUT -p tcp --dport 6022 -j ACCEPT
#exibe mensagem na tela
msg="Liberando SSH -> FW"
exibemsg
#fim mensagem

# Limite contra ping da morte e DoS
$IPT -t filter -A INPUT -p icmp --icmp-type echo-reply -m limit --limit 1/s -j DROP
#exibe mensagem na tela
msg="Bloqueando ataques comuns"
exibemsg
#fim mensagem