Исходное сообщение
"SQUID + PF в FreeBSD 7.0 проблемы и их решения" Отправлено konstantine, 08-Фев-09 14:13
Имеем набор: Стоит FreeBSD 7.0 в качестве сетевого экрана был выбран недавно портированный из OpenBSD пакетый фильтр PF. Далее на машине установлен Squid 3.0, сейчас уже обновлённый до "Squid Cache: Version 3.0.STABLE11", раньше сквид использовался явным способом но помере чтения и сёрфа в интернете узнал что есть прозрачное проксирование. Теперь уже 4ый месяц работает прозрачно. Далее, установлен MPD5 Version 5.2 долго бился но в итоге победил проблему чтобы ВПНщики видели локалбную подсеть..... Итак а теперь имеем следущие проблемы в данной систме: Все пользователи из локальной и впн подсетей прзрачно проксируются по http, иногда я что то меняю в конфиге сквида, а порой сквид сам перезагружается предварительно сея в конфигах: cache.log: 2009/02/08 09:51:27| assertion failed: store_client.cc:430: "STORE_DISK_CLIENT == getType()" 2009/02/08 09:51:31| Starting Squid Cache version 3.0.STABLE11 for i386-portbld-freebsd7.1... 2009/02/08 09:51:32| Pinger exiting. и в мною созданном благодаря syslog`у в /var/log/squid.log Feb  8 09:51:28 213-183 squid[4783]: Squid Parent: child process 4785 exited due to signal 6 Feb  8 09:51:31 213-183 squid[4783]: Squid Parent: child process 68993 started и такие перезагрузки бывают абсолютно в разное время как видим по дате и времени Feb  8 09:51:31 утром когда пользователей было не так уж и много... Итак я может и не заметил бы этого если бы сквид мог свободно сам перезапускаться. Он зависает, причём даже если я делаю squid -k reconfigure он всеравно зависает. При рестарте происходит следуее: cache.log: 2009/02/08 15:52:56| Pinger exiting. 2009/02/08 13:45:45| ctx: enter level  0: 'http://update.fr1.drweb.com/444/vr/windows/dwrtoday.txt.patc...' 2009/02/08 13:45:45| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 2009/02/08 13:54:11| ctx: exit level  0 2009/02/08 13:54:11| ctx: enter level  0: 'http://update.fr1.drweb.com/444/vr/windows/dwrtoday.txt.lzma' 2009/02/08 13:54:11| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 2009/02/08 13:54:14| ctx: exit level  0 2009/02/08 13:54:14| ctx: enter level  0: 'http://update.fr1.drweb.com/444/vr/windows/dwrtoday.txt' 2009/02/08 13:54:14| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 2009/02/08 13:54:32| ctx: exit level  0 2009/02/08 13:54:32| ctx: enter level  0: 'http://update.msk.drweb.com/444/vr/windows/dwrtoday.txt.patc...' 2009/02/08 13:54:32| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 2009/02/08 13:56:53| ctx: exit level  0 2009/02/08 13:56:53| ctx: enter level  0: 'http://update.msk.drweb.com/444/vr/windows/dwrtoday.txt.lzma' 2009/02/08 13:56:53| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 2009/02/08 13:56:57| ctx: exit level  0 2009/02/08 13:56:57| ctx: enter level  0: 'http://update.msk.drweb.com/444/vr/windows/dwrtoday.txt' 2009/02/08 13:56:57| http.cc(561) HttpStateData::cacheableReply: unexpected http status code 452 CPU Usage: 776.727 seconds = 751.037 user + 25.689 sys Maximum Resident Size: 64576 KB Page faults with physical i/o: 3 2009/02/08 15:53:24| Starting Squid Cache version 3.0.STABLE11 for i386-portbld-freebsd7.1... 2009/02/08 15:56:17| Starting Squid Cache version 3.0.STABLE11 for i386-portbld-freebsd7.1... 2009/02/08 15:56:18| commBind: Cannot bind socket FD 29 to 213.183.104.220:3128: (48) Address already in use 2009/02/08 15:56:18| commBind: Cannot bind socket FD 29 to 127.0.0.1:3128: (48) Address already in use FATAL: Cannot open HTTP Port Squid Cache (Version 3.0.STABLE11): Terminated abnormally. CPU Usage: 0.132 seconds = 0.079 user + 0.053 sys Maximum Resident Size: 14556 KB Page faults with physical i/o: 0 2009/02/08 15:56:21| Starting Squid Cache version 3.0.STABLE11 for i386-portbld-freebsd7.1... 2009/02/08 15:56:21| commBind: Cannot bind socket FD 29 to 213.183.104.220:3128: (48) Address already in use 2009/02/08 15:56:21| commBind: Cannot bind socket FD 29 to 127.0.0.1:3128: (48) Address already in use FATAL: Cannot open HTTP Port Squid Cache (Version 3.0.STABLE11): Terminated abnormally. CPU Usage: 0.131 seconds = 0.088 user + 0.044 sys Maximum Resident Size: 14556 KB Page faults with physical i/o: 0 2009/02/08 15:56:24| Starting Squid Cache version 3.0.STABLE11 for i386-portbld-freebsd7.1... 2009/02/08 15:56:25| commBind: Cannot bind socket FD 29 to 213.183.104.220:3128: (48) Address already in use 2009/02/08 15:56:25| commBind: Cannot bind socket FD 29 to 127.0.0.1:3128: (48) Address already in use FATAL: Cannot open HTTP Port Squid Cache (Version 3.0.STABLE11): Terminated abnormally. CPU Usage: 0.132 seconds = 0.075 user + 0.056 sys Maximum Resident Size: 14556 KB ... и т д я в это время пытаюсь сделать squid - shutdown не помогает, причём смотрите что выдат команда: ivc_router /# ps -ax | grep squid 72569  ??  Is     0:00.00 squid -D 76911  ??  I      0:00.13 (squid) -D (squid) 77123  ??  Ss     0:00.00 squid - k shutdown 77144  ??  Ss     0:00.00 squid - k shutdown 77184  ??  Ss     0:00.00 squid - k shutdown 77207  ??  Ss     0:00.00 squid - k shutdown 77245  ??  Ss     0:00.00 squid - k shutdown 77304  p0  R+     0:00.00 grep squid 76908  p1  S+     0:00.00 tail -f /usr/local/squid/logs/cache.log Обратите внимание на номера процессов "squid -D" и "(squid) -D (squid)" обычно они разлчаются на 1-2 единицы... Убить сквид помогает только команда "killall squid", Далее сквид не запустить командой "squid -D" он опять же зависает. Запустить удаётся сквид только тогда.... ))) когда PF превращаю в "дырку от бублика" тобишь когда в pf.conf: pass all После этоих "шаманств" я делаю squid -D и обратно применяю "нормальные" не дырявые правила pfctl -f /etc/pf.conf.  И всё работает, но стоит звёздам сгуститься на небе сквид сново перезапуститься и мне опять будут звонить на трубу и гундеть, гундеть и гундеть.... p.s. Выкладываю все конфиги: ivc_router /# ifconfig sis0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500         options=8<VLAN_MTU>         ether 00:01:6c:ad:33:12         inet 213.183.104.220 netmask 0xfffffff8 broadcast 213.183.104.223         media: Ethernet autoselect (100baseTX <full-duplex>)         status: active xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500         options=8<VLAN_MTU>         ether 00:60:97:20:e1:eb         inet 192.168.1.175 netmask 0xffff0000 broadcast 192.168.255.255         inet 192.168.0.175 netmask 0xffff0000 broadcast 192.168.255.255         media: Ethernet autoselect (100baseTX <full-duplex>)         status: active plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500 pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33204 pfsync0: flags=0<> metric 0 mtu 