Qaul serviço voce quer acessar na net ? Qual o erro que apresenta ?
2011/6/6 Rodrigo Lira <[email protected]>: > Salve Salve Galera!!!! > Seguinte, to com um problema em uma das empresas que dou suporte. Tem um > software que faz envio de pedidos de revelação de Fotos, já fiz todas as > liberações no firewall mas o mesmo continua dando erro: > Segue abaixo o meu firewall, squid e o tcpdump. > FIREWALL > #!/bin/bash > # Modulos de Compartilhamento da Conexão > /sbin/modprobe ip_nat_amanda > /sbin/modprobe ip_nat_h323 > /sbin/modprobe ip_nat > /sbin/modprobe ip_nat_sip > /sbin/modprobe ip_nat_tftp > /sbin/modprobe ip_nat_ftp > /sbin/modprobe ip_nat_irc > /sbin/modprobe ip_nat_pptp > /sbin/modprobe ip_nat_snmp_basic > /sbin/modprobe iptable_nat > /sbin/modprobe ip_conntrack_ftp > /sbin/iptables -F > /sbin/iptables -F -t nat > /sbin/iptables -X > INTERNET="ppp0" > REDELOCAL="eth1" > echo 1 > /proc/sys/net/ipv4/ip_forward > iptables -P INPUT ACCEPT > iptables -P OUTPUT ACCEPT > iptables -P FORWARD ACCEPT > #Regras de nat para Servicos Convide Eventos > iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d alphaeditora.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d redenetworks.net.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d hayangroup.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d zyoncore.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d servidor01.zyoncore.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d locaweb.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d xxxdnn1252.locaweb.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d cabald.sites.uol.com.br -j MASQUERADE > iptables -t nat -I POSTROUTING -d webgeral.com -j MASQUERADE > iptables -t nat -I POSTROUTING -d ns1.webgeral.com -j MASQUERADE > iptables -t nat -I POSTROUTING -d ns2.webgeral.com -j MASQUERADE > iptables -t nat -I POSTROUTING -d akamai.com -j MASQUERADE > iptables -t nat -I POSTROUTING -d 189.1.162.21 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 186.202.10.40 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 189.1.161.55 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 189.1.161.50 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.45.247.66 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.17.68.200 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.0.211.215 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 187.45.202.30 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.219.246.7 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 189.126.119.93 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 189.126.116.18 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.223 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.224 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.225 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.226 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.227 -j MASQUERADE > iptables -t nat -I POSTROUTING -d 200.140.198.228 -j MASQUERADE > #Regra de bloqueio ao acesso externo do proxy > iptables -A INPUT -p tcp -i $INTERNET -m multiport --destination-port 3128 > -j DROP > #Porta SSL > iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE > #TEAMVIEWER > iptables -t nat -I POSTROUTING -p tcp --dport 5930 -j MASQUERADE > #FTP > iptables -t nat -I POSTROUTING -p tcp --dport 21 -j MASQUERADE > #SQUID redirect > iptables -t nat -A PREROUTING -p tcp -i $REDELOCAL --dport 80 -j REDIRECT > --to-port 3128 > > SQUID > http_port 3128 transparent > visible_hostname cache-convide > error_directory /usr/share/squid/errors/Portuguese > cache_access_log /var/log/squid/access.log > cache_dir ufs /var/spool/squid 80240 32 512 > maximum_object_size 512 MB > minimum_object_size 0 KB > cache_swap_low 90 > cache_swap_high 95 > dns_nameservers 208.67.222.222 > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl SSL_ports port 443 563 > acl Safe_ports port 21 80 443 563 70 210 280 488 59 777 901 1025-65535 > acl purge method PURGE > acl CONNECT method CONNECT > http_access allow manager localhost > http_access deny manager > http_access allow purge localhost > http_access deny purge > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > acl NOCACHE url_regex 192.168.0.1 \? > no_cache deny NOCACHE > # ACLs > acl redelocal src 192.168.0.0/24 > acl manha time 06:00-08:00 > acl noite time 19:00-20:00 > acl almoco time 12:00-14:00 > #ACLs para permissao de acesso > acl acesso_ouro src "/etc/squid/ips_ouro.txt" > acl acesso_prata src "/etc/squid/ips_prata.txt" > acl acesso_bronze src "/etc/squid/ips_bronze.txt" > #ACLs sites liberados > acl sites_bronze url_regex "/etc/squid/sites_bronze.txt" > acl sites_prata url_regex "/etc/squid/sites_prata.txt" > #Execucao das ACLS > #Libera o acesso aos sites liberados > http_access allow sites_bronze > http_access allow sites_prata > #Primeiro nivel de acesso a internet > http_access allow acesso_ouro > #Segundo nivel de acesso a internet > http_access allow manha > http_access allow noite > http_access allow almoco > #Segundo nivel de bloqueio > http_access deny redelocal > #Terceiro nivel de bloqueio > http_access deny all > > TCPDUMP > 12:25:01.491009 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [S], seq > 2717378554, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length > 0 > 12:25:01.491039 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [S.], seq > 2083647526, ack 2717378555, win 5840, options [mss > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > 12:25:01.491205 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], ack > 1, win 16425, length 0 > 12:25:01.492790 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], seq > 1:325, ack 1, win 16425, length 324 > 12:25:01.492808 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], ack > 325, win 54, length 0 > 12:25:01.493040 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], seq > 325:756, ack 1, win 16425, length 431 > 12:25:01.493055 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], ack > 756, win 63, length 0 > 12:25:01.697631 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], seq > 1:408, ack 756, win 63, length 407 > 12:25:01.697655 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], seq > 408:1868, ack 756, win 63, length 1460 > 12:25:01.697666 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], seq > 1868:1919, ack 756, win 63, length 51 > 12:25:01.698248 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], ack > 1919, win 16425, length 0 > 12:25:01.891401 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [S], seq > 1498805634, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length > 0 > 12:25:01.891423 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [S.], seq > 2101414921, ack 1498805635, win 5840, options [mss > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > 12:25:01.891642 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack > 1, win 16425, length 0 > 12:25:01.892585 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], seq > 1:332, ack 1, win 16425, length 331 > 12:25:01.892602 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], ack > 332, win 54, length 0 > 12:25:01.892841 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], seq > 332:734, ack 1, win 16425, length 402 > 12:25:01.892856 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], ack > 734, win 63, length 0 > 12:25:02.087377 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq > 1:408, ack 734, win 63, length 407 > 12:25:02.087397 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq > 408:1570, ack 734, win 63, length 1162 > 12:25:02.087657 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq > 1570:2153, ack 734, win 63, length 583 > 12:25:02.087884 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack > 1570, win 16425, length 0 > 12:25:02.210895 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [S], seq > 598358245, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length > 0 > 12:25:02.210917 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [S.], seq > 2090396113, ack 598358246, win 5840, options [mss > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > 12:25:02.211131 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [.], ack 1, > win 16425, length 0 > 12:25:02.211807 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [P.], seq > 1:714, ack 1, win 16425, length 713 > 12:25:02.211825 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [.], ack > 714, win 57, length 0 > 12:25:02.289333 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq > 1570:2153, ack 734, win 63, length 583 > 12:25:02.289753 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack > 2153, win 16279, options [nop,nop,sack 1 {1570:2153}], length 0 > 12:25:02.369489 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq > 1:385, ack 714, win 57, length 384 > 12:25:02.369509 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq > 385:1511, ack 714, win 57, length 1126 > Galera nao coloquei o log do tcpdump todo porque era muito extenso e > repetitivo. > > Rodrigo Lira > Coordenador de Suporte Técnico > Rede GigaNet > (83) 3021-5430 / 8754-5490 / 9906-2552 > Msn: [email protected] > Skype: rbl1984 > ------------------------------------------ > > -- > GUS-BR - Grupo de Usuários de Slackware Brasil > http://www.slackwarebrasil.org/ > http://groups.google.com/group/slack-users-br > > Antes de perguntar: > http://www.istf.com.br/perguntas/ > > Para sair da lista envie um e-mail para: > [email protected] -- Otavio Augusto --------------------- Consultor de TI -- GUS-BR - Grupo de Usuários de Slackware Brasil http://www.slackwarebrasil.org/ http://groups.google.com/group/slack-users-br Antes de perguntar: http://www.istf.com.br/perguntas/ Para sair da lista envie um e-mail para: [email protected]
