Rodrigo não é o squid fazendo bloqueio de algum termo que você utilize? tente fazer o seguinte, pegue o ip da estação que esta acessando este software e faz a seguinte regra:
iptables -t nat -A POSTROUTING -s 192.168.0.100 -d 0/0 -j MASQUERADE #Teste Monitora também a saída do access.log do squid tail -f /var/log/squid/access.log | grep 192.168.0.100 pode monitorar também se esta batendo na regra de saida iptables -t nat -L -nv | grep 192.168.0.100 Assim você pode verificar se o squid esta bloqueando algum termo, ou se o firewall não esta travando a saída em alguma porta... Se funcionar assim, ai você identifica a porta que ele usa para saída e os termos a serem liberados... Espero ter ajudado. Abraços... Tiago Dib 2011/6/6 Otavio Augusto <[email protected]> > Qaul serviço voce quer acessar na net ? > Qual o erro que apresenta ? > > > > 2011/6/6 Rodrigo Lira <[email protected]>: > > Salve Salve Galera!!!! > > Seguinte, to com um problema em uma das empresas que dou suporte. Tem um > > software que faz envio de pedidos de revelação de Fotos, já fiz todas as > > liberações no firewall mas o mesmo continua dando erro: > > Segue abaixo o meu firewall, squid e o tcpdump. > > FIREWALL > > #!/bin/bash > > # Modulos de Compartilhamento da Conexão > > /sbin/modprobe ip_nat_amanda > > /sbin/modprobe ip_nat_h323 > > /sbin/modprobe ip_nat > > /sbin/modprobe ip_nat_sip > > /sbin/modprobe ip_nat_tftp > > /sbin/modprobe ip_nat_ftp > > /sbin/modprobe ip_nat_irc > > /sbin/modprobe ip_nat_pptp > > /sbin/modprobe ip_nat_snmp_basic > > /sbin/modprobe iptable_nat > > /sbin/modprobe ip_conntrack_ftp > > /sbin/iptables -F > > /sbin/iptables -F -t nat > > /sbin/iptables -X > > INTERNET="ppp0" > > REDELOCAL="eth1" > > echo 1 > /proc/sys/net/ipv4/ip_forward > > iptables -P INPUT ACCEPT > > iptables -P OUTPUT ACCEPT > > iptables -P FORWARD ACCEPT > > #Regras de nat para Servicos Convide Eventos > > iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d alphaeditora.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d redenetworks.net.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d hayangroup.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d zyoncore.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d servidor01.zyoncore.com.br -j > MASQUERADE > > iptables -t nat -I POSTROUTING -d locaweb.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d xxxdnn1252.locaweb.com.br -j > MASQUERADE > > iptables -t nat -I POSTROUTING -d cabald.sites.uol.com.br -j MASQUERADE > > iptables -t nat -I POSTROUTING -d webgeral.com -j MASQUERADE > > iptables -t nat -I POSTROUTING -d ns1.webgeral.com -j MASQUERADE > > iptables -t nat -I POSTROUTING -d ns2.webgeral.com -j MASQUERADE > > iptables -t nat -I POSTROUTING -d akamai.com -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 189.1.162.21 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 186.202.10.40 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 189.1.161.55 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 189.1.161.50 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.45.247.66 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.17.68.200 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.0.211.215 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 187.45.202.30 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.219.246.7 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 189.126.119.93 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 189.126.116.18 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.223 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.224 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.225 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.226 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.227 -j MASQUERADE > > iptables -t nat -I POSTROUTING -d 200.140.198.228 -j MASQUERADE > > #Regra de bloqueio ao acesso externo do proxy > > iptables -A INPUT -p tcp -i $INTERNET -m multiport --destination-port > 3128 > > -j DROP > > #Porta SSL > > iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE > > #TEAMVIEWER > > iptables -t nat -I POSTROUTING -p tcp --dport 5930 -j MASQUERADE > > #FTP > > iptables -t nat -I POSTROUTING -p tcp --dport 21 -j MASQUERADE > > #SQUID redirect > > iptables -t nat -A PREROUTING -p tcp -i $REDELOCAL --dport 80 -j REDIRECT > > --to-port 3128 > > > > SQUID > > http_port 3128 transparent > > visible_hostname cache-convide > > error_directory /usr/share/squid/errors/Portuguese > > cache_access_log /var/log/squid/access.log > > cache_dir ufs /var/spool/squid 80240 32 512 > > maximum_object_size 512 MB > > minimum_object_size 0 KB > > cache_swap_low 90 > > cache_swap_high 95 > > dns_nameservers 208.67.222.222 > > acl all src 0.0.0.0/0.0.0.0 > > acl manager proto cache_object > > acl localhost src 127.0.0.1/255.255.255.255 > > acl SSL_ports port 443 563 > > acl Safe_ports port 21 80 443 563 70 210 280 488 59 777 901 1025-65535 > > acl purge method PURGE > > acl CONNECT method CONNECT > > http_access allow manager localhost > > http_access deny manager > > http_access allow purge localhost > > http_access deny purge > > http_access deny !Safe_ports > > http_access deny CONNECT !SSL_ports > > acl NOCACHE url_regex 192.168.0.1 \? > > no_cache deny NOCACHE > > # ACLs > > acl redelocal src 192.168.0.0/24 > > acl manha time 06:00-08:00 > > acl noite time 19:00-20:00 > > acl almoco time 12:00-14:00 > > #ACLs para permissao de acesso > > acl acesso_ouro src "/etc/squid/ips_ouro.txt" > > acl acesso_prata src "/etc/squid/ips_prata.txt" > > acl acesso_bronze src "/etc/squid/ips_bronze.txt" > > #ACLs sites liberados > > acl sites_bronze url_regex "/etc/squid/sites_bronze.txt" > > acl sites_prata