forum.lissyara.su

Код: Выделить всё

uname -a
FreeBSD ergo-proxy 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Fri Dec  7 17:24:37 SAMT 2012     root@ergo-proxy:/usr/src/sys/amd64/compile/MYKERNEL  amd64

Код: Выделить всё

 squid -v
Squid Cache: Version 3.2.3
configure options:  '--with-default-user=squid' '--bindir=/usr/local/sbin' '--sbindir=/usr/local/sbin' '--datadir=/usr/local/etc/squid' '--libexecdir=/usr/local/libexec/squid' '--localstatedir=/var/squid' '--sysconfdir=/usr/local/etc/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid/squid.pid' '--enable-auth' '--enable-build-info' '--enable-loadable-modules' '--enable-removal-policies=lru heap' '--disable-epoll' '--disable-linux-netfilter' '--disable-linux-tproxy' '--disable-translation' '--enable-auth-basic=DB MSNT MSNT-multi-domain NCSA PAM POP3 RADIUS  fake getpwnam NIS' '--enable-auth-digest=file' '--enable-external-acl-helpers=file_userip unix_group' '--enable-auth-negotiate=kerberos wrapper' '--enable-auth-ntlm=fake smb_lm' '--enable-storeio=diskd rock ufs aufs' '--enable-disk-io=AIO Blocking DiskDaemon IpcIo Mmapped DiskThreads' '--enable-log-daemon-helpers=file' '--enable-url-rewrite-helpers=fake' '--disable-ipv6' '--enable-htcp' '--disable-forw-via-db' '--disable-cache-digests' '--enable-wccp' '--enable-wccpv2' '--disable-eui' '--disable-ipfw-transparent' '--enable-pf-transparent' '--disable-ipf-transparent' '--disable-follow-x-forwarded-for' '--disable-ecap' '--disable-icap-client' '--disable-esi' '--enable-kqueue' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd9.0' 'build_alias=amd64-portbld-freebsd9.0' 'CC=cc' 'CFLAGS=-O2 -pipe  -fno-strict-aliasing' 'LDFLAGS= -pthread' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe -fno-strict-aliasing' 'CPP=cpp' --enable-ltdl-convenience

Код: Выделить всё

 less /etc/rc.conf
#!/bin/sh
defaultrouter="10.18.71.1"
gateway_enable="YES"
hostname="ergo-proxy"
inetd_enable="YES"
network_interfaces="msk0 msk1 lo0"
ifconfig_msk0="inet 192.168.111.201 netmask 255.255.255.0"
ifconfig_msk1="inet 10.18.71.201 netmask 255.255.255.0"
natd_enable="YES"
natd_interface="10.18.71.201"

sshd_enable="YES"
squid_enable="YES"

pf_enable="YES"
pf_rules="/etc/pf.conf"

pflog_enable="YES"
pflog_logfile="/var/log/pflog"

#ifconfig_msk2="inet 192.168.111.230 netmask 255.255.255.0"
keymap="ru.koi8-r.win.kbd"
#ifconfig_msk0="DHCP"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
natd_interface="msk1"

Код: Выделить всё

less /usr/local/etc/squid/squid.conf
acl localnet src 192.168.111.0/24 
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow localhost manager
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 127.0.0.1:3128 transparent
cache_mem 128 MB
maximum_object_size 8092 KB
maximum_object_size_in_memory 512 KB
cache_log /var/squid/logs/squid_debug.log squid
cache_access_log /var/squid/logs/access.log squid
cache_store_log  /var/squid/logs/cache_store.log squid
cache_dir ufs /var/squid/cache/squid 2048 64 256
coredump_dir /var/squid/cache/squid
visible_hostname ergoProxy
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

Код: Выделить всё

int_if="msk0"
ext_if="msk1"
ext_ip="10.18.71.201"
int_ip="192.168.111.201"
int_net="192.168.111.0/24"
rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
nat on $ext_if from $int_net to any ->$ext_ip
pass in on $int_if proto tcp to ($int_if) port ssh
pass in on $ext_if proto tcp to ($ext_if) port 22
block out all
block in all
pass on lo0
pass on $int_if
pass out from $ext_if to any keep state
pass in on $int_if proto tcp to ($int_if) port ssh
pass in on $ext_if proto tcp to ($ext_if) port 80
pass in on $int_if proto tcp to any port www

Код: Выделить всё

rdr on $int_if proto tcp from $int_if:network to any port www -> 127.0.0.1 port 3128

Код: Выделить всё

int_if="msk0"
ext_if="msk1"
ext_ip="10.18.71.201"
int_ip="192.168.111.201"
int_net="192.168.111.0/24"
-->rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128  #редирект на 3128
nat on $ext_if from $int_net to any ->$ext_ip
-->pass in on $int_if proto tcp to ($int_if) port ssh #зачем? дальше следует block in all
-->pass in on $ext_if proto tcp to ($ext_if) port 22 #зачем? дальше следует block in all
block out all
block in all
pass on lo0
pass on $int_if
pass out from $ext_if to any keep state
pass in on $int_if proto tcp to ($int_if) port ssh
pass in on $ext_if proto tcp to ($ext_if) port 80
-->pass in on $int_if proto tcp to any port www  #разрешаем входящие на 80 порт, хотя выше делали редирект на 3128

