slacky.eu

ragazzi dopo avere installato Samba come pdc sto cercando ora di far funzionare Squid sulla stessa macchina. In rc.local ho impostto alcune regole di firewalling e masquerade:
 
 echo 1 > /proc/sys/net/ipv4/ip_forward
 iptables -F
 iptables -P INPUT DROP
 iptables -P OUTPUT ACCEPT
 iptables -P FORWARD DROP
 iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 iptables -A INPUT -p tcp --dport 53 -j ACCEPT
 iptables -A INPUT -i eth0 -j ACCEPT
 iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j DROP
 iptables -A FORWARD -s 10.0.0.0/8 -i eth1 -j DROP
 iptables -A INPUT -s 172.16.0.0/12 -i eth1 -j DROP
 iptables -A FORWARD -s 172.16.0.0/12 -i eth1 -j DROP
 iptables -A INPUT -s 192.168.0.0/16 -i eth1 -j DROP
 iptables -A FORWARD -s 192.168.0.0/16 -i eth1 -j DROP
 iptables -A INPUT -s 224.0.0.0/3 -i eth1 -j DROP
 iptables -A FORWARD -s 224.0.0.0/3 -i eth1 -j DROP
 iptables -A INPUT -s 127.0.0.1 -i eth1 -j DROP
 iptables -A FORWARD -s 127.0.0.1 -i eth1 -j DROP
 iptables -A INPUT -i eth1 -p tcp --dport 1024:65535 -j ACCEPT
 iptables -A InPUT -i eth1 -p udp --dport 1024:65535 -j ACCEPT
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT
 iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
 iptables -A FORWARD -i eth1 -o eth0 -m state ESTABLISHED,RELATED -j ACCEPT
 iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
 iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
 
 aggiungendo poi:
 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
 per redirigere il traffico http sullo squid locale.
 
 il file squid.conf :
 http_port 3128
 icp_port 3130
 cache_mem 8 MB
 cache_dir ufs /var/log/squid/cache 100 16 256
 cache_access_log /var/log/squid/logs/access.log
 cache_log /var/log/squid/logs/cache.log
 cache_store_log /var/log/squid/logs/store.log
 emulate_httpd_log off
 mime_table /etc/squid/mime.conf
 acl all src 0.0.0.0/0.0.0.0
 acl manager proto cache_object
 acl localhost src 127.0.0.1/255.255.255.255
 acl to_localhost dst 127.0.0.0/8
 acl SSL_ports port 443 563
 acl Safe_ports port 80 # http
 acl Safe_ports port 21 # ftp
 acl Safe_ports port 443 563 # https, snews
 acl Safe_ports port 70 # gopher
 acl Safe_ports port 210 # wais
 acl Safe_ports port 1025-65535 # unregistered ports
 acl Safe_ports port 280 # http-mgmt
 acl Safe_ports port 488 # gss-http
 acl Safe_ports port 591 # filemaker
 acl Safe_ports port 777 # multiling http
 acl locallan src 192.168.0.0/255.255.255.0
 acl CONNECT method CONNECT
 http_access allow manager localhost
 http_access deny manager
 http_access deny !Safe_ports
 http_access deny CONNECT !SSL_ports
 http_access allow localhost
 http_access allow locallan
 http_access deny all
 cache_effective_user nobody
 cache_effective_group nobody
 
 
 adesso non funzione più la condivisione internet. Sto approfondendo Squid ma intanto mi piacerebbe vederlo funzionare, e´ da più di un giorno ch ci smanetto senza risultati :-[

dunque, adesso Squid funziona ma non il transparent proxy per cui sono costretto ad impostare indirizzo IP e porta 8080 sul browser. Ecco i nuovi file di conf. e rc.local che uso (lo so che è un post lungo ma vi prego leggetelo per darmi una mano a capire dove sta il problema):
 
 SQUID.CONF
 #Seleziono Le Porte Di Ascolto Di Squid
 http_port 8080
 #Le Pagine CGI non verranno messe in cache
 acl QUERY urlpath_regex cgi-bin \?
 #Imposto La Memoria Che UtilizzerÃ Squid
 cache_mem 32 MB
 #Imposto La QuantitÃ Di Cache che utiizzerÃ Squid (2550 Significa 2.5GB)
 cache_dir ufs /var/log/squid/cache 2500 16 256
 
 #Imposto Le directory Dove Squid ScriverÃ i Logs
 cache_log /var/log/squid/cache.log
 cache_access_log /var/log/squid/access.log
 cache_store_log /var/log/squid/store.log
 cache_swap_log /var/log/squid/swap.log
 #I Log Di Squid ruoteranno per 10 giorni e poi li cancello
 logfile_rotate 10
 
 redirect_rewrites_host_header off
 
 cache_replacement_policy GDSF
 #Imposto Delle regole per la sicurezza del Proxy
 acl localnet src 192.168.100.0/255.255.255.0
 acl localhost src 127.0.0.1/255.255.255.255
 acl Safe_ports port 80 443 210 119 70 20 21 1025-65535
 acl CONNECT method CONNECT
 acl all src 0.0.0.0/0.0.0.0
 http_access allow localnet
 http_access allow localhost
 http_access deny !Safe_ports
 http_access deny CONNECT
 http_access deny all
 maximum_object_size 3000 KB
 store_avg_object_size 50 KB
 
 #Imposto Il Proxy in ModalitÃ Trsparente.
 httpd_accel_host virtual
 httpd_accel_port 80
 httpd_accel_with_proxy on
 httpd_accel_uses_host_header on
 
 cache_mgr <a href="mailto:giuseppe@localhost" target="_new">giuseppe@localhost</a>
 cachemgr_passwd startac85 all
 
 #Imposto L´Anonimato Per i Client
 forwarded_for off
 client_db off
 
 log_icp_queries off
 buffered_logs on
 
 #Non Imposto Il Limite Del Download Per Gli Utenti Della Mia Rete
 acl magic_words1 url_regex -i 192.168
 
 #Imposto Il Limite Del Download Per Queste Estensioni
 acl magic_words2 url_regex -i ftp .mp3 .vqf .tar.gz .gz .rpm .avi .mpeg .mpe .mpg .qt .wav .exe .zip
 
 #Limito La Banda Dalle 09:00 Alle 23:59 e Do Piena Banda La Notte
 acl day time 09:00-23:59
 no_cache deny QUERY
 
 e il file rc.local dove ho messo:
 
 RC.LOCAL
 echo 1 > /proc/sys/net/ipv4/ip_forward
 iptables -F
 iptables -P INPUT DROP
 iptables -P OUTPUT ACCEPT
 iptables -P FORWARD DROP
 iptables -A INPUT -p tcp --dport 22 -j ACCEPT
 iptables -A INPUT -p tcp --dport 53 -j ACCEPT
 iptables -A INPUT -i eth0 -j ACCEPT
 iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j DROP
 iptables -A FORWARD -s 10.0.0.0/8 -i eth1 -j DROP
 iptables -A INPUT -s 172.16.0.0/12 -i eth1 -j DROP
 iptables -A FORWARD -s 172.16.0.0/12 -i eth1 -j DROP
 iptables -A INPUT -s 192.168.0.0/16 -i eth1 -j DROP
 iptables -A FORWARD -s 192.168.0.0/16 -i eth1 -j DROP
 iptables -A INPUT -s 224.0.0.0/3 -i eth1 -j DROP
 iptables -A FORWARD -s 224.0.0.0/3 -i eth1 -j DROP
 iptables -A INPUT -s 127.0.0.1 -i eth1 -j DROP
 iptables -A FORWARD -s 127.0.0.1 -i eth1 -j DROP
 iptables -A INPUT -i eth1 -p tcp --dport 1024:65535 -j ACCEPT
 iptables -A InPUT -i eth1 -p udp --dport 1024:65535 -j ACCEPT
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT
 iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
 iptables -A FORWARD -i eth1 -o eth0 -m state ESTABLISHED,RELATED -j ACCEPT
 iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
 iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
 iptables -A PREROUTING -p tcp -m tcp -s 192.168.100.0 --dport 80 -j REDIRECT --to-ports 8080

Da ignorante mi sto chedendo se c´e´ qualche altro script firewall attivo che in qualche modo rompe le gnagnnere! stranamento poi il file rc.firewall che mi ricordavo essere presente sul myo slack adesso non c´e´ piu´. Help please!

slacky.eu

Squid !!

Squid !!

Squid !!

Squid !!