Realmente por algum motivo como proxy transparente, ele não esta tentando acesso no server 192.168.0.2 e sim no 192.168.0.1.
Fiz um comparativo aqui. Minha rede esta assim: - Server W2K3 - servidor de AD e DNS - Server Ubuntu - firewall e squid (esta por enquanto é uma maquina virtual para efeito de testes). Estação de teste: - WinXP (Maquina virtual tb) 2009/5/21 Nilson Chagas <[email protected]> > Zeca, não sei bem se é isto que vc estava pesando: > iptables -t nat -A PREROUTING -p tcp -m multiport -d ! 200.201.173.68 > --dports 80,443 -j REDIRECT --to-ports 3128 > > > > On Thu, May 21, 2009 at 10:56 AM, zeca <[email protected]>wrote: > >> >> >> Nilson como esta a sua regra de iptables para o proxy transparente. ! >> >> >> ------------------------------ >> *De:* [email protected] [mailto:[email protected]] *Em >> nome de *Nilson Chagas >> *Enviada em:* quinta-feira, 21 de maio de 2009 10:43 >> *Para:* [email protected] >> *Assunto:* [squid-br] Dicas Proxy Transparente >> >> Alguém poderia me dar uma luz, pq o meu proxy transparente não estaria >> funcionando??? >> >> r...@bsinternet:/home/administrador# cat /etc/squid/squid.conf >> >> ## >> ## ACL externa autenciação nas base LDAP do PDC >> ## >> #external_acl_type InetGroup %LOGIN /usr/lib/squid/squid_ldap_auth -R -b >> "dc=biosoja,dc=matriz" -D >> "cn=administrador,ou=administrador,dc=biosoja,dc=matriz" -w "<senha>" -f >> "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn%a,cn=users,dc=biosoja,dc=matriz))" >> -h 192.168.0.1 >> >> >> ## >> ## As linhas abaixo se referem a autenciação de usuários no AD >> ## >> auth_param basic program /usr/lib/squid/ldap_auth -R -b >> "dc=biosoja,dc=matriz" -D "cn=Administrador,cn=Users,dc=biosoja,dc=matriz" >> -w "<senha>" -f sAMAccountName=%s -h 192.168.0.1 >> auth_param basic children 5 >> auth_param basic realm Informe Usuario e Senha >> auth_param basic credentialsttl 5 minutes >> acl ldapauth proxy_auth REQUIRED # Exige autenticação >> >> ## >> ## Configuração do Cache ##################################### >> ## >> #cache_mem 128 MB >> cache_mem 2 MB >> cache_swap_low 90 >> cache_swap_high 95 >> #maximum_object_size 4096 KB >> maximum_object_size 8096 KB >> #maximum_object_size_in_memory 8 kb >> maximum_object_size_in_memory 20 kb >> #cache_dir ufs /var/spool/squid 100 16 256 >> cache_dir ufs /var/spool/squid 5 16 256 >> cache_access_log /var/log/squid/access.log >> cache_store_log /var/log/squid/store.log >> >> ## >> ##### ACLs (Access Control Lists) ########################### >> ## >> >> acl all src all >> >> acl LIBERA_MSN url_regex -i "/etc/squid/sites/msn.txt" # Libera MSN >> >> acl porno url_regex -i "/etc/squid/sites/porno.txt" # Lista >> Sites >> acl proibidos url_regex -i "/etc/squid/sites/proibidos.txt" # Lista >> Sites >> acl liberados url_regex -i "/etc/squid/sites/liberados.txt" # Lista >> Sites >> >> acl cadastro url_regex -i "/etc/squid/sites/cadastro.txt" # >> Lista Sites >> acl contabilidade url_regex -i "/etc/squid/sites/contabilidade.txt" # >> Lista Sites >> acl dp url_regex -i "/etc/squid/sites/dp.txt" # Lista Sites >> acl faturamento url_regex -i "/etc/squid/sites/faturamento.txt" # >> Lista Sites >> acl financeiro url_regex -i "/etc/squid/sites/financeiro.txt" # >> Lista Sites >> acl negocio url_regex -i "/etc/squid/sites/negocio.txt" # >> Lista Sites >> acl industria url_regex -i "/etc/squid/sites/industria.txt" # >> Lista Sites >> acl eletrica url_regex -i "/etc/squid/sites/eletrica.txt" # >> Lista Sites >> >> acl manager proto cache_object >> acl localhost src 127.0.0.1/32 >> acl to_localhost dst 