Код: Выделить всё

rdr pass on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128 

Код: Выделить всё

rdr on $int_if inet proto tcp from 192.168.111.0/24 to any port www -> 127.0.0.1 port 3128
rdr on $int_if inet proto tcp from $int_if to any port www -> 127.0.0.1 port 3128

Код: Выделить всё

int_if="msk0"
ext_if="msk1"
int_ip="192.168.111.201"
ext_ip="10.18.71.201"
int_net="192.168.111.0/24"
rdr pass on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128

nat on $ext_if from $int_net to any ->$ext_ip

pass on lo0
pass on $int_if
pass out from $ext_if to any keep state
pass in on $int_if proto tcp to ($int_if) port ssh
pass in on $ext_if proto tcp to ($ext_if) port 80

Код: Выделить всё

int_if="msk0"
ext_if="msk1"

set skip on lo  # можно не использовать эту опцию, а явно разрешить правилами ниже

rdr on $int_if inet proto tcp from $int_if:network to ! $int_if:network port www -> 127.0.0.1 port 3128

nat on $ext_if from $int_if:network to ! $int_if:network -> $ext_if

block all
#pass on lo0 # использована опция выше, поэтому правило не нужно
pass on $int_if
pass out from $ext_if to any keep state
pass in on $ext_if proto tcp to ($ext_if) port 80  # а точно нужно пускать снаружи на порт 80?

Код: Выделить всё

pfctl -sn
nat on msk0 inet from 192.168.111.0/24 to any -> 192.168.111.201
rdr on msk0 inet proto tcp from 192.168.111.201 to ! 192.168.111.201 port = http -> 127.0.0.1 port 3128

Код: Выделить всё

pfctl -sr
pass in on msk1 proto tcp from any to (msk1) port = http flags S/SA keep state
pass out on msk1 inet6 from fe80::222:15ff:fe39:9a9c to any flags S/SA keep state
pass on msk0 all flags S/SA keep state
pass out inet from 10.18.71.201 to any flags S/SA keep state

Код: Выделить всё

netstat -nrf inet
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            10.18.71.1         UGS         0        0   msk1
10.18.71.0/24      link#6             U           0        0   msk1
10.18.71.201       link#6             UHS         0        0    lo0
127.0.0.1          link#17            UH          0        0    lo0
192.168.111.0/24   link#5             U           1     1732   msk0
192.168.111.201    link#5             UHS         0        0    lo0

Код: Выделить всё

netstat -nrf inet
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            10.18.71.1         UGS         0        0   msk1
10.18.71.0/24      link#6             U           0        0   msk1
10.18.71.201       link#6             UHS         0        0    lo0
127.0.0.1          link#17            UH          0        0    lo0
192.168.111.0/24   link#5             U           1     1732   msk0
192.168.111.201    link#5             UHS         0        0    lo0
ergo-proxy# sockstat -4l
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
squid    squid      2480  7  udp4   *:58109               *:*
squid    squid      2480  16 tcp4   *:3129                *:*
root     sendmail   2139  3  tcp4   127.0.0.1:25          *:*
root     sshd       2132  4  tcp4   *:22                  *:*
root     syslogd    1882  7  udp4   *:514                 *:*

Код: Выделить всё

pfctl -sr
pass in on msk1 proto tcp from any to (msk1) port = http flags S/SA keep state
pass out on msk1 inet6 from fe80::222:15ff:fe39:9a9c to any flags S/SA keep state
pass on msk0 all flags S/SA keep state
pass out inet from 10.18.71.201 to any flags S/SA keep state

pfctl -sn
nat on msk0 inet from 192.168.111.0/24 to any -> 10.18.71.201
rdr on msk0 inet proto tcp from 192.168.111.0/24 to any port = http -> 127.0.0.1 port 3128

Код: Выделить всё

pfctl -s state | grep 80
all tcp 127.0.0.1:3128 (192.168.111.201:80) <- 192.168.111.24:52671       CLOSED:SYN_SENT

Код: Выделить всё

cd /usr/ports/www/squid33/
make config
[x] TP_PF          Enable transparent proxying with PF

Код: Выделить всё

http_port 127.0.0.1:3128 intercept

Код: Выделить всё

rdr on $int_if inet proto tcp from <your_local_net> to any port 80 -> 127.0.0.1 port 3128

Код: Выделить всё

# Allow Squid read acess to /dev/pf
own pf root:squid
perm pf 0640

Код: Выделить всё

/etc/rc.d/devfs restart