Cara gasta energia para resolver o meu problema com proxy transparente. rsrsrrs
Esta com o subject: Erro: TCP_DENIED/400 2009/5/25 bruno micali macagnani <[email protected]> > > > vou analizar o proxy... abracos > Bruno Macagnani > > > > 2009/5/25 Nilson Chagas <[email protected]> > >> >> >> rsrsrs As vezes esqueço que trabalhamos com informatica e não videntes. >> rsrsrss >> >> r...@bsinternet:~/etc/firewall# cat /etc/squid/squid.conf >> >> ## >> ## ACL externa autenciação nas base LDAP do PDC >> ## >> #external_acl_type InetGroup %LOGIN /usr/lib/squid/squid_ldap_auth -R -b >> "dc=biosoja,dc=matriz" -D >> "cn=administrador,ou=administrador,dc=biosoja,dc=matriz" -w "<senha>" -f >> "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn%a,cn=users,dc=biosoja,dc=matriz))" >> -h 192.168.0.1 >> >> >> ## >> ## As linhas abaixo se referem a autenciação de usuários no AD >> ## >> auth_param basic program /usr/lib/squid/ldap_auth -R -b >> "dc=biosoja,dc=matriz" -D "cn=Administrador,cn=Users,dc=biosoja,dc=matriz" >> -w "<senha>" -f sAMAccountName=%s -h 192.168.0.1 >> auth_param basic children 5 >> auth_param basic realm Informe Usuario e Senha >> auth_param basic credentialsttl 5 minutes >> acl ldapauth proxy_auth REQUIRED # Exige autenticação >> >> ## >> ## Configuração do Cache ##################################### >> ## >> cache_mem 128 MB >> #cache_mem 2 MB >> cache_swap_low 90 >> cache_swap_high 95 >> #maximum_object_size 4096 KB >> maximum_object_size 8096 KB >> #maximum_object_size_in_memory 8 kb >> maximum_object_size_in_memory 20 kb >> cache_dir ufs /var/spool/squid 1000 16 256 >> #cache_dir ufs /var/spool/squid 5 16 256 >> cache_access_log /var/log/squid/access.log >> cache_store_log /var/log/squid/store.log >> >> ## >> ##### ACLs (Access Control Lists) ########################### >> ## >> >> acl all src all >> >> acl LIBERA_MSN url_regex -i "/etc/squid/sites/msn.txt" # Libera MSN >> >> acl porno url_regex -i "/etc/squid/sites/porno.txt" # Lista Sites >> acl proibidos url_regex -i "/etc/squid/sites/proibidos.txt" # Lista Sites >> acl liberados url_regex -i "/etc/squid/sites/liberados.txt" # Lista Sites >> >> acl cadastro url_regex -i "/etc/squid/sites/cadastro.txt" # Lista Sites >> acl contabilidade url_regex -i "/etc/squid/sites/contabilidade.txt" # >> Lista Sites >> acl dp url_regex -i "/etc/squid/sites/dp.txt" # Lista Sites >> acl faturamento url_regex -i "/etc/squid/sites/faturamento.txt" # Lista >> Sites >> acl financeiro url_regex -i "/etc/squid/sites/financeiro.txt" # Lista >> Sites >> acl negocio url_regex -i "/etc/squid/sites/negocio.txt" # Lista Sites >> acl industria url_regex -i "/etc/squid/sites/industria.txt" # Lista Sites >> acl eletrica url_regex -i "/etc/squid/sites/eletrica.txt" # Lista Sites >> >> acl manager proto cache_object >> acl localhost src 127.0.0.1/32 >> acl to_localhost dst 127.0.0.0/8 >> >> ## Inicio - Permições de Rede >> # Grupos >> acl rede_bsdb src "/etc/squid/redes/bsdb.txt # IP do servidor BSDB >> acl rede_bsterm2 src "/etc/squid/redes/bsterm2.txt" # IP do servidor >> BSTERM2 >> acl rede_bsbkp src "/etc/squid/redes/bsbkp.txt" # IP do servidor BSBKP >> >> acl rede_cadastro src "/etc/squid/redes/cadastro.txt" # IPs setor cadastro >> acl rede_contabilidade src "/etc/squid/redes/contabilidade.txt" # IPs >> setor contabilidade >> acl rede_compras src "/etc/squid/redes/compras.txt" # IPs setor >> contabilidade >> acl rede_diretoria src "/etc/squid/redes/diretoria.txt" # IPs setor >> diretoria >> acl rede_dp src "/etc/squid/redes/dp.txt" # IPs setor DP >> acl rede_faturamento src "/etc/squid/redes/faturamento.txt" # IPs setor >> faturamento >> acl rede_financeiro src "/etc/squid/redes/financeiro.txt" # IPs setor >> financeiro >> acl rede_gestor src "/etc/squid/redes/gestor.txt" # IPs setor gestor >> acl rede_juridico src "/etc/squid/redes/juridico.txt" # IPs setor juridico >> acl rede_logistica src "/etc/squid/redes/logistica.txt" # IPs setor >> logistica >> acl rede_negocio src "/etc/squid/redes/negocio.txt" # IPs setor negocio >> acl rede_portaria src "/etc/squid/redes/portaria.txt" # IPs setor portaria >> acl rede_ti src "/etc/squid/redes/ti.txt" # IPs setor ti >> # >> >> acl rede_interna src 192.168.0.0/24 # Range da Rede Interna >> >> acl rede_wireless src 192.168.15.0/24 # Rage da Rede Wireless >> >> acl acesso_gestores proxy_auth "/etc/squid/usuarios/gestores.txt" >> acl acesso_dp proxy_auth "/etc/squid/usuarios/dp.txt" >> >> #Bloqueio downloads de arquivos no webmail >> >> acl mult urlpath_regex .mp3$ .pps$ .ppt$ .asfv1$ .mpeg$ .mpg$ .pps$ .mov$ >> .avi$ .asf$ .wmv$ .ra$ .rm$ .ram$ .asx$ .asf$ .afx$ .divx$ .m3u$ .viv$ >> .vivo$ .vo$ >> acl mult2 urlpath_regex .pps$ .ppt$ .com$ .exe$ .pif$ .bat$ .asfv1 .wmv$ >> .mp3$ .avi$ .mpg$ .mpge$ .asf$ >> >> acl mimeproibe rep_mime_type "/etc/squid/sites/mimeproibe.txt >> acl mimeproibe2 req_mime_type "/etc/squid/sites/mimeproibe.txt" # >> Complemento da anterior >> >> acl nofiles urlpath_regex –i >> \.(mp3|avi|pps|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|afx|asfv1|divx|m3u|viv|vivo|vo)$ >> acl blockexe urlpath_regex -i >> \.(com|exe|pif|pps|bat|wmv|mp3|avi|mpg|mpge|asf|asfv1)($|\?)" # Bloqueia a >> execução de aplicativos dmime-type >> >> # >> >> # Liberação Windows UPDATE >> acl WindowsUpdate dstdomain -i "/etc/squid/sites/windowsupdate.txt" >> >> # Liberação Caixa Economica Federal >> acl CEF dstdomain -i "/etc/squid/sites/cef.txt" >> >> ## Fim - Permições de Rede >> >> acl SSL_ports port 443 # https >> acl SSL_ports port 563 # snews >> acl SSL_ports port 873 # rsync >> acl Safe_ports port 80 # http >> acl Safe_ports port 443 # https >> acl Safe_ports port 70 # gopher >> acl Safe_ports port 210 # wais >> #acl Safe_ports port 1025-65535 # unregistered ports >> acl Safe_ports port 280 # http-mgmt >> acl Safe_ports port 488 # gss-http >> acl Safe_ports port 591 # filemaker >> acl Safe_ports port 777 # multiling http >> acl Safe_ports port 631 # cups >> acl Safe_ports port 873 # rsync >> acl Safe_ports port 901 # SWAT >> acl Safe_ports port 21 # ftp >> acl purge method PURGE >> acl CONNECT method CONNECT >> acl apache rep_header Server ^Apache >> >> ## >> ## HTTP ######################### >> >> http_port 8080 transparent >> http_port 3128 >> >> no_cache deny WindowsUpdate >> http_access allow WindowsUpdate >> >> no_cache deny CEF >> http_access allow CEF >> >> http_access allow rede_wireless >> http_access deny rede_wireless porno >> >> http_access allow rede_interna LIBERA_MSN >> >> http_access allow rede_diretoria >> >> http_access deny porno >> >> http_access allow rede_ti >> >> http_access allow rede_dp CEF >> >> http_access deny rede_interna proibidos >> >> http_access allow rede_bsdb liberados >> http_access deny rede_bsdb !liberados >> http_access allow rede_bsterm2 liberados >> http_access deny rede_bsterm2 !liberados >> http_access allow rede_bsbkp liberados >> http_access deny rede_bsbkp !liberados >> >> #http_access allow rede_cadastro cadastro >> #http_access allow rede_cadastro liberados >> #http_access deny rede_cadastro !cadastro >> http_access allow rede_contabilidade contabilidade >> http_access allow rede_contabilidade liberados >> http_access deny rede_contabilidade !contabilidade >> #http_access allow rede_compras compras >> http_access allow rede_compras liberados >> http_access deny rede_compras !liberados >> http_access allow rede_faturamento faturamento >> http_access allow rede_faturamento liberados >> http_access deny rede_faturamento !faturamento >> http_access allow rede_financeiro financeiro >> http_access allow rede_financeiro liberados >> http_access deny rede_financeiro !financeiro >> http_access allow rede_juridico !proibidos >> http_access allow rede_logistica !proibidos >> http_access allow rede_negocio negocio >> http_access allow rede_negocio liberados >> http_access deny rede_negocio !negocio >> http_access allow rede_portaria liberados >> http_access deny rede_portaria !liberados >> >> http_access allow rede_gestor >> >> http_access allow acesso_gestores >> >> http_access allow acesso_dp dp >> >> http_access deny mult >> http_access deny mult2 >> http_reply_access deny mimeproibe >> http_reply_access deny mimeproibe2 >> http_access deny blockexe >> http_access deny nofiles >> >> http_access allow rede_interna ldapauth liberados >> >> http_access allow manager localhost >> http_access deny manager >> http_access allow purge localhost >> http_access deny purge >> http_access deny !Safe_ports >> http_access deny CONNECT !SSL_ports >> http_access allow localhost >> http_access deny all >> >> ## >> ## PROXY REVERSO ################## >> ## >> #httpd_accel_host virtual >> #httpd_accel_host 192.168.15.1 >> #httpd_accel_port 3128 >> ##httpd_accel_single_host on >> #httpd_accel_with_proxy on >> ##httpd_accel_uses_host_header off >> #httpd_accel_uses_host_header on >> >> ## >> ## ICP ############################ >> ## >> #icp_access allow localnet >> icp_access allow rede_interna >> icp_access deny all >> >> ## >> ## REFRESH ######################## >> ## >> refresh_pattern ^ftp: 1440 20% 10080 >> refresh_pattern ^gopher: 1440 0% 1440 >> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 >> refresh_pattern . 0 20% 4320 >> >> >> ## >> ## OUTRAS CONFIGURAÇÔES ############ >> ## >> hierarchy_stoplist cgi-bin ? >> access_log /var/log/squid/access.log squid >> broken_vary_encoding allow apache >> extension_methods REPORT MERGE MKACTIVITY CHECKOUT >> hosts_file /etc/hosts >> coredump_dir /var/spool/squid >> >> >> E minhas regras de redirecionamento estão assim: >> # Redirecionando Portas rede 192.168.0.0 >> $fw -t nat -A PREROUTING -i eth1 -p tcp -m multiport -d ! 200.201.173.68 >> --dports 80,443 -j REDIRECT --to-ports 3128 >> $fw -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 3128 -j REDIRECT >> --to-ports 3128 >> >> # Redirecionando Portas rede 192.168.15.0 >> $fw -t nat -A PREROUTING -i eth2 -p tcp -m multiport -d ! 200.201.173.68 >> --dports 80,443 -j REDIRECT --to-ports 8080 >> $fw -t nat -A PREROUTING -i eth2 -p tcp -m tcp --dport 8080 -j REDIRECT >> --to-ports 8080 >> >> >> Onde a rede 192.168.0.0 é onde estou conectado e tentando acessar o >> apache, é minha rede interna. >> >> A rede 192.168.15.0 é um acesso externo (wirelless) que disponibilizamos >> para visitantes. >> >> Não consigo lembrar qual foi a ultima alteração que fiz que possa ter >> gerado isto, acredito qua tenha sido depois de acrescentar a oção de proxy >> transparente. >> >> OBS.: Para ficar regisrado minha burrice lembrei que minha maquina não >> esta configurada para proxy, e por esta razão dá este erro. Isto só me >> ocorreu enquanto escrevia esta mensagem, pq estou tendo um outro problema >> com o proxy transparente. >> Ou seja para acessa internamente, sou obrigado a ter configurado o proxy >> no browser (é assim mesmo que eu quero). >> Desculpem. >> >> >> 2009/5/25 bruno micali macagnani <[email protected]> >> >>> >>> >>> amigo post o conf do squid. >>> Bruno Macagnani >>> >>> >>> >>> 2009/5/25 Nilson Chagas <[email protected]> >>> >>> >>>> >>>> Tenho um server com ip valido. >>>> >>>> Se digito o IP externo, recebo a mensagem do apache "ITS WORK!". >>>> Se informo o ip da rede, tenho a mensagem: >>>> ERROR The requested URL could not be retrieved >>>> ------------------------------ >>>> >>>> While trying to process the request: >>>> >>>> GET / HTTP/1.1 >>>> Host: 192.168.0.2 >>>> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) >>>> Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 >>>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> Accept-Language: en-us,en;q=0.5 >>>> Accept-Encoding: gzip,deflate >>>> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 >>>> Keep-Alive: 300 >>>> Connection: keep-alive >>>> >>>> >>>> The following error was encountered: >>>> >>>> - * Invalid Request * >>>> >>>> Some aspect of the HTTP Request is invalid. Possible problems: >>>> >>>> - Missing or unknown request method >>>> - Missing URL >>>> - Missing HTTP Identifier (HTTP/1.0) >>>> - Request is too large >>>> - Content-Length missing for POST or PUT requests >>>> - Illegal character in hostname; underscores are not allowed >>>> >>>> Your cache administrator is webmaster. >>>> ------------------------------ >>>> Generated Mon, 25 May 2009 14:03:35 GMT by bsinternet.biosoja.matriz >>>> (squid/2.7.STABLE3) >>>> >>>> Por onde eu posso começar a procurar isto??? >>>> >>>> -- >>>> []s >>>> OBS.: Para ficar regisrado minha burrice lembrei que minha maquina não >>>> esta configurada para proxy, e por esta razão dá este erro. Isto só me >>>> ocorreu enquanto escrevia esta mensagem, pq estou tendo um outro problema >>>> com o proxy transparente. >>>> Desculpem >>>> Nilson Chagas - Ubuntu User 25794 >>>> --- >>>> Visite: >>>> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >>>> http://tempodesalvacao.blogspot.com/ >>>> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >>>> Biblico >>>> >>>> >>>> >>> >> >> >> -- >> []s >> Nilson Chagas - Ubuntu User 25794 >> --- >> Visite: >> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >> http://tempodesalvacao.blogspot.com/ >> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >> Biblico >> >> >> > > -- []s Nilson Chagas - Ubuntu User 25794 --- Visite: http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico http://tempodesalvacao.blogspot.com/ http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico
