LINUX.ORG.RU
ФорумAdmin

FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128


0

0

стоит на работе фря (шестёрка) в качестве шлюза. Squid настроен. Необходимо, чтобы пакеты перебрасывались с 80-го и (желательно) 21-го порта на 3128. Попробовал настроить это всё с помощью pf:

ext_if="rl0"
int_if="sis0"

internal_net="192.168.1.0/24"
external_addr="83.221.211.202"
lo0="127.0.0.1"

tcp_services = "{ 5999, 110, 53, 443, 25, 8080, 5190, 1521, 6001 }" #
# "{ ftp-data, cvsup, smtp, domain, http, https, pop3, aol }"
#udp_services = "{ 53, 123 }"
udp_services = "{ domain, ntp }"
priv_nets = "{ 127.0.0.0/8, 192.168.1.0/24 }"
zenit_main = "{ ... }"

scrub in all

nat on $ext_if from $int_if:network to any -> ($ext_if)
#nat on $ext_if from $internal_net to any -> ($ext_if)

#rdr pass on $ext_if proto tcp from any to $ext_if port $oracle_port -> $oracle_server port $oracle_port
#rdr pass on $ext_if proto tcp from any to $ext_if port 2022 -> $oracle_server port ssh

# squid forwarding
rdr pass on $int_if proto tcp from $internal_net to any port { 21, 80, 8080 } -> lo0 port 3128

pass in quick on $int_if inet proto tcp from any to lo0 port 3128 keep state
pass out quick on $ext_if inet proto tcp from any to any port 80 keep state

#DNS
pass out proto tcp to any port domain keep state
pass proto udp to any port domain keep state

#set optimization normal
#set block-policy drop
#set loginterface $ext_if
pass quick on lo0 all
block quick log from any os NMAP
block log all

block in quick on $ext_if from $internal_net to any
block out quick on $ext_if from any to $internal_net
antispoof for $ext_if

# terminal access support
#pass in proto tcp from $terminal_source to any port $terminal_port #flags S/SA keep state
#pass out proto tcp from $internal_net to $terminal_source port $terminal_port #flags S/SA keep state

# ftp support
#pass in proto { tcp, udp } from any to any port { 20, 21 } keep state
#pass out proto { tcp, udp } from any to any port { 20, 21 } keep state

# ssh support
pass in proto tcp from any to any port 22 flags S/SA keep state
pass out proto tcp from any to any port 22 flags S/SA keep state

# allow tcp services
pass in quick proto tcp from any to any port $tcp_services flags S/SA keep state
pass out proto tcp from any to any port $tcp_services flags S/SA keep state

# allow upd services
pass quick inet proto udp to any port $udp_services keep state
pass out proto udp to any port $udp_services keep state

# in/out ping requets support
pass in proto icmp from any to any keep state
pass out proto icmp from any to any keep state

# allow requests to/from web server
pass in log on $int_if proto tcp from $internal_net to $int_if port 80 flags S/SA
pass out log on $int_if proto tcp from any to $internal_net port 80 flags S/SA
pass in on $ext_if proto tcp from any to $ext_if port 80 keep state flags S/SA
pass out on $ext_if proto tcp from $ext_if to any port 80 keep state flags S/SA

pass in log all
pass out log all

===================================================

Вот. При '/etc/rc.d/pf start' через прокси пушает, а напрямую -- нет :( Пишет:

ОШИБКА
Запрошенный URL не может быть доставлен.

и тд

хотя напрямую из консоли пингуется внешняя сеть:

$ ping linux.org.ru
PING linux.org.ru (217.76.32.61) 56(84) bytes of data.
64 bytes from linux.org.ru (217.76.32.61): icmp_seq=1 ttl=51 time=38.8 ms
64 bytes from linux.org.ru (217.76.32.61): icmp_seq=2 ttl=51 time=36.6 ms

# pfctl -sa
No ALTQ support in kernel
ALTQ related functions disabled
TRANSLATION RULES:
nat on rl0 inet from 192.168.1.0/24 to any -> (rl0) round-robin
rdr pass on sis0 inet proto tcp from 192.168.1.0/24 to any port = ftp -> 127.0.0.1 port 3128
rdr pass on sis0 inet proto tcp from 192.168.1.0/24 to any port = http -> 127.0.0.1 port 3128
rdr pass on sis0 inet proto tcp from 192.168.1.0/24 to any port = 8080 -> 127.0.0.1 port 3128

(...)

self tcp 127.0.0.1:3128 <- 85.249.23.38:80 <- 192.168.1.113:1442 TIME_WAIT:TIME_WAIT
self tcp 127.0.0.1:3128 <- 85.249.23.38:80 <- 192.168.1.113:1443 TIME_WAIT:TIME_WAIT
self tcp 192.168.1.1:110 <- 192.168.1.118:1338 FIN_WAIT_2:FIN_WAIT_2
self tcp 83.221.211.202:56628 -> 194.67.45.123:80 FIN_WAIT_2:FIN_WAIT_2
self tcp 83.221.211.202:56642 -> 194.67.45.123:80 FIN_WAIT_2:FIN_WAIT_2
self tcp 83.221.211.202:63851 -> 194.67.45.123:80 SYN_SENT:CLOSED
self tcp 83.221.211.202:51320 -> 194.67.45.123:80 FIN_WAIT_2:FIN_WAIT_2
self tcp 83.221.211.202:52960 -> 64.233.183.103:80 ESTABLISHED:ESTABLISHED
self tcp 83.221.211.202:56610 -> 66.249.93.104:80 ESTABLISHED:ESTABLISHED
self tcp 205.188.1.120:5190 <- 192.168.1.110:1402 ESTABLISHED:ESTABLISHED

Куда копать?

★★★★★

Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128

Настройки проксика:

http_port 3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 64 MB #
error_directory /usr/local/etc/squid/errors/Russian-koi8-r
maximum_object_size 16384 KB
cache_dir ufs /usr/local/etc/squid/cache 5000 16 256
cache_access_log /usr/local/etc/squid/logs/access.log
cache_log /usr/local/etc/squid/logs/cache.log
cache_store_log /usr/local/etc/squid/logs/store.log
pid_filename /var/run/squid.pid
ftp_user vasa@pupkin.ru
quick_abort_pct 60
negative_ttl 1 minutes
positive_dns_ttl 6 hours
negative_dns_ttl 5 minutes
half_closed_clients on
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80
acl Safe_ports port 20
acl Safe_ports port 21
acl Safe_ports port 443 563
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow all
cache_mgr olderon@r-style.donpac.ru
cache_effective_user nobody
cache_effective_group nogroup
forwarded_for on
cachemgr_passwd passwd all
client_db on
redirector_bypass on
redirect_program /usr/local/bin/squidGuard
redirect_children 1

vovans ★★★★★ ()
Ответ на: Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128 от vovans

Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128

рекомендуют пересобрать скуид с опцией "--enable-pf-transparent" или это не поможет?

vovans ★★★★★ ()
Ответ на: Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128 от vovans

Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128

Попробовал в свиде указать:

http_port 3128

теперь через свиду пускает, если указана в настройках, а если не указана:

Ошибка при загрузке http://ya.ru/:
Ошибка соединения с узлом ya.ru.

vovans ★★★★★ ()
Ответ на: Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128 от x86

Re: FreeBSD, NAT, PF, SQUID: 21, 80 ==> 3128

Хорошо бы использовать "User line break" при вводе такого ;) а то теперь трудно разобраться что в какой строчке, а с рабочим сервером эксперементировать опасно ;) Спасибо, буду пробовать!

vovans ★★★★★ ()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.