论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2004-02-19 00:02 |只看该作者 |倒序浏览

RED9 IPTABLES防火墙和SQUID代理各自分开，但不能在线升级系统补丁，WEB新发带附件邮件出错！感觉是不能上传附件!
SQUID代理服务器本身直接在防火墙用NAT出去。
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.10.1  -j snat --to x.x.x.x

上面192.168.10.1 是SQUID服务器对外网卡地址，ETH1是防火墙的对内网卡。测试NAT没问题的。

SQUID代理服务器的ETH1网卡做了VLAN配置，对应内网的几个网段。这样主要是可用MAC地址做访问控制。配置如下，请大家帮忙找问题所在，多谢!

http_port 192.168.1.1:3128
http_port 192.168.2.1:3128
http_port 192.168.3.1:3128
http_port 192.168.4.1:3128
http_port 192.168.5.1:3128
icp_port 0

ssl_unclean_shutdown off
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \? asp php shtml php3 cgi
acl cache_prevent url_regex Servlet
acl mmx urlpath_regex -i \.mp3$ \.avi$
no_cache deny QUERY
no_cache deny cache_prevent
no_cache deny mmx
#acl aclname url_regex [-i] ^http:// ... # regex matching on whole URL
hierarchy_stoplist cgi-bin ?

cache_mem 200 MB
cache_swap_low 80
cache_swap_high 100

half_closed_clients off
maximum_object_size 1024 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 8 KB

dns_nameservers x.x.x.x x.x.x.x
dns_timeout 1 minutes
ipcache_size 1024
ipcache_low 90
ipcache_high 95
fqdncache_size 1024

cache_replacement_policy heap GDSF
memory_replacement_policy heap GDSF
redirect_rewrites_host_header off

cache_dir aufs /cache/cache 4096 16 1024
cache_access_log /cache/squidlog/access.log

cache_log /cache/squidlog/cache.log
cache_store_log none
mime_table /usr/local/squid/etc/mime.conf
pid_filename /cache/squidlog/squid.pid
logfile_rotate 100
log_icp_queries off
buffered_logs on
emulate_httpd_log on

cache_effective_user squid
cache_effective_group squid
visible_hostname proxy
cache_mgr administrator@server
error_directory /usr/local/squid/share/errors/Simplify_Chinese
icon_directory /usr/local/squid/share/icons

unlinkd_program /usr/local/squid/libexec/unlinkd
redirect_children 5
redirect_rewrites_host_header off

ftp_list_width 32

ftp_passive on

log_icp_queries off
buffered_logs on

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object

acl proto proto HTTP FTP Gopher SSL WAIS
acl method method GET POST
acl CONNECT method CONNECT
acl localhost src 127.0.0.1
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80       # http
acl Safe_ports port 20       # ftp-data
acl Safe_ports port 21       # ftp

acl Safe_ports port 22       # ssl
acl Safe_ports port 443 563    # https, snews
acl Safe_ports port 70       # gopher
acl Safe_ports port 210       # wais
acl Safe_ports port 280       # http-mgmt
acl Safe_ports port 488       # gss-http
acl Safe_ports port 591       # filemaker
acl Safe_ports port 777       # multiling http
acl Safe_ports port 8080 8081 8180 8181
http_access allow manager localhost
http_access deny manager
http_access deny to_localhost
http_access deny CONNECT !SSL_ports

acl ss time AS
acl work1 time MTWHF 08:00-12:00
acl work2 time MTWHF 14:00-17:00
acl mac arp "/etc/mac"
acl macall arp "/etc/macall"
acl to_ghip dst x.x.x.x
acl outip src x.x.x.x x.x.x.x

http_access allow to_ghip
http_access allow outip

http_access deny !Safe_ports

http_access allow mac
http_access deny macall work1
http_access deny macall work2
http_access allow macall
http_access deny all
http_reply_access allow all

snmp_port 3401
acl aclsnmp snmp_community public
snmp_access allow aclsnmp localhost
snmp_access deny all
snmp_incoming_address 0.0.0.0
snmp_outgoing_address 0.0.0.0

digest_generation on
digest_rebuild_period 1 hour
digest_rewrite_period 1 hour
digest_swapout_chunk_size 4096 bytes
digest_rebuild_chunk_percentage 10

以上配置在防火墙和代理同在一台机器上时没这样的问题。这可是我经过优化得到的比较满意的配置了。请各路朋友帮忙找找问题所在，拜托了！