127.0.0.0/8 >> >> ## Inicio - Permições de Rede >> # Grupos >> acl rede_bsdb src "/etc/squid/redes/bsdb.txt # IP do >> servidor BSDB >> acl rede_bsterm2 src "/etc/squid/redes/bsterm2.txt" # IP do >> servidor BSTERM2 >> acl rede_bsbkp src "/etc/squid/redes/bsbkp.txt" # IP do >> servidor BSBKP >> >> acl rede_cadastro src "/etc/squid/redes/cadastro.txt" # IPs >> setor cadastro >> acl rede_contabilidade src "/etc/squid/redes/contabilidade.txt" # IPs >> setor contabilidade >> acl rede_compras src "/etc/squid/redes/compras.txt" # IPs >> setor contabilidade >> acl rede_diretoria src "/etc/squid/redes/diretoria.txt" # IPs >> setor diretoria >> acl rede_dp src "/etc/squid/redes/dp.txt" # IPs >> setor DP >> acl rede_faturamento src "/etc/squid/redes/faturamento.txt" # IPs >> setor faturamento >> acl rede_financeiro src "/etc/squid/redes/financeiro.txt" # IPs >> setor financeiro >> acl rede_gestor src "/etc/squid/redes/gestor.txt" # IPs >> setor gestor >> acl rede_juridico src "/etc/squid/redes/juridico.txt" # IPs >> setor juridico >> acl rede_logistica src "/etc/squid/redes/logistica.txt" # IPs >> setor logistica >> acl rede_negocio src "/etc/squid/redes/negocio.txt" # IPs >> setor negocio >> acl rede_portaria src "/etc/squid/redes/portaria.txt" # IPs >> setor portaria >> acl rede_ti src "/etc/squid/redes/ti.txt" # IPs >> setor ti >> # >> >> acl rede_interna src 192.168.0.0/24 # Range da Rede Interna >> >> acl rede_wireless src 192.168.0.113 # Rage da Rede Wireless >> >> acl acesso_gestores proxy_auth "/etc/squid/usuarios/gestores.txt" >> acl acesso_dp proxy_auth "/etc/squid/usuarios/dp.txt" >> >> #Bloqueio downloads de arquivos no webmail >> >> acl mult urlpath_regex .mp3$ .pps$ .ppt$ .asfv1$ .mpeg$ .mpg$ .pps$ .mov$ >> .avi$ .asf$ .wmv$ .ra$ .rm$ .ram$ .asx$ .asf$ .afx$ .divx$ .m3u$ .viv$ >> .vivo$ .vo$ >> acl mult2 urlpath_regex .pps$ .ppt$ .com$ .exe$ .pif$ .bat$ .asfv1 .wmv$ >> .mp3$ .avi$ .mpg$ .mpge$ .asf$ >> >> acl mimeproibe rep_mime_type "/etc/squid/sites/mimeproibe.txt >> acl mimeproibe2 req_mime_type "/etc/squid/sites/mimeproibe.txt" # >> Complemento da anterior >> >> acl nofiles urlpath_regex –i >> \.(mp3|avi|pps|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|afx|asfv1|divx|m3u|viv|vivo|vo)$ >> acl blockexe urlpath_regex -i >> \.(com|exe|pif|pps|bat|wmv|mp3|avi|mpg|mpge|asf|asfv1)($|\?)" # Bloqueia a >> execução de aplicativos dmime-type >> >> # >> >> # Liberação Windows UPDATE >> acl WindowsUpdate dstdomain -i "/etc/squid/sites/windowsupdate.txt" >> >> # Liberação Caixa Economica Federal >> acl CEF dstdomain -i "/etc/squid/sites/cef.txt" >> >> ## Fim - Permições de Rede >> >> acl SSL_ports port 443 # https >> acl SSL_ports port 563 # snews >> acl SSL_ports port 873 # rsync >> acl Safe_ports port 80 # http >> acl Safe_ports port 443 # https >> acl Safe_ports port 70 # gopher >> acl Safe_ports port 210 # wais >> #acl Safe_ports port 1025-65535 # unregistered ports >> acl Safe_ports port 280 # http-mgmt >> acl Safe_ports port 488 # gss-http >> acl Safe_ports port 591 # filemaker >> acl Safe_ports port 777 # multiling http >> acl Safe_ports port 631 # cups >> acl Safe_ports port 873 # rsync >> acl Safe_ports port 901 # SWAT >> acl Safe_ports port 21 # ftp >> acl purge method PURGE >> acl CONNECT method CONNECT >> acl apache rep_header Server ^Apache >> >> ## >> ## HTTP ######################### >> >> http_port 3128 transparent >> >> no_cache deny WindowsUpdate >> http_access allow WindowsUpdate >> >> no_cache deny CEF >> http_access allow CEF >> >> http_access allow LIBERA_MSN >> >> #http_access allow liberados >> >> http_access allow rede_diretoria >> http_access deny porno >> >> http_access allow rede_wireless >> >> http_access allow rede_ti >> >> http_access deny proibidos >> >> http_access allow rede_gestor >> >> http_access allow rede_bsdb liberados >> http_access deny rede_bsdb !liberados >> http_access allow rede_bsterm2 liberados >> http_access deny rede_bsterm2 !liberados >> http_access allow rede_bsbkp liberados >> http_access deny rede_bsbkp !liberados >> >> http_access allow rede_cadastro cadastro >> http_access allow rede_cadastro liberados >> http_access deny rede_cadastro !cadastro >> http_access allow rede_contabilidade contabilidade >> http_access allow rede_contabilidade liberados >> http_access deny rede_contabilidade !contabilidade >> #http_access allow rede_compras compras >> http_access allow rede_compras liberados >> http_access deny rede_compras !liberados >> http_access allow rede_faturamento faturamento >> http_access allow rede_faturamento liberados >> http_access deny rede_faturamento !faturamento >> http_access allow rede_financeiro financeiro >> http_access allow rede_financeiro liberados >> http_access deny rede_financeiro !financeiro >> http_access allow rede_juridico !proibidos >> http_access allow rede_logistica !proibidos >> http_access allow rede_negocio negocio >> http_access allow rede_negocio liberados >> http_access deny rede_negocio !negocio >> http_access allow rede_portaria liberados >> http_access deny rede_portaria !liberados >> >> http_access allow acesso_gestores >> >> http_access allow rede_dp dp >> >> http_access deny mult >> http_access deny mult2 >> http_reply_access deny mimeproibe >> http_reply_access deny mimeproibe2 >> http_access deny blockexe >> http_access deny nofiles >> >> http_access allow rede_interna ldapauth liberados >> >> http_access allow manager localhost >> http_access deny manager >> http_access allow purge localhost >> http_access deny purge >> http_access deny !Safe_ports >> http_access deny CONNECT !SSL_ports >> http_access allow localhost >> http_access deny all >> >> ## >> ## PROXY REVERSO ################## >> ## >> #httpd_accel_host 192.168.0.2 >> #httpd_accel_port 3128 >> #httpd_accel_single_host on >> #httpd_accel_uses_host_header off >> >> ## >> ## ICP ############################ >> ## >> #icp_access allow localnet >> icp_access allow rede_interna >> icp_access deny all >> >> ## >> ## REFRESH ######################## >> ## >> refresh_pattern ^ftp: 1440 20% 10080 >> refresh_pattern ^gopher: 1440 0% 1440 >> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 >> refresh_pattern . 0 20% 4320 >> >> >> ## >> ## OUTRAS CONFIGURAÇÔES ############ >> ## >> hierarchy_stoplist cgi-bin ? >> access_log /var/log/squid/access.log squid >> broken_vary_encoding allow apache >> extension_methods REPORT MERGE MKACTIVITY CHECKOUT >> hosts_file /etc/hosts >> coredump_dir /var/spool/squid >> >> >> -- >> []s >> Nilson Chagas - Ubuntu User 25794 >> --- >> Visite: >> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >> http://tempodesalvacao.blogspot.com/ >> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >> Biblico >> >> >> >> > > > > -- > []s > Nilson Chagas - Ubuntu User 25794 > --- > Visite: > http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico > http://tempodesalvacao.blogspot.com/ > http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico > > > -- []s Nilson Chagas - Ubuntu User 25794 --- Visite: http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico http://tempodesalvacao.blogspot.com/ http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico
