SQUID会导致基于UDP的软件失效！

heccj

环境：双网卡，FreeBSD 6.1 PF。
症状：在pf中如果不rdr到squid的3128上，工作一切正常。开启rdr则仍然可以浏览网页，但upd失效！什么原因呀？我rdr时只选了tcp呀？
rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
怎么把UPD给破坏了，squid到底做了些啥黑幕？

大家遇到过这个问题吗？别人是想封udp，我是想开都开不了呀！
跪求高人解答！

HonestQiao

你确定你没有其他的操作会影响？

squid不会对你的upd操作的。
当然squid自己有些功能需要使用udp

platinum

开启rdr则仍然可以浏览网页，但upd失效！

首先，不是 upd，是 udp
你的问题可能是做了透明以后，网页走 squid，所以浏览网页没问题，但是 NAT 没有做，udp 无法出去造成的

heccj

原帖由 platinum 于 2007-1-6 01:12 发表

首先，不是 upd，是 udp
你的问题可能是做了透明以后，网页走 squid，所以浏览网页没问题，但是 NAT 没有做，udp 无法出去造成的

如果是NAT有问题的话，没有打开rdr的时候也不行呀？但事实是不开rdr的话，内网一切服务访问正常。说明问题应该出在squid中，但是我rdr的只是tcp的80端口呀？很怪。
QQ的TCP方式登录没问题，UDP方式无法登录。PPLive在等待下载时死掉，弹出框说P2P接通性出错。另外播放嵌入到网页中文件形式的rm视频也不行。

HonestQiao

这个问问bsd版的pf熟悉的。

肯定不是squid的问题，我现在只能这么说。

你的pf规则和这个rdr可能存在一定的不规范性。

heccj

谢谢，我到pf版问问。

heccj

经过多个其它防火墙测试，的确是Squid的问题，其的几个防火墙(ipf,ipfw也不行)。也许不是UDP问题，但的确导致了upd无法访问，下面是配置：

squid.conf
visible_hostname proxy_243
http_port 127.0.0.1:3128 transparent

cache_mem 512 MB
cache_dir ufs /usr/local/squid/cache 2048 16 256

emulate_httpd_log on
logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
cache_access_log /usr/local/squid/logs/access.log combined
cache_log /usr/local/squid/logs/cache.log
cache_store_log none
logfile_rotate 60

cache_swap_low 90
cache_swap_high 95

maximum_object_size 2048 KB
maximum_object_size_in_memory 1024 KB

acl all src 0.0.0.0/0.0.0.0
acl int_net src 192.168.16.0/24

http_access allow int_net
http_access deny all

===============================ipf.conf============================
#
# +------------------+   +---------------------+   +------------------+
# | Internet Network |---| fxp0  NAT+IPF   em0 |---| Internal Network |
# +------------------+   +---------------------+   +------------------+
#
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Interface: all
# Block all incoming and outgoing packets unless they're allowed later.
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# block all frist
block in all
block out all

# packets with ip-options, short and fragmented packets
block in quick all with short
block in quick all with ipopts
block in quick all with frag
block in quick all with opt lsrr
block in quick all with opt ssrr

# disable nmap scan
block in quick on fxp0 proto tcp from any to any flags FUP
block in quick on fxp0 proto tcp from any to any flags SF/SFRA
block in quick on fxp0 proto tcp from any to any flags /SFRA

# Local network traffic is allowed
pass out quick on lo0
pass in quick on lo0
pass in quick on em0
pass out quick on em0

# The pass rules to enable Services
pass in on fxp0 proto icmp from any to any icmp-type echo
pass in on fxp0 proto tcp from any to any port = 20 flags S keep state
pass in on fxp0 proto tcp from any to any port = 21 flags S keep state
pass in on fxp0 proto tcp from any to any port = 22 flags S keep state
pass in on fxp0 proto tcp from any to any port = 80 flags S keep state
pass in on fxp0 proto tcp from any to any port = 443 flags S keep state
pass in on fxp0 proto tcp from any to any port 55000 >< 55100 flags S keep state

# The general pass rules.
pass out quick on fxp0 proto tcp from any to any flags S/SAFR keep state keep frags
pass out quick on fxp0 proto udp from any to any keep state keep frags
pass out quick on fxp0 proto icmp from any to any keep state keep frags


#==============================ipnat.conf===========================
#
# +------------------+   +---------------------+   +------------------+
# | Internet Network |---| fxp0  NAT+IPF   em0 |---| Internal Network |
# +------------------+   +---------------------+   +------------------+
#
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#map fxp0 192.168.100.0/16 -> x.y.z.u/32 proxy port ftp ftp/tcp
map fxp0 192.168.100.0/16 -> x.y.z.u/32 portmap tcp/udp auto
map fxp0 192.168.100.0/16 -> x.y.z.u/32

rdr em0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3128
#==============================ipnat.conf===========================

testab

编译的时候 加 --enable-pf-transparent   --enable-ipf-transparent 选项了吗？