squid 3.0 透明代理后,开启防火墙后客户端就不能解析域名,关闭防火墙就正常.帮忙看看

Intranet

squid 3.0 透明代理后,开启防火墙后客户端就不能解析域名,关闭防火墙就正常.请帮忙看看

下面是iptables文件.

squid服务器和客户端的DNS都用202.96.134.133

1. 
   
2. # Generated by iptables-save v1.3.5 on Thu Mar 19 12:46:46 2009
   
3. *filter
   
4. :INPUT ACCEPT [0:0]
   
5. :FORWARD ACCEPT [0:0]
   
6. :OUTPUT ACCEPT [2329:939501]
   
7. :RH-Firewall-1-INPUT - [0:0]
   
8. -A INPUT -j RH-Firewall-1-INPUT
   
9. -A FORWARD -j RH-Firewall-1-INPUT
   
10. -A RH-Firewall-1-INPUT -i lo -j ACCEPT
    
11. -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
    
12. -A RH-Firewall-1-INPUT -p esp -j ACCEPT
    
13. -A RH-Firewall-1-INPUT -p ah -j ACCEPT
    
14. -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
    
15. -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
    
16. -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
    
17. -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    
18. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 32667 -j ACCEPT
    
19. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3128 -j ACCEPT
    
20. -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
    
21. -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
    
22. COMMIT
    
23. # Completed on Thu Mar 19 12:46:46 2009
    
24. # Generated by iptables-save v1.3.5 on Thu Mar 19 12:46:46 2009
    
25. *nat
    
26. :PREROUTING ACCEPT [90:7240]
    
27. :POSTROUTING ACCEPT [0:0]
    
28. :OUTPUT ACCEPT [79:4773]
    
29. -A PREROUTING -s 172.16.0.0/255.255.0.0 -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j REDIRECT --to-ports 3128
    
30. -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
    
31. -A PREROUTING -s 172.16.0.0/255.255.0.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
    
32. -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 202.96.134.133
    
33. -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 202.96.134.133
    
34. -A POSTROUTING -s 172.16.0.0/255.255.0.0 -j MASQUERADE
    
35. COMMIT
    
36. # Completed on Thu Mar 19 12:46:46 2009
    

复制代码

Intranet

只留下

-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128


后,..

正常运行...