构建基于PF+SQUID的内容过滤器

cnllww

经常需要针对内网用户的上网行为进行一定的限制，所以在防火墙电脑（OpenBSD系统）上安装了Squid代理软件，对内网用户的上网行为作一些简单过滤。
OpenBSD5.0，em0连接内网，em1连接外网。
打开数据包转发：

1. $cat /etc/sysctl.conf
   
2. net.inet.ip.forwarding=1        # 1=Permit forwarding (routing) of IPv4 packets
   
3. net.inet.ip.mforwarding=1       # 1=Permit forwarding (routing) of IPv4 multicas

复制代码

软件开关：

1. $ cat /etc/rc.conf.local
   
2. #Enable or Disable System Daemon
   
3. ntpd_flags=             # enabled during install
   
4. ftpproxy_flags=         # enabled by pf.conf 允许FTP-PROXY
   
5. pkg_scripts="squid"     # 开机启动squid

复制代码

PF过滤文件：

1. $cat /etc/pf.conf
   
2. #Macros
   
3.         int_if="em0"
   
4.         open_tcp_services="{ 2200,80 }"          #指定开放服务的端口
   
5.         icmp_types="echoreq"
   
6.         allow_tcp_ports="{ 80,443,701,800,7002,8001,8002,8080,8089,8601,9002 }"          #指定允许内网访问的端口
   
7.         tencent_udp_ports="8000"           #开放QQ服务端口
   
8.         table <badhosts> persist { 172.20.6.40,172.20.6.41 }    #指定黑名单地址
   
9.         table <manager_ip> persist { 172.20.6.1,172.20.6.2,172.20.6.13,172.20.6.15 }      #指定特权地址
   
10. 
    
11. #Options
    
12.         set block-policy drop
    
13.         set optimization aggressive
    
14.         set loginterface none
    
15.         set skip on lo0
    
16.         set limit { states 65535, frags 200, src-nodes 65536, tables 65536, table-entries 1048576 }
    
17. 
    
18. #Firewall Rules
    
19. ####### default
    
20.         block quick from <badhosts>
    
21.         block in all
    
22.         block out all
    
23.         antispoof quick for { lo0 $int_if }
    
24. 
    
25. ###### ftp client
    
26.         anchor "ftp-proxy/*"
    
27.         pass in quick on $int_if inet proto tcp to any port 21 divert-to 127.0.0.1 port 8021
    
28. 
    
29. ######  squid，转发www访问到squid端口
    
30.         pass in quick on $int_if inet proto tcp to any port 80 divert-to 127.0.0.1 port 3128
    
31. 
    
32. ######  nat
    
33.         match out on egress inet proto tcp from !(egress:network) to any port $allow_tcp_ports nat-to (egress)
    
34.         match out on egress inet proto udp from !(egress:network) to any port $tencent_udp_ports nat-to (egress)
    
35.         match out on egress inet from <manager_ip> to any nat-to (egress)
    
36. 
    
37. ####### pass out
    
38.         pass out quick on egress inet from (egress) to any flags S/SA keep state
    
39.         pass out quick on $int_if
    
40. 
    
41. ####### Pass in for EXT_IF _egress
    
42.         pass in on egress inet proto tcp from any to (egress) port $open_tcp_services
    
43. 
    
44. ####### enable icmp
    
45.         pass in quick inet proto icmp all icmp-type $icmp_types
    
46. 
    
47. ####### Pass in for int_if
    
48.         pass in on $int_if

复制代码

SQUID代理过滤：

1. $cat /etc/squid/squid.conf
   
2. 
   
3. http_port 127.0.0.1:3128 transparent #指定透明代理
   
4. 
   
5. acl all src all
   
6. acl manager proto cache_object
   
7. acl localhost src 127.0.0.1/32
   
8. acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
   
9. acl manager_ip src "/etc/squid/ip_manager.txt"  #指定特权地址
   
10. acl badhosts_ip src "/etc/squid/ip_badhosts.txt" #指定黑名单地址
    
11. acl OverConnLimit maxconn 200
    
12. acl work_time time S M T W H F A 7:00-11:00 13:00-17:00 #定义工作时间
    
13. 
    
14. acl filter_flash urlpath_regex -i "/etc/squid/filter_flash.txt" #过滤Flash
    
15. acl filter_files urlpath_regex -i "/etc/squid/filter_files.txt" #过滤下载文件后缀
    
16. acl filter_sites dstdom_regex "/etc/squid/filter_sites.txt"   #过滤特定网址
    
17. acl filter_keys url_regex -i "/etc/squid/filter_keys.txt"  #过滤特定关键词
    
18. acl nocache_sites dstdom_regex "/etc/squid/nocache_sites.txt" #指定不缓存网址
    
19. acl nocache_files urlpath_regex -i "/etc/squid/nocache_files.txt" #指定不缓存文件后缀
    
20. 
    
21. http_access deny badhosts_ip
    
22. http_access deny filter_flash work_time !manager_ip   #阻止非特权地址在工作时间查看FLASH动画
    
23. http_access deny filter_files work_time !manager_ip   #阻止非特权地址在工作时间下载文件
    
24. http_access deny filter_keys work_time !manager_ip
    
25. http_access deny filter_sites work_time !manager_ip
    
26. http_access deny OverConnLimit
    
27. no_cache deny nocache_sites
    
28. no_cache deny nocache_files
    
29. 
    
30. http_access allow localnet

复制代码

阻止FLASH

1. $ cat /etc/squid/filter_flash.txt
   
2. \.swf
   
3. \.flash
   
4. \.flv

复制代码

阻止下载文件

1. $ cat /etc/squid/filter_files.txt
   
2. \.rar
   
3. \.zip
   
4. \.exe
   
5. \.msi
   
6. \.cab

复制代码

阻止特定网址

1. $ cat /etc/squid/filter_sites.txt
   
2. v.ifeng.com
   
3. v.sohu.com

复制代码

##经过以上设置，基本达到过滤要求

站在岸上的鱼

别偷换概念行不！明明就是URL过滤，非要说成内容过滤！

站在岸上的鱼

昨天没回复上去？
你标题能不能不误导人？明明是简单的URL过滤，怎么能写成“内容”过滤呢？明显的偷换概念行为！

wosl2001

写的挺好的啊