Estou conversando como Gleison, e pelo que estamos vendo, vamos tentar encaminhar o server w2k3 (192.168.0.1) para o server internet (192.168.0.2), através das opções do DNS, e tentar liberar a porta no firewall.
2009/5/21 Nilson Chagas <[email protected]> > Realmente por algum motivo como proxy transparente, ele não esta tentando > acesso no server 192.168.0.2 e sim no 192.168.0.1. > > Fiz um comparativo aqui. > > Minha rede esta assim: > - Server W2K3 - servidor de AD e DNS > - Server Ubuntu - firewall e squid (esta por enquanto é uma maquina virtual > para efeito de testes). > > Estação de teste: > - WinXP (Maquina virtual tb) > > > 2009/5/21 Nilson Chagas <[email protected]> > > Zeca, não sei bem se é isto que vc estava pesando: >> iptables -t nat -A PREROUTING -p tcp -m multiport -d ! 200.201.173.68 >> --dports 80,443 -j REDIRECT --to-ports 3128 >> >> >> >> On Thu, May 21, 2009 at 10:56 AM, zeca <[email protected]>wrote: >> >>> >>> >>> Nilson como esta a sua regra de iptables para o proxy transparente. ! >>> >>> >>> ------------------------------ >>> *De:* [email protected] [mailto:[email protected]] *Em >>> nome de *Nilson Chagas >>> *Enviada em:* quinta-feira, 21 de maio de 2009 10:43 >>> *Para:* [email protected] >>> *Assunto:* [squid-br] Dicas Proxy Transparente >>> >>> Alguém poderia me dar uma luz, pq o meu proxy transparente não estaria >>> funcionando??? >>> >>> r...@bsinternet:/home/administrador# cat /etc/squid/squid.conf >>> >>> ## >>> ## ACL externa autenciação nas base LDAP do PDC >>> ## >>> #external_acl_type InetGroup %LOGIN /usr/lib/squid/squid_ldap_auth -R -b >>> "dc=biosoja,dc=matriz" -D >>> "cn=administrador,ou=administrador,dc=biosoja,dc=matriz" -w "<senha>" -f >>> "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn%a,cn=users,dc=biosoja,dc=matriz))" >>> -h 192.168.0.1 >>> >>> >>> ## >>> ## As linhas abaixo se referem a autenciação de usuários no AD >>> ## >>> auth_param basic program /usr/lib/squid/ldap_auth -R -b >>> "dc=biosoja,dc=matriz" -D "cn=Administrador,cn=Users,dc=biosoja,dc=matriz" >>> -w "<senha>" -f sAMAccountName=%s -h 192.168.0.1 >>> auth_param basic children 5 >>> auth_param basic realm Informe Usuario e Senha >>> auth_param basic credentialsttl 5 minutes >>> acl ldapauth proxy_auth REQUIRED # Exige autenticação >>> >>> ## >>> ## Configuração do Cache ##################################### >>> ## >>> #cache_mem 128 MB >>> cache_mem 2 MB >>> cache_swap_low 90 >>> cache_swap_high 95 >>> #maximum_object_size 4096 KB >>> maximum_object_size 8096 KB >>> #maximum_object_size_in_memory 8 kb >>> maximum_object_size_in_memory 20 kb >>> #cache_dir ufs /var/spool/squid 100 16 256 >>> cache_dir ufs /var/spool/squid 5 16 256 >>> cache_access_log /var/log/squid/access.log >>> cache_store_log /var/log/squid/store.log >>> >>> ## >>> ##### ACLs (Access Control Lists) ########################### >>> ## >>> >>> acl all src all >>> >>> acl LIBERA_MSN url_regex -i "/etc/squid/sites/msn.txt" # Libera >>> MSN >>> >>> acl porno url_regex -i "/etc/squid/sites/porno.txt" # Lista >>> Sites >>> acl proibidos url_regex -i "/etc/squid/sites/proibidos.txt" # Lista >>> Sites >>> acl liberados url_regex -i "/etc/squid/sites/liberados.txt" # Lista >>> Sites >>> >>> acl cadastro url_regex -i "/etc/squid/sites/cadastro.txt" # >>> Lista Sites >>> acl contabilidade url_regex -i "/etc/squid/sites/contabilidade.txt" # >>> Lista Sites >>> acl dp url_regex -i "/etc/squid/sites/dp.txt" # Lista Sites >>> acl faturamento url_regex -i "/etc/squid/sites/faturamento.txt" # >>> Lista Sites >>> acl financeiro url_regex -i "/etc/squid/sites/financeiro.txt" # >>> Lista Sites >>> acl negocio url_regex -i "/etc/squid/sites/negocio.txt" # >>> Lista Sites >>> acl industria url_regex -i "/etc/squid/sites/industria.txt" # >>> Lista Sites >>> acl eletrica url_regex -i "/etc/squid/sites/eletrica.txt" # >>> Lista Sites >>> >>> acl manager proto cache_object >>> acl localhost src 127.0.0.1/32 >>> acl to_localhost dst 127.0.0.0/8 >>> >>> ## Inicio - Permições de Rede >>> # Grupos >>> acl rede_bsdb src "/etc/squid/redes/bsdb.txt # IP do >>> servidor BSDB >>> acl rede_bsterm2 src "/etc/squid/redes/bsterm2.txt" # IP do >>> servidor BSTERM2 >>> acl rede_bsbkp src "/etc/squid/redes/bsbkp.txt" # IP do >>> servidor BSBKP >>> >>> acl rede_cadastro src "/etc/squid/redes/cadastro.txt" # IPs >>> setor cadastro >>> acl rede_contabilidade src "/etc/squid/redes/contabilidade.txt" # IPs >>> setor contabilidade >>> acl rede_compras src "/etc/squid/redes/compras.txt" # IPs >>> setor contabilidade >>> acl rede_diretoria src "/etc/squid/redes/diretoria.txt" # IPs >>> setor diretoria >>> acl rede_dp src "/etc/squid/redes/dp.txt" # IPs >>> setor DP >>> acl rede_faturamento src "/etc/squid/redes/faturamento.txt" # IPs >>> setor faturamento >>> acl rede_financeiro src "/etc/squid/redes/financeiro.txt" # IPs >>> setor financeiro >>> acl rede_gestor src "/etc/squid/redes/gestor.txt" # IPs >>> setor gestor >>> acl rede_juridico src "/etc/squid/redes/juridico.txt" # IPs >>> setor juridico >>> acl rede_logistica src "/etc/squid/redes/logistica.txt" # IPs >>> setor logistica >>> acl rede_negocio src "/etc/squid/redes/negocio.txt" # IPs >>> setor negocio >>> acl rede_portaria src "/etc/squid/redes/portaria.txt" # IPs >>> setor portaria >>> acl rede_ti src "/etc/squid/redes/ti.txt" # IPs >>> setor ti >>> # >>> >>> acl rede_interna src 192.168.0.0/24 # Range da Rede Interna >>> >>> acl rede_wireless src 192.168.0.113 # Rage da Rede Wireless >>> >>> acl acesso_gestores proxy_auth "/etc/squid/usuarios/gestores.txt" >>> acl acesso_dp proxy_auth "/etc/squid/usuarios/dp.txt" >>> >>> #Bloqueio downloads de arquivos no webmail >>> >>> acl mult urlpath_regex .mp3$ .pps$ .ppt$ .asfv1$ .mpeg$ .mpg$ .pps$ .mov$ >>> .avi$ .asf$ .wmv$ .ra$ .rm$ .ram$ .asx$ .asf$ .afx$ .divx$ .m3u$ .viv$ >>> .vivo$ .vo$ >>> acl mult2 urlpath_regex .pps$ .ppt$ .com$ .exe$ .pif$ .bat$ .asfv1 .wmv$ >>> .mp3$ .avi$ .mpg$ .mpge$ .asf$ >>> >>> acl mimeproibe rep_mime_type "/etc/squid/sites/mimeproibe.txt >>> acl mimeproibe2 req_mime_type "/etc/squid/sites/mimeproibe.txt" # >>> Complemento da anterior >>> >>> acl nofiles urlpath_regex –i >>> \.(mp3|avi|pps|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|afx|asfv1|divx|m3u|viv|vivo|vo)$ >>> acl blockexe urlpath_regex -i >>> \.(com|exe|pif|pps|bat|wmv|mp3|avi|mpg|mpge|asf|asfv1)($|\?)" # Bloqueia a >>> execução de aplicativos dmime-type >>> >>> # >>> >>> # Liberação Windows UPDATE >>> acl WindowsUpdate dstdomain -i "/etc/squid/sites/windowsupdate.txt" >>> >>> # Liberação Caixa Economica Federal >>> acl CEF dstdomain -i "/etc/squid/sites/cef.txt" >>> >>> ## Fim - Permições de Rede >>> >>> acl SSL_ports port 443 # https >>> acl SSL_ports port 563 # snews >>> acl SSL_ports port 873 # rsync >>> acl Safe_ports port 80 # http >>> acl Safe_ports port 443 # https >>> acl Safe_ports port 70 # gopher >>> acl Safe_ports port 210 # wais >>> #acl Safe_ports port 1025-65535 # unregistered ports >>> acl Safe_ports port 280 # http-mgmt >>> acl Safe_ports port 488 # gss-http >>> acl Safe_ports port 591 # filemaker >>> acl Safe_ports port 777 # multiling http >>> acl Safe_ports port 631 # cups >>> acl Safe_ports port 873 # rsync >>> acl Safe_ports port 901 # SWAT >>> acl Safe_ports port 21 # ftp >>> acl purge method PURGE >>> acl CONNECT method CONNECT >>> acl apache rep_header Server ^Apache >>> >>> ## >>> ## HTTP ######################### >>> >>> http_port 3128 transparent >>> >>> no_cache deny WindowsUpdate >>> http_access allow WindowsUpdate >>> >>> no_cache deny CEF >>> http_access allow CEF >>> >>> http_access allow LIBERA_MSN >>> >>> #http_access allow liberados >>> >>> http_access allow rede_diretoria >>> http_access deny porno >>> >>> http_access allow rede_wireless >>> >>> http_access allow rede_ti >>> >>> http_access deny proibidos >>> >>> http_access allow rede_gestor >>> >>> http_access allow rede_bsdb liberados >>> http_access deny rede_bsdb !liberados >>> http_access allow rede_bsterm2 liberados >>> http_access deny rede_bsterm2 !liberados >>> http_access allow rede_bsbkp liberados >>> http_access deny rede_bsbkp !liberados >>> >>> http_access allow rede_cadastro cadastro >>> http_access allow rede_cadastro liberados >>> http_access deny rede_cadastro !cadastro >>> http_access allow rede_contabilidade contabilidade >>> http_access allow rede_contabilidade liberados >>> http_access deny rede_contabilidade !contabilidade >>> #http_access allow rede_compras compras >>> http_access allow rede_compras liberados >>> http_access deny rede_compras !liberados >>> http_access allow rede_faturamento faturamento >>> http_access allow rede_faturamento liberados >>> http_access deny rede_faturamento !faturamento >>> http_access allow rede_financeiro financeiro >>> http_access allow rede_financeiro liberados >>> http_access deny rede_financeiro !financeiro >>> http_access allow rede_juridico !proibidos >>> http_access allow rede_logistica !proibidos >>> http_access allow rede_negocio negocio >>> http_access allow rede_negocio liberados >>> http_access deny rede_negocio !negocio >>> http_access allow rede_portaria liberados >>> http_access deny rede_portaria !liberados >>> >>> http_access allow acesso_gestores >>> >>> http_access allow rede_dp dp >>> >>> http_access deny mult >>> http_access deny mult2 >>> http_reply_access deny mimeproibe >>> http_reply_access deny mimeproibe2 >>> http_access deny blockexe >>> http_access deny nofiles >>> >>> http_access allow rede_interna ldapauth liberados >>> >>> http_access allow manager localhost >>> http_access deny manager >>> http_access allow purge localhost >>> http_access deny purge >>> http_access deny !Safe_ports >>> http_access deny CONNECT !SSL_ports >>> http_access allow localhost >>> http_access deny all >>> >>> ## >>> ## PROXY REVERSO ################## >>> ## >>> #httpd_accel_host 192.168.0.2 >>> #httpd_accel_port 3128 >>> #httpd_accel_single_host on >>> #httpd_accel_uses_host_header off >>> >>> ## >>> ## ICP ############################ >>> ## >>> #icp_access allow localnet >>> icp_access allow rede_interna >>> icp_access deny all >>> >>> ## >>> ## REFRESH ######################## >>> ## >>> refresh_pattern ^ftp: 1440 20% 10080 >>> refresh_pattern ^gopher: 1440 0% 1440 >>> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 >>> refresh_pattern . 0 20% 4320 >>> >>> >>> ## >>> ## OUTRAS CONFIGURAÇÔES ############ >>> ## >>> hierarchy_stoplist cgi-bin ? >>> access_log /var/log/squid/access.log squid >>> broken_vary_encoding allow apache >>> extension_methods REPORT MERGE MKACTIVITY CHECKOUT >>> hosts_file /etc/hosts >>> coredump_dir /var/spool/squid >>> >>> >>> -- >>> []s >>> Nilson Chagas - Ubuntu User 25794 >>> --- >>> Visite: >>> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >>> http://tempodesalvacao.blogspot.com/ >>> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >>> Biblico >>> >>> >>> >>> >> >> >> >> -- >> []s >> Nilson Chagas - Ubuntu User 25794 >> --- >> Visite: >> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >> http://tempodesalvacao.blogspot.com/ >> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >> Biblico >> >> >> > > > -- > []s > Nilson Chagas - Ubuntu User 25794 > --- > Visite: > http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico > http://tempodesalvacao.blogspot.com/ > http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico > > > -- []s Nilson Chagas - Ubuntu User 25794 --- Visite: http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico http://tempodesalvacao.blogspot.com/ http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico
