Vou ver o possivel.... Se conseguir algo te falo..
abs Bruno Macagnani 2009/5/25 Nilson Chagas <[email protected]> > > > Cara gasta energia para resolver o meu problema com proxy transparente. > rsrsrrs > > Esta com o subject: > Erro: TCP_DENIED/400 > > > 2009/5/25 bruno micali macagnani <[email protected]> > >> >> >> vou analizar o proxy... abracos >> Bruno Macagnani >> >> >> >> 2009/5/25 Nilson Chagas <[email protected]> >> >>> >>> >>> rsrsrs As vezes esqueço que trabalhamos com informatica e não videntes. >>> rsrsrss >>> >>> r...@bsinternet:~/etc/firewall# cat /etc/squid/squid.conf >>> >>> ## >>> ## ACL externa autenciação nas base LDAP do PDC >>> ## >>> #external_acl_type InetGroup %LOGIN /usr/lib/squid/squid_ldap_auth -R -b >>> "dc=biosoja,dc=matriz" -D >>> "cn=administrador,ou=administrador,dc=biosoja,dc=matriz" -w "<senha>" -f >>> "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn%a,cn=users,dc=biosoja,dc=matriz))" >>> -h 192.168.0.1 >>> >>> >>> ## >>> ## As linhas abaixo se referem a autenciação de usuários no AD >>> ## >>> auth_param basic program /usr/lib/squid/ldap_auth -R -b >>> "dc=biosoja,dc=matriz" -D "cn=Administrador,cn=Users,dc=biosoja,dc=matriz" >>> -w "<senha>" -f sAMAccountName=%s -h 192.168.0.1 >>> auth_param basic children 5 >>> auth_param basic realm Informe Usuario e Senha >>> auth_param basic credentialsttl 5 minutes >>> acl ldapauth proxy_auth REQUIRED # Exige autenticação >>> >>> ## >>> ## Configuração do Cache ##################################### >>> ## >>> cache_mem 128 MB >>> #cache_mem 2 MB >>> cache_swap_low 90 >>> cache_swap_high 95 >>> #maximum_object_size 4096 KB >>> maximum_object_size 8096 KB >>> #maximum_object_size_in_memory 8 kb >>> maximum_object_size_in_memory 20 kb >>> cache_dir ufs /var/spool/squid 1000 16 256 >>> #cache_dir ufs /var/spool/squid 5 16 256 >>> cache_access_log /var/log/squid/access.log >>> cache_store_log /var/log/squid/store.log >>> >>> ## >>> ##### ACLs (Access Control Lists) ########################### >>> ## >>> >>> acl all src all >>> >>> acl LIBERA_MSN url_regex -i "/etc/squid/sites/msn.txt" # Libera MSN >>> >>> acl porno url_regex -i "/etc/squid/sites/porno.txt" # Lista Sites >>> acl proibidos url_regex -i "/etc/squid/sites/proibidos.txt" # Lista Sites >>> acl liberados url_regex -i "/etc/squid/sites/liberados.txt" # Lista Sites >>> >>> acl cadastro url_regex -i "/etc/squid/sites/cadastro.txt" # Lista Sites >>> acl contabilidade url_regex -i "/etc/squid/sites/contabilidade.txt" # >>> Lista Sites >>> acl dp url_regex -i "/etc/squid/sites/dp.txt" # Lista Sites >>> acl faturamento url_regex -i "/etc/squid/sites/faturamento.txt" # Lista >>> Sites >>> acl financeiro url_regex -i "/etc/squid/sites/financeiro.txt" # Lista >>> Sites >>> acl negocio url_regex -i "/etc/squid/sites/negocio.txt" # Lista Sites >>> acl industria url_regex -i "/etc/squid/sites/industria.txt" # Lista Sites >>> acl eletrica url_regex -i "/etc/squid/sites/eletrica.txt" # Lista Sites >>> >>> acl manager proto cache_object >>> acl localhost src 127.0.0.1/32 >>> acl to_localhost dst 127.0.0.0/8 >>> >>> ## Inicio - Permições de Rede >>> # Grupos >>> acl rede_bsdb src "/etc/squid/redes/bsdb.txt # IP do servidor BSDB >>> acl rede_bsterm2 src "/etc/squid/redes/bsterm2.txt" # IP do servidor >>> BSTERM2 >>> acl rede_bsbkp src "/etc/squid/redes/bsbkp.txt" # IP do servidor BSBKP >>> >>> acl rede_cadastro src "/etc/squid/redes/cadastro.txt" # IPs setor >>> cadastro >>> acl rede_contabilidade src "/etc/squid/redes/contabilidade.txt" # IPs >>> setor contabilidade >>> acl rede_compras src "/etc/squid/redes/compras.txt" # IPs setor >>> contabilidade >>> acl rede_diretoria src "/etc/squid/redes/diretoria.txt" # IPs setor >>> diretoria >>> acl rede_dp src "/etc/squid/redes/dp.txt" # IPs setor DP >>> acl rede_faturamento src "/etc/squid/redes/faturamento.txt" # IPs setor >>> faturamento >>> acl rede_financeiro src "/etc/squid/redes/financeiro.txt" # IPs setor >>> financeiro >>> acl rede_gestor src "/etc/squid/redes/gestor.txt" # IPs setor gestor >>> acl rede_juridico src "/etc/squid/redes/juridico.txt" # IPs setor >>> juridico >>> acl rede_logistica src "/etc/squid/redes/logistica.txt" # IPs setor >>> logistica >>> acl rede_negocio src "/etc/squid/redes/negocio.txt" # IPs setor negocio >>> acl rede_portaria src "/etc/squid/redes/portaria.txt" # IPs setor >>> portaria >>> acl rede_ti src "/etc/squid/redes/ti.txt" # IPs setor ti >>> # >>> >>> acl rede_interna src 192.168.0.0/24 # Range da Rede Interna >>> >>> acl rede_wireless src 192.168.15.0/24 # Rage da Rede Wireless >>> >>> acl acesso_gestores proxy_auth "/etc/squid/usuarios/gestores.txt" >>> acl acesso_dp proxy_auth "/etc/squid/usuarios/dp.txt" >>> >>> #Bloqueio downloads de arquivos no webmail >>> >>> acl mult urlpath_regex .mp3$ .pps$ .ppt$ .asfv1$ .mpeg$ .mpg$ .pps$ .mov$ >>> .avi$ .asf$ .wmv$ .ra$ .rm$ .ram$ .asx$ .asf$ .afx$ .divx$ .m3u$ .viv$ >>> .vivo$ .vo$ >>> acl mult2 urlpath_regex .pps$ .ppt$ .com$ .exe$ .pif$ .bat$ .asfv1 .wmv$ >>> .mp3$ .avi$ .mpg$ .mpge$ .asf$ >>> >>> acl mimeproibe rep_mime_type "/etc/squid/sites/mimeproibe.txt >>> acl mimeproibe2 req_mime_type "/etc/squid/sites/mimeproibe.txt" # >>> Complemento da anterior >>> >>> acl nofiles urlpath_regex –i >>> \.(mp3|avi|pps|mpg|mpeg|asf|wmv|ra|rm|ram|asx|asf|afx|asfv1|divx|m3u|viv|vivo|vo)$ >>> acl blockexe urlpath_regex -i >>> \.(com|exe|pif|pps|bat|wmv|mp3|avi|mpg|mpge|asf|asfv1)($|\?)" # Bloqueia a >>> execução de aplicativos dmime-type >>> >>> # >>> >>> # Liberação Windows UPDATE >>> acl WindowsUpdate dstdomain -i "/etc/squid/sites/windowsupdate.txt" >>> >>> # Liberação Caixa Economica Federal >>> acl CEF dstdomain -i "/etc/squid/sites/cef.txt" >>> >>> ## Fim - Permições de Rede >>> >>> acl SSL_ports port 443 # https >>> acl SSL_ports port 563 # snews >>> acl SSL_ports port 873 # rsync >>> acl Safe_ports port 80 # http >>> acl Safe_ports port 443 # https >>> acl Safe_ports port 70 # gopher >>> acl Safe_ports port 210 # wais >>> #acl Safe_ports port 1025-65535 # unregistered ports >>> acl Safe_ports port 280 # http-mgmt >>> acl Safe_ports port 488 # gss-http >>> acl Safe_ports port 591 # filemaker >>> acl Safe_ports port 777 # multiling http >>> acl Safe_ports port 631 # cups >>> acl Safe_ports port 873 # rsync >>> acl Safe_ports port 901 # SWAT >>> acl Safe_ports port 21 # ftp >>> acl purge method PURGE >>> acl CONNECT method CONNECT >>> acl apache rep_header Server ^Apache >>> >>> ## >>> ## HTTP ######################### >>> >>> http_port 8080 transparent >>> http_port 3128 >>> >>> no_cache deny WindowsUpdate >>> http_access allow WindowsUpdate >>> >>> no_cache deny CEF >>> http_access allow CEF >>> >>> http_access allow rede_wireless >>> http_access deny rede_wireless porno >>> >>> http_access allow rede_interna LIBERA_MSN >>> >>> http_access allow rede_diretoria >>> >>> http_access deny porno >>> >>> http_access allow rede_ti >>> >>> http_access allow rede_dp CEF >>> >>> http_access deny rede_interna proibidos >>> >>> http_access allow rede_bsdb liberados >>> http_access deny rede_bsdb !liberados >>> http_access allow rede_bsterm2 liberados >>> http_access deny rede_bsterm2 !liberados >>> http_access allow rede_bsbkp liberados >>> http_access deny rede_bsbkp !liberados >>> >>> #http_access allow rede_cadastro cadastro >>> #http_access allow rede_cadastro liberados >>> #http_access deny rede_cadastro !cadastro >>> http_access allow rede_contabilidade contabilidade >>> http_access allow rede_contabilidade liberados >>> http_access deny rede_contabilidade !contabilidade >>> #http_access allow rede_compras compras >>> http_access allow rede_compras liberados >>> http_access deny rede_compras !liberados >>> http_access allow rede_faturamento faturamento >>> http_access allow rede_faturamento liberados >>> http_access deny rede_faturamento !faturamento >>> http_access allow rede_financeiro financeiro >>> http_access allow rede_financeiro liberados >>> http_access deny rede_financeiro !financeiro >>> http_access allow rede_juridico !proibidos >>> http_access allow rede_logistica !proibidos >>> http_access allow rede_negocio negocio >>> http_access allow rede_negocio liberados >>> http_access deny rede_negocio !negocio >>> http_access allow rede_portaria liberados >>> http_access deny rede_portaria !liberados >>> >>> http_access allow rede_gestor >>> >>> http_access allow acesso_gestores >>> >>> http_access allow acesso_dp dp >>> >>> http_access deny mult >>> http_access deny mult2 >>> http_reply_access deny mimeproibe >>> http_reply_access deny mimeproibe2 >>> http_access deny blockexe >>> http_access deny nofiles >>> >>> http_access allow rede_interna ldapauth liberados >>> >>> http_access allow manager localhost >>> http_access deny manager >>> http_access allow purge localhost >>> http_access deny purge >>> http_access deny !Safe_ports >>> http_access deny CONNECT !SSL_ports >>> http_access allow localhost >>> http_access deny all >>> >>> ## >>> ## PROXY REVERSO ################## >>> ## >>> #httpd_accel_host virtual >>> #httpd_accel_host 192.168.15.1 >>> #httpd_accel_port 3128 >>> ##httpd_accel_single_host on >>> #httpd_accel_with_proxy on >>> ##httpd_accel_uses_host_header off >>> #httpd_accel_uses_host_header on >>> >>> ## >>> ## ICP ############################ >>> ## >>> #icp_access allow localnet >>> icp_access allow rede_interna >>> icp_access deny all >>> >>> ## >>> ## REFRESH ######################## >>> ## >>> refresh_pattern ^ftp: 1440 20% 10080 >>> refresh_pattern ^gopher: 1440 0% 1440 >>> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 >>> refresh_pattern . 0 20% 4320 >>> >>> >>> ## >>> ## OUTRAS CONFIGURAÇÔES ############ >>> ## >>> hierarchy_stoplist cgi-bin ? >>> access_log /var/log/squid/access.log squid >>> broken_vary_encoding allow apache >>> extension_methods REPORT MERGE MKACTIVITY CHECKOUT >>> hosts_file /etc/hosts >>> coredump_dir /var/spool/squid >>> >>> >>> E minhas regras de redirecionamento estão assim: >>> # Redirecionando Portas rede 192.168.0.0 >>> $fw -t nat -A PREROUTING -i eth1 -p tcp -m multiport -d ! 200.201.173.68 >>> --dports 80,443 -j REDIRECT --to-ports 3128 >>> $fw -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 3128 -j REDIRECT >>> --to-ports 3128 >>> >>> # Redirecionando Portas rede 192.168.15.0 >>> $fw -t nat -A PREROUTING -i eth2 -p tcp -m multiport -d ! 200.201.173.68 >>> --dports 80,443 -j REDIRECT --to-ports 8080 >>> $fw -t nat -A PREROUTING -i eth2 -p tcp -m tcp --dport 8080 -j REDIRECT >>> --to-ports 8080 >>> >>> >>> Onde a rede 192.168.0.0 é onde estou conectado e tentando acessar o >>> apache, é minha rede interna. >>> >>> A rede 192.168.15.0 é um acesso externo (wirelless) que disponibilizamos >>> para visitantes. >>> >>> Não consigo lembrar qual foi a ultima alteração que fiz que possa ter >>> gerado isto, acredito qua tenha sido depois de acrescentar a oção de proxy >>> transparente. >>> >>> OBS.: Para ficar regisrado minha burrice lembrei que minha maquina não >>> esta configurada para proxy, e por esta razão dá este erro. Isto só me >>> ocorreu enquanto escrevia esta mensagem, pq estou tendo um outro problema >>> com o proxy transparente. >>> Ou seja para acessa internamente, sou obrigado a ter configurado o proxy >>> no browser (é assim mesmo que eu quero). >>> Desculpem. >>> >>> >>> 2009/5/25 bruno micali macagnani <[email protected]> >>> >>>> >>>> >>>> amigo post o conf do squid. >>>> Bruno Macagnani >>>> >>>> >>>> >>>> 2009/5/25 Nilson Chagas <[email protected]> >>>> >>>> >>>>> >>>>> Tenho um server com ip valido. >>>>> >>>>> Se digito o IP externo, recebo a mensagem do apache "ITS WORK!". >>>>> Se informo o ip da rede, tenho a mensagem: >>>>> ERROR The requested URL could not be retrieved >>>>> ------------------------------ >>>>> >>>>> While trying to process the request: >>>>> >>>>> GET / HTTP/1.1 >>>>> Host: 192.168.0.2 >>>>> User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) >>>>> Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 >>>>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> Accept-Language: en-us,en;q=0.5 >>>>> Accept-Encoding: gzip,deflate >>>>> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 >>>>> Keep-Alive: 300 >>>>> Connection: keep-alive >>>>> >>>>> >>>>> The following error was encountered: >>>>> >>>>> - * Invalid Request * >>>>> >>>>> Some aspect of the HTTP Request is invalid. Possible problems: >>>>> >>>>> - Missing or unknown request method >>>>> - Missing URL >>>>> - Missing HTTP Identifier (HTTP/1.0) >>>>> - Request is too large >>>>> - Content-Length missing for POST or PUT requests >>>>> - Illegal character in hostname; underscores are not allowed >>>>> >>>>> Your cache administrator is webmaster. >>>>> ------------------------------ >>>>> Generated Mon, 25 May 2009 14:03:35 GMT by bsinternet.biosoja.matriz >>>>> (squid/2.7.STABLE3) >>>>> >>>>> Por onde eu posso começar a procurar isto??? >>>>> >>>>> -- >>>>> []s >>>>> OBS.: Para ficar regisrado minha burrice lembrei que minha maquina não >>>>> esta configurada para proxy, e por esta razão dá este erro. Isto só me >>>>> ocorreu enquanto escrevia esta mensagem, pq estou tendo um outro problema >>>>> com o proxy transparente. >>>>> Desculpem >>>>> Nilson Chagas - Ubuntu User 25794 >>>>> --- >>>>> Visite: >>>>> http://www.amados.com.br/podcast -> Peça gratuitamente um curso >>>>> Bíblico >>>>> http://tempodesalvacao.blogspot.com/ >>>>> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >>>>> Biblico >>>>> >>>>> >>>>> >>>> >>> >>> >>> -- >>> []s >>> Nilson Chagas - Ubuntu User 25794 >>> --- >>> Visite: >>> http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico >>> http://tempodesalvacao.blogspot.com/ >>> http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso >>> Biblico >>> >>> >>> >> > > > -- > []s > Nilson Chagas - Ubuntu User 25794 > --- > Visite: > http://www.amados.com.br/podcast -> Peça gratuitamente um curso Bíblico > http://tempodesalvacao.blogspot.com/ > http://bbnradio.org/ -> Ouça a rádio e faça gratuitamente um Curso Biblico > > > >
