Проблемы:
1) Не получается организовать прозрачный прокси. В настройках squid.conf прописываю transparent - не получается.
2) не понятно, работает NAT или нет. (Насколько я понял, Squid обрабатывает только http-запросы, все остальное должно нат-ом транслироваться...Аська, skype и остальные не подключаются)
Конфигурационные файлы:
squid.conf
Код: Выделить всё
http_port 3128 transparent
icp_port 3130
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin?
no_cache deny QUERY
cache_mem 32 MB
maximum_object_size 2000 KB
maximum_object_size_in_memory 1000 KB
cache_dir ufs /usr/local/squid/cache 2000 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_mgr root@domain.kg
visible_hostname proxy
tcp_outgoing_address 111.111.111.222
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl manager proto cache_object
acl localnet77 src 192.168.77.0/32
acl localnet0 src 192.168.0.0/32
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Icq_port port 5190 # icq
acl Irc_port port 6667 # irc
acl MSN_port port 1863 # msn messager
acl CONNECT method CONNECT
acl cad77 src 192.168.77.5-192.168.77.100
acl cad0 src 192.168.0.1-192.168.0.99
acl stop_files url_regex -i .mp3$ .vqf$ .rpm$ .avi$ .mpeg$ .rm$ .raw$ .wav$ .mov$ .ogg$
acl StopWWW dstdomain "/usr/local/etc/squid/stopWWW.acl"
http_access deny stop_files
http_access deny StopWWW
http_access allow cad77
http_access allow cad0
http_access allow CONNECT Icq_port
http_access allow localnet77 Icq_port
http_access allow localnet0 Icq_port
http_access allow CONNECT Irc_port
http_access allow localnet77 Irc_port
http_access allow localnet0 Irc_port
http_access allow CONNECT MSN_port
http_access allow localnet77 MSN_port
http_access allow localnet0 MSN_port
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all
http_reply_access allow all
icp_access allow all
icon_directory /usr/local/etc/squid/icons
coredump_dir /usr/local/squid/cacheКод: Выделить всё
#!/bin/sh
fwcmd="/sbin/ipfw"
LanOut="nfe0"
LanIn0="rl0"
LanIn77="tl0"
IpOut="111.111.111.222"
IpIn0="192.168.0.100"
IpIn77="192.168.77.1"
NetMask="32"
NetIn0="192.168.0.0"
NetIn77="192.168.77.0"
${fwcmd} -f flush
${fwcmd} add check-state
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add deny ip from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any
${fwcmd} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${fwcmd} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
#${fwcmd} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${fwcmd} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${fwcmd} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${fwcmd} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${fwcmd} add deny icmp from any to any frag
${fwcmd} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${fwcmd} add deny log icmp from any to 255.255.255.255 out via ${LanOut}
${fwcmd} add fwd ${IpIn0},3128 tcp from ${NetIn0}/${NetMask} to any 80 via ${LanOut}
${fwcmd} add fwd ${IpIn77},3128 tcp from ${NetIn77}/${NetMask} to any 80 via ${LanOut}
${fwcmd} add fwd ${IpIn0},2121 tcp from ${NetIn0}/${NetMask} to any 21 via ${LanOut}
${fwcmd} add fwd ${IpIn77},2121 tcp from ${NetIn77}/${NetMask} to any 21 via ${LanOut}
${fwcmd} add divert natd ip from ${NetIn0}/${NetMask} to any out via ${LanOut}
${fwcmd} add divert natd ip from ${NetIn77}/${NetMask} to any out via ${LanOut}
${fwcmd} add divert natd ip from any to ${IpOut} in via ${LanOut}
${fwcmd} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${fwcmd} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
#${fwcmd} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${fwcmd} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
${fwcmd} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${fwcmd} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
${fwcmd} add deny ip from 240.0.0.0/4 to any out via ${LanOut}
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from ${IpOut} to any out xmit ${LanOut}
${fwcmd} add allow udp from any 53 to any via ${LanOut}
${fwcmd} add allow udp from any to any 53 via ${LanOut}
${fwcmd} add allow udp from any to any 123 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 21 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut}
${fwcmd} add allow icmp from any to any icmptypes 0,8,11
${fwcmd} add allow tcp from any to ${IpOut} 80 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 25 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 22 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 143 via ${LanOut}
${fwcmd} add allow tcp from any to ${IpOut} 110 via ${LanOut}
${fwcmd} add allow tcp from any to any via ${LanIn0}
${fwcmd} add allow tcp from any to any via ${LanIn77}
${fwcmd} add allow udp from any to any via ${LanIn0}
${fwcmd} add allow udp from any to any via ${LanIn77}
${fwcmd} add allow icmp from any to any via ${LanIn0}
${fwcmd} add allow icmp from any to any via ${LanIn77}
${fwcmd} add deny ip from any to anyКод: Выделить всё
firewall_enable="YES"
firewall_type="/etc/rc.firewall"
firewall_logging="YES"
natd_enable="YES"
natd_interface="nfe0"
defaultrouter="111.111.111.221"
gateway_enable="YES"
hostname="xxx.kg"
ifconfig_nfe0="inet 111.111.111.222 netmask 255.255.255.252"
ifconfig_rl0="inet 192.168.0.100 netmask 255.255.255.0"
ifconfig_tl0="inet 192.168.77.1 netmask 255.255.255.0"
keymap="ru.koi8-r"
moused_enable="YES"
sshd_enable="YES"
named_enable="YES"
named_uid="bind"
named_chrootdir=""
named_flags="-s"
mysql_enable="YES"
apache22_enable="YES"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
postfix_enable="YES"
dovecot_enable="YES"
frox_enable="YES"
squid_enable="YES"
clamav_clamd_enable="YES"
spamd_enable="YES"
clamsmtpd_enable="YES"