forum.lissyara.su

[X] SQUID_DELAY_POOLS    Enable delay pools 
[X] SQUID_CARP           Enable CARP support 
[X] SQUID_WCCP           Enable Web Cache Coordination Prot. v1 
[X] SQUID_IDENT          Enable ident (RFC 931) lookups  
[X] SQUID_ARP_ACL        Enable ACLs based on ethernet address
[X] SQUID_PF             Enable transparent proxying with PF
[X] SQUID_KQUEUE         Use kqueue(2) instead of poll(2)
[X] SQUID_LARGEFILE      Support log and cache files >2GB

http_port 3128
icp_port 0
acl QUERY urlpath_regex cgi-bin/?
no_cache deny QUERY
cache_mem 128 MB
cache_dir ufs /var/squid/cache 10000 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
logfile_rotate 10
mime_table /usr/local/etc/squid/mime.conf
pid_filename /var/run/squid.pid
acl server src 10.0.10.2/255.255.255.255 #
acl clients src 10.0.10.1-10.0.10.254/255.255.255.255
acl all src 0.0.0.0/0.0.0.0 #
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563 # SSL
acl SMTP port 25
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow server
http_access allow clients
http_access deny !Safe_ports
http_access deny SMTP
http_access deny all
icp_access deny all
error_directory /usr/local/etc/squid/errors/Russian-koi8-r

int_if="vlan10"
ext_if="vlan20"
icmp_types="{echoreq, unreach}"

lan_nets= "{10.0.0.0/24}"

set block-policy return
set skip on lo0
set skip on $int_if

scrub in all
#####------------------------
##### NAT ZONE START
nat on $ext_if from $lan_nets to any -> ($ext_if)
##### NAT ZONE FINISH
#####------------------------
##
#####------------------------
##### REDIRECT ZONE START
rdr pass on $int_if proto tcp from $lan_nets to any port www -> 127.0.0.1 port 3128
##### REDIRECT ZONE FINISH
#####------------------------
#####------------------------
##### FILTER ZONE START
antispoof quick for {lo0, $ext_if, $int_if}

block in all
block out all
#block log all
block drop in quick on $ext_if from $lan_nets to any

pass inet proto icmp icmp-type echoreq

pass in on $int_if inet proto tcp from $int_if:network to { $int_if } port 22 keep state

pass out on $ext_if inet proto tcp from any to any port 80 keep state
pass out on $ext_if inet proto udp from any to any port domain
##### FILTER ZONE FINISH
#####------------------------

IP-адрес . . . . . . . . . . . . : 10.0.0.2
Маска подсети . . . . . . . . . . : 255.255.255.0
Основной шлюз . . . . . . . . . . : 10.0.0.1

lagg0:
laggport: em1 flags=1c<ACTIVE,COLLECTING,DISTRIBUTING>
laggport: em0 flags=1c<ACTIVE,COLLECTING,DISTRIBUTING>
vlan10:
inet 10.0.10.1 netmask 0xffffff00 broadcast 10.0.10.255
vlan: 10 parent interface: lagg0
vlan20:
inet *.*.*.15 netmask 0xffffff00 broadcast *.*.*.255
vlan: 20 parent interface: lagg0

Zedik писал(а):
# cat /usr/local/etc/squid/squid.conf (содран с инета пока)

http_port 3128 transparent

# cat /etc/pf.conf

##
#####------------------------
##### REDIRECT ZONE START
rdr pass on $int_if proto tcp from $lan_nets to any port www -> 127.0.0.1 port 3128
##### REDIRECT ZONE FINISH
#####------------------------

##### NAT ZONE START
nat on $ext_if from $lan_nets to any -> ($ext_if)
##### NAT ZONE FINISH
#####------------------------

Zedik писал(а):pimlab
пробовал
skeletor
чего не перечитал только, и похожие видел.
мне кажется, что туда даже и не заворачивается трафик. а если не заворачивается то скорее всего дело в pf

pfctl -nf <путь к конфигу>

table <home_lan> const   { 192.168.110.0/24, 192.168.111.0/24 }
squid = " 3128 "
perevod ="{ 80, 3128, 8080 }"

rdr on {$int_if $int_if2 $int_if4 $int_if5} inet proto tcp from <home_lan> to \
 !(self) port $perevod  -> 127.0.0.1 port $squid

pimlab писал(а): у меня так заворачивается

Код: Выделить всё

table <home_lan> const   { 192.168.110.0/24, 192.168.111.0/24 }
squid = " 3128 "
perevod ="{ 80, 3128, 8080 }"

rdr on {$int_if $int_if2 $int_if4 $int_if5} inet proto tcp from <home_lan> to \
 !(self) port $perevod  -> 127.0.0.1 port $squid

#!/bin/sh -
FwCMD="/sbin/ipfw"
NetIn="10.0.10.0"
NetMask="24"
IpOut="*.*.*.15"
#!/bin/sh
ipfw -q -f flush
cmd="ipfw -q add "
${FwCMD} add divert 8668 ip from any to any via vlan20
${FwCMD} add fwd 127.0.0.1,3128 tcp from any to any dst-port 80 via vlan10
${FwCMD} add deny tcp from 10.0.10.0/24 to any dst-port 80 via vlan10
${FwCMD} add allow ip from any to any

int_if="vlan10"
ext_if="vlan20"
lan_nets= "{10.0.10.0/24}"
set block-policy return
set skip on lo0
set skip on $int_if

scrub in all
#####------------------------
##### NAT ZONE START
nat on $ext_if from $lan_nets to any -> ($ext_if) #add divert 8668 ip from any to any via vlan20
##### NAT ZONE FINISH
#####------------------------
##
#####------------------------
##### REDIRECT ZONE START
rdr pass on vlan10 proto tcp from any to any port 80 -> 127.0.0.1 port 3128 #add fwd 127.0.0.1,3128 tcp from any to any dst-port 80 via vlan10
##### REDIRECT ZONE FINISH
#####------------------------

#####------------------------
##### FILTER ZONE START
antispoof quick for {lo0, $ext_if, $int_if}

block in quick on vlan10 inet proto tcp from 10.0.10.0/24 to any port 80 #deny tcp from 10.0.10.0/24 to any dst-port 80 via vlan10

pass in all #add allow ip from any to any
pass out all #add allow ip from any to any

Note that squid needs to open /dev/pf in order to query the packet filter. The default permissions for this file allow access only to root. squid is running as user _squid, group _squid, so one way to allow access to squid is by changing the group ID of the file to squid and make it group-accessable:
# chgrp squid /dev/pf
# chmod g+rw /dev/pf

#set skip on $int_if