Me perdoem o flood, mas faltou registrar, pra fazer os testes, deixei apenas as seguintes regras no firewall:
/iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT/ Ou seja, tudo aberto. Neste tempo o msn estabilizou conectado. Agora preciso fechar o firewall denovo, deixar o proxy transparente e deixar esta encrenca do msn funcionando. =-O PS: esta Thread já ta quase OFF TOPIC// Paulo Daniel Dorensbach escreveu: > Aproveitei a dica do tcpdump e usei aqui. > Abaixo coloquei algumas linhas capturadas. > > Como eu poderia montar as regras no firewall pra deixar passar sempre?? > > Desta forma deveria resolver, não? :-\ > > iptables -I FORWARD -p tcp --dport 1863 -j ACCEPT > > > Linhas de log do TCPDump > > #################################################################### > 15:58:22.422032 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 60 > 15:58:22.619794 IP 192.168.1.61.1060 > 64.4.34.224.1863: Flags [.], ack > 38226, win 65535, length 0 > 15:58:22.619816 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 48 > 15:58:24.192237 IP 192.168.1.61.1060 > 64.4.34.224.1863: Flags [.], ack > 38226, win 65535, length 0 > 15:58:24.192288 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 48 > 15:58:27.440228 IP 192.168.1.61.1060 > 64.4.34.224.1863: Flags [.], ack > 38226, win 65535, length 0 > 15:58:27.440279 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 48 > 15:58:33.804324 IP 192.168.1.61.1060 > 64.4.34.224.1863: Flags [.], ack > 38226, win 65535, length 0 > 15:58:33.804382 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 48 > 15:58:46.592633 IP 192.168.1.61.1060 > 64.4.34.224.1863: Flags [.], ack > 38226, win 65535, length 0 > 15:58:46.592664 IP 192.168.1.2 > 192.168.1.61: ICMP 64.4.34.224 tcp port > 1863 unreachable, length 48 > 15:59:33.331863 IP 192.168.1.2.3128 > 192.168.1.61.1098: Flags [P.], ack > 135126, win 63784, length 1440 > 16:00:25.108392 IP 192.168.1.61.1112 > 64.4.9.254.1863: Flags [S], seq > 52651824, win 65535, options [mss 1460,nop,nop,sackOK], length 0 > #################################################################### > > > Paulo Daniel Dorensbach escreveu: >> Tentei vario IP's e varios links, mas o dito cujo não toma jeito. :-( >> >> Fui vendo os logs do squid e os ips e links que o msn acessava durante a >> conexão fui testando nas regras do firewall, mas com nenhum ele >> permanece conecatado por mais de 10 minutos. >> >> To comecando a desconfiar da maquina. Mas ja ouvi lendasde maquinas mais >> "caquinhas" trabalharem bem com squid. >> Configuração do meu server: >> Intel(R) Pentium(R) 4 CPU 3.00GHz >> 512Mb Memória >> 1Gb Swap >> HD Sata 250 Gb, sendo que o squid ta no / que tem 20Gb. >> >> Algumas conf do squid.conf: >> >> ####################################### >> http_port 3128 transparent >> # Memória RAM usada pelo squid >> cache_mem 256 MB >> # Gerenciamento do cache rotate >> cache_swap_low 90 >> cache_swap_high 95 >> # Arquivo máximo gravado no Cache >> maximum_object_size 30480 KB >> # Diretório do cache >> cache_dir ufs /var/log/squid/cache 4096 16 256 >> >> acl SSL_ports port 443 >> acl Safe_ports port 80 # http >> acl Safe_ports port 21 # ftp >> acl Safe_ports port 443 # https >> acl Safe_ports port 70 # gopher >> acl Safe_ports port 210 #wais >> acl Safe_ports port 1025-65535 # unregistered ports >> acl Safe_ports port 280 # http-mgmt >> acl Safe_ports port 488 # gss-http >> acl Safe_ports port 591 # filemaker >> acl Safe_ports port 777 # multiling http >> acl Safe_ports port 1863 # MSN >> acl CONNECT method CONNECT >> ####################################### >> >> >> >> zeca escreveu: >> >>> tenta com esse veja se resolve >>> >>> mensager.hotmail.com ou 208.70.188.17 >>> >>> >>> ------------------------------------------------------------------------ >>> *De:* [email protected] [mailto:[email protected]] >>> *Em nome de *Paulo Daniel Dorensbach >>> *Enviada em:* sábado, 16 de maio de 2009 10:03 >>> *Para:* [email protected] >>> *Assunto:* Re: RES: [squid-br] MSN não se mantem conectado >>> >>> E o que eu coloco no "sitemessenger" ??? >>> >>> zeca escreveu: >>> >>>> Sr tenta isso e veja se resolve essa regras antes da regra >>>> redirecionamento para o squid. >>>> veja se funciona >>>> >>>> iptables -t nat -A PREROUTING -i eth0 -d sitemenssanger -p tcp --dport >>>> 1863 -j ACCEPT >>>> >>>> iptables -I FORWARD -p tcp --dport 1863 -d sitemenssanger -j ACCEPT >>>> iptables -I FORWARD -p tcp -s sitemenssager -m state --state >>>> ESTABLISHED,RELATED -j ACCEPT >>>> iptables -t nat -I PREROUTING -d sitemenssanger -j ACCEPT >>>> iptables -t nat -I PREROUTING -s sitemenssanger -j ACCEPT >>>> iptables -A INPUT -i eth0 -p udp -s sitemenssanger -j ACCEPT >>>> iptables -A INPUT -i eth0 -p tcp -s sitemenssanger -j ACCEPT >>>> iptables -A OUTPUT -p tcp --destination-port 1863:1863 -j ACCEPT >>>> iptables -A INPUT -p tcp --destination-port 1863:1863 -j ACCEPT >>>> >>>> >>>> >>>> >>>> ---------------------------------------------------------- >>>> *De:* [email protected] >>>> -- +--------------------------------------------------+ Paulo Daniel Dorensbach Técnico em Redes de Computadores Técnico Florestal Usuario GNU/Linux #363631 - http://counter.li.org/ "We don't need no education" http://geocities.yahoo.com.br/dorensbach www.velocidadejusta.com.br/rfc.htm By Mozilla Thunderbird www.mozilla.org.br +--------------------------------------------------+ __________________________________________________ Faça ligações para outros computadores com o novo Yahoo! Messenger http://br.beta.messenger.yahoo.com/
