新年第一天上班SQIUD 陶宝不能买东西求解

bigbigsh

公司用的是IPTABLES+ SQIUD

今天第一天上班 上网都正常，taobao 买东西的时候出问题,我点立刻购买，然出现下个页面是空白的，以前都好的.附两张图大家看的清一点，
谢谢各了 也祝大家新的一年，身体健康 工作顺利.



http_port 3128 transparent
cache_mem 256 MB
dns_nameservers 196.196.0.8
maximum_object_size_in_memory 2 MB
memory_replacement_policy heap LFUDA
cache_replacement_policy heap LFUDA
cache_dir ufs /var/squid/cache 5000 32 512
cache_dir ufs /home/cache 5000 32 512
error_directory /usr/local/squid/share/errors/Simplify_Chinese
acl nocache urlpath_regex cookie.*\.php *\.jsp *\.asp *\.pl *\.cgi
no_cache deny nocache
acl badurls dstdomain -i www.xunlei.com www.gougou.com www.flashget.com www.flashget.net www.soso.com
http_access deny badurls
acl badkeywords url_regex -i xunlei.com gougou.com flashget.com flashget.net soso.com
http_access deny badkeywords
acl audio urlpath_regex -i .torrent$ .avi$ .mp3$ .mp4$  
http_access deny audio
acl badfiles urlpath_regex -i .swf$ .flv$
http_access deny badfiles
acl download urlpath_regex -i \.mp3$ \.ra$ \.avi$ \.rvmb$ \.mpe$ \.swf$ \.flv$
http_access deny download
acl localhost src 196.196.0.0/24
http_access allow localhost
http_access deny all
acl safe port 80 3128
http_access allow safe
cache_effective_user squid
cache_effective_group squid
icp_port 0
cache_mgr worldrestart@yahoo.com.cn
acl OverConnLimit maxconn 16
http_access deny OverConnLimit
acl conncount maxconn 5
visible_hostname 196.196.0.8
icon_directory /usr/local/squid/share/icons
max_open_disk_fds 0
minimum_object_size 1 KB
maximum_object_size 20 MB
cache_swap_low 90
cache_swap_high 95
access_log /usr/local/squid/var/logs/access.log squid
cache_log /usr/local/squid/var/logs/cache.log squid
cache_store_log none
emulate_httpd_log on
cache_dns_program /usr/local/squid/libexec/dnsserver
dns_children 80
dns_nameservers 196.196.0.8
refresh_pattern -i \.htm$ 0 20% 1440
refresh_pattern -i \.html$ 0 20% 1440
refresh_pattern -i . 5 25% 2880
acl buggy_server url_regex ^http://.... http://
broken_posts allow buggy_server
request_entities off
relaxed_header_parser on
client_lifetime 120 minute                                
hostname_aliases 196.196.0.8
error_directory /usr/local/squid/share/errors/Simplify_Chinese
always_direct allow all
ignore_unknown_nameservers on
coredump_dir  /var/log/squid
half_closed_clients off
buffered_logs on

bigbigsh

)大家帮看看

Steiny

tail -f /usr/local/squid/var/logs/access.log

看一下是否有被拒绝的信息。或者换台电脑，更新一下淘宝插件看看？

也用squid，不过没遇到问题。

bigbigsh

淘宝里也不是所有的页面都不能拍，主要是 聚划算里不能拍.
http://ju.taobao.com/?TBG=146280 ... m=1.146280.176778.2

[root@hwt ~]# tail -f /usr/local/squid/var/logs/access.log

1327895006.129  12049 196.196.0.200 TCP_MISS/200 196 GET http://mpp.tmall.com/buildconnection.do? - DIRECT/110.75.127.234 text/plain

1327895012.249   6167 196.196.0.200 TCP_MISS/200 196 GET http://mpp.tmall.com/buildconnection.do? - DIRECT/110.75.127.234 text/plain
1327895014.517     69 196.196.0.200 TCP_MISS/200 1080 GET http://buy.taobao.com/auction/buy.htm? - DIRECT/110.75.2.18 text/javascript
1327895014.604    112 196.196.0.200 TCP_MISS/200 428 GET http://hotclick.app.linezing.com/hotclick.gif? - DIRECT/110.75.2.10 image/gif
1327895014.795    168 196.196.0.200 TCP_MISS/200 2840 POST http://buy.taobao.com/auction/buy_now.jhtml - DIRECT/110.75.2.18 text/html

Steiny

把一台电脑IP单独开出去，放到规则最前面，试试看呢？

bigbigsh

在iptables 里还是在SQUID里 规则什么写

bigbigsh

我把SQUID关了，重新写一个iptables 不通过SQUID就没问题,

#!/bin/sh
echo "1" > /proc/sys/net/ipv4/ip_forward
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X
iptables -t nat -A POSTROUTING -s 196.196.0.8/24 -o ppp0 -j MASQUERADE

bigbigsh

我目前用的是这个规则

#!/bin/sh
echo "1" > /proc/sys/net/ipv4/ip_forward
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 110,25 -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 88 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P FORWARD DROP
iptables -A FORWARD -p udp -s 196.196.0.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -i eth1 -m multiport --dports 110,25 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 22223 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 22221 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 22224 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 16801 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 16811 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4000 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1863 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 569 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8014 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8084 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4443 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8601 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7709 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8001 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8002 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8003 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8004 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8009 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8109 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8209 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6677 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7711 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1080 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 9080 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7708 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7709 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4430 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6001 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8905 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8101 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 3128 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 9999 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 9000 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 9001 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 9002 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 23 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8016 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1119 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1088 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 17991 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1800 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1810 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7001 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8016 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6188 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 5188 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1119 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 88 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 81 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 6666 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7711 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7777 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7773 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 7008 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 16000 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 3724 -j ACCEPT
/sbin/sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=3800 &>/dev/null
iptables -t nat -A PREROUTING -s 196.196.0.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A POSTROUTING -s 196.196.0.8/24 -o ppp0 -j MASQUERADE

bigbigsh

我把缓存都清了还是不行 ，是我SQUID配置那里出问题了。我以前没用taobao没发现。

Steiny

我的意思是在squid里把你的ip直接允许，

acl my_pc 10.10.10.11
http_access allow my_pc

或者，把监控到的，关于淘宝的域名和ip允许通过。