url_regex "/etc/squid/sites_prata.txt" > > #Execucao das ACLS > > #Libera o acesso aos sites liberados > > http_access allow sites_bronze > > http_access allow sites_prata > > #Primeiro nivel de acesso a internet > > http_access allow acesso_ouro > > #Segundo nivel de acesso a internet > > http_access allow manha > > http_access allow noite > > http_access allow almoco > > #Segundo nivel de bloqueio > > http_access deny redelocal > > #Terceiro nivel de bloqueio > > http_access deny all > > > > TCPDUMP > > 12:25:01.491009 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [S], > seq > > 2717378554, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], > length > > 0 > > 12:25:01.491039 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [S.], > seq > > 2083647526, ack 2717378555, win 5840, options [mss > > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > > 12:25:01.491205 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], > ack > > 1, win 16425, length 0 > > 12:25:01.492790 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], > seq > > 1:325, ack 1, win 16425, length 324 > > 12:25:01.492808 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], > ack > > 325, win 54, length 0 > > 12:25:01.493040 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], > seq > > 325:756, ack 1, win 16425, length 431 > > 12:25:01.493055 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], > ack > > 756, win 63, length 0 > > 12:25:01.697631 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], > seq > > 1:408, ack 756, win 63, length 407 > > 12:25:01.697655 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], > seq > > 408:1868, ack 756, win 63, length 1460 > > 12:25:01.697666 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], > seq > > 1868:1919, ack 756, win 63, length 51 > > 12:25:01.698248 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], > ack > > 1919, win 16425, length 0 > > 12:25:01.891401 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [S], > seq > > 1498805634, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], > length > > 0 > > 12:25:01.891423 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [S.], > seq > > 2101414921, ack 1498805635, win 5840, options [mss > > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > > 12:25:01.891642 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], > ack > > 1, win 16425, length 0 > > 12:25:01.892585 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], > seq > > 1:332, ack 1, win 16425, length 331 > > 12:25:01.892602 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], > ack > > 332, win 54, length 0 > > 12:25:01.892841 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], > seq > > 332:734, ack 1, win 16425, length 402 > > 12:25:01.892856 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], > ack > > 734, win 63, length 0 > > 12:25:02.087377 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], > seq > > 1:408, ack 734, win 63, length 407 > > 12:25:02.087397 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], > seq > > 408:1570, ack 734, win 63, length 1162 > > 12:25:02.087657 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], > seq > > 1570:2153, ack 734, win 63, length 583 > > 12:25:02.087884 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], > ack > > 1570, win 16425, length 0 > > 12:25:02.210895 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [S], seq > > 598358245, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], > length > > 0 > > 12:25:02.210917 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [S.], seq > > 2090396113, ack 598358246, win 5840, options [mss > > 1460,nop,nop,sackOK,nop,wscale 7], length 0 > > 12:25:02.211131 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [.], ack > 1, > > win 16425, length 0 > > 12:25:02.211807 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [P.], seq > > 1:714, ack 1, win 16425, length 713 > > 12:25:02.211825 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [.], ack > > 714, win 57, length 0 > > 12:25:02.289333 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], > seq > > 1570:2153, ack 734, win 63, length 583 > > 12:25:02.289753 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], > ack > > 2153, win 16279, options [nop,nop,sack 1 {1570:2153}], length 0 > > 12:25:02.369489 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq > > 1:385, ack 714, win 57, length 384 > > 12:25:02.369509 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq > > 385:1511, ack 714, win 57, length 1126 > > Galera nao coloquei o log do tcpdump todo porque era muito extenso e > > repetitivo. > > > > Rodrigo Lira > > Coordenador de Suporte Técnico > > Rede GigaNet > > (83) 3021-5430 / 8754-5490 / 9906-2552 > > Msn: [email protected] > > Skype: rbl1984 > > ------------------------------------------ > > > > -- > > GUS-BR - Grupo de Usuários de Slackware Brasil > > http://www.slackwarebrasil.org/ > > http://groups.google.com/group/slack-users-br > > > > Antes de perguntar: > > http://www.istf.com.br/perguntas/ > > > > Para sair da lista envie um e-mail para: > > [email protected] > > > > -- > Otavio Augusto > --------------------- > Consultor de TI > > -- > GUS-BR - Grupo de Usuários de Slackware Brasil > http://www.slackwarebrasil.org/ > http://groups.google.com/group/slack-users-br > > Antes de perguntar: > http://www.istf.com.br/perguntas/ > > Para sair da lista envie um e-mail para: > [email protected] > -- GUS-BR - Grupo de Usuários de Slackware Brasil http://www.slackwarebrasil.org/ http://groups.google.com/group/slack-users-br Antes de perguntar: http://www.istf.com.br/perguntas/ Para sair da lista envie um e-mail para: [email protected]