1460         syncpeer: 224.0.0.240 maxupd: 128 lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384         inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6         inet6 ::1 prefixlen 128         inet 127.0.0.1 netmask 0xff000000 ng6: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.29 netmask 0xffffffff ng5: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.13 netmask 0xffffffff ng7: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1456         inet 192.168.0.175 --> 192.168.0.10 netmask 0xffffffff ng3: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.12 netmask 0xffffffff ng9: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.34 netmask 0xffffffff ng8: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.11 netmask 0xffffffff ng10: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.30 netmask 0xffffffff ng1: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.17 netmask 0xffffffff ng2: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1396         inet 192.168.0.175 --> 192.168.0.26 netmask 0xffffffff ng0: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1448         inet 192.168.0.175 --> 192.168.0.16 netmask 0xffffffff ngX - это текущие подключенные по ВПНу пользователи. далее... ivc_router /# cat /etc/pf.conf if_in   ="xl0"          # Vnutrennaia if_out  ="sis0"         # Vnechnaia cetevuxa if_vpn  ="{ ng0, ng1, ng2, ng3, ng4, ng5, ng6, ng7, \             ng8, ng9, ng10, ng11, ng12, ng13, ng14, \             ng15, ng16, ng17, ng18, ng19, ng20, ng21 }"  #Opisivaem VPN Interfases localaddr0 ="192.168.0.175"     # Localnii adress localaddr1 ="192.168.1.175"     # Localnii adress inet_addr  ="213.183.104.220"   # Vneshnii addres our_network = "192.168.1.0/24"  # Nacha Vnutrennaia cetb vpn_network = "192.168.0.0/24"  # Virtual Private Network (Manatom) gamers  = "{ 192.168.1.11, 192.168.1.7,              192.168.1.10, 192.168.1.1 }" table <friendslist> file "/etc/admins" table <tomsk> file "/etc/tomsk_networks" set loginterface $if_out #Karo4e Pefzdataia options 4itaem # http://citforum.univ.kiev.ua/operating_systems/openbsd/ipf/ #pynkt 10 i eshe #http://house.hcn-strela.ru/BSDCert/BSDA-course/apbs01.html#t... set block-policy return # man http://house.hcn-strela.ru/BSDCert/BSDA-course/apcs02.html#p... #pynkt C.2.2 #set optimization conservative set optimization aggressive # Prozrachnaia proxy #Redirectim vse zaprosi po 80 porty c ouenetwork na nashy proxy rdr on $if_in inet proto tcp from { $our_network } to !192.168.0.0/16 port = http -> 127.0.0.1 port 3128 rdr on $if_vpn inet proto tcp from { $vpn_network } to !192.168.0.0/16 port = http -> 127.0.0.1 port 3128 #rdr on $if_in inet proto tcp from { $our_network } to any port = 8080 -> 127.0.0.1 port 3128 #rdr on $if_vpn inet proto tcp from { $vpn_network } to any port = 8080 -> 127.0.0.1 port 3128 #DLA toko 4tobi mozno bilo videtb iz VPN seti localnetwork nat on $if_in from $vpn_network to $our_network -> 192.168.1.175 #u na oborot nat on $if_in from $our_network to $vpn_network -> 192.168.1.175 #NAT na Vneshnii INTERNET nat on $if_out from $if_in:network to any -> $if_out #pass quick all keep state block in all pass out all block out on lo all #ping $$ traceroute (razreshitb vxodashie na BCE !!!) pass in proto icmp all keep state #DNS dostyp c nashei ceti pass in proto udp from { $vpn_network $our_network } to any port 53 #Dla SSh i FTP #Dla uzania VPNa iz BHESHNEGO INTERNETA                               VPN  VPN_WEB_MORDA pass in log on $if_out proto tcp from { <tomsk> } to $if_out port { 1723 5006 3122 20 21 49152:65534 } #Dla rushnogo uzania PROXY iz VNESHNEGO INETA pass in log on $if_out proto tcp from { <friendslist> } to $if_out port 3128 #Otkrivaem Protokoll GRE pass proto gre all keep state #Otkrivaem ports dla nashix GAMEROV i zakrivaem im TOMSK pass in proto { tcp udp } from { $vpn_network } to !<tomsk> port \ { 20,21,22,443,488,591,777,6667:6669,7770:7775,2106,2009,5190,6060,7777 \   ,3390,3392,3400,2346,3688,1174,2802,5000,5121,6000,6121,6900,3128,3122 \   ,6007 \   ,8085,8086,3724 \   ,3574,3576,3577,17453 } keep state pass in proto { tcp udp } from { 192.168.0.2 192.168.0.33 } to <tomsk> #2106,7777,17453 - Lineage #8085,8086,3724  - WOW pass in from $vpn_network to $our_network pass in from $our_network to $vpn_network #dla uzania WEB interfeisa MPD i PROXY 9vnim sposobom iz local network pass in on $if_in proto { tcp } from $gamers to any port { 3128 5006 } #Verhnee pravilo mozno bilo ne pisatb no 9 pisy 4tobi bilo pass in from $gamers to any #V Manualax posovetovali tak cdelatb block out on $if_out from { 192.168.0.0/16 127.0.0.0/8 } to any - это конфиг который закрывает все дыры, это текущие правила которые работают постоянно. А вот эти правила я и спользую для перезарядки Сквида: ivc_router /# cat /etc/pf_open.conf if_in   ="xl0"          # Vnutrennaia if_out  ="sis0"         # Vnechnaia cetevuxa if_vpn  ="{ ng0, ng1, ng2, ng3, ng4, ng5, ng6, ng7, \             ng8, ng9, ng10, ng11, ng12, ng13, ng14, \             ng15, ng16, ng17, ng18, ng19, ng20, ng21 }"  #Opisivaem VPN Interfases localaddr0 ="192.168.0.175"     # Localnii adress localaddr1 ="192.168.1.175"     # Localnii adress inet_addr  ="213.183.104.220"   # Vneshnii addres our_network = "192.168.1.0/24"  # Nacha Vnutrennaia cetb vpn_network = "192.168.0.0/24"  # Virtual Private Network (Manatom) gamers  = "{ 192.168.1.11, 192.168.1.101, 192.168.1.7, 192.168.1.15 }" table <friendslist> file "/etc/admins" table <tomsk> file "/etc/tomsk_networks" set loginterface $if_out #Karo4e Pefzdataia options 4itaem # http://citforum.univ.kiev.ua/operating_systems/openbsd/ipf/ #pynkt 10 i eshe #http://house.hcn-strela.ru/BSDCert/BSDA-course/apbs01.html#t... set block-policy return # man http://house.hcn-strela.ru/BSDCert/BSDA-course/apcs02.html#p... #pynkt C.2.2 set optimization conservative #Mytim nat koneshno na vneshnem interfeice nat on $if_out from $if_in:network to any -> $if_out #dla VPNov nat on $if_in from $vpn_network to $our_network -> 192.168.1.175 nat on $if_in from $our_network to $vpn_network -> 192.168.1.175 #block in all pass all Причём я решил проблему когда вырубают на долго свет и компы все выключаются и в дальнейшем дабы при запуске фри не зависал сквид в ivc_router /# cat /etc/rc.conf # -- sysinstall generated deltas -- # Tue Oct 28 18:02:00 2008 # Created: Tue Oct 28 18:02:00 2008 # Enable network daemons for user convenience. # Please make all changes to this file, not to /etc/defaults/rc.conf. # This file now contains just the overrides from /etc/defaults/rc.conf. sshd_enable="YES" inetd_enable="YES" pf_enable="YES" pf_rules="/etc/pf_open.conf" pflog_enable="YES" pflog_logfile="/var/log/pflog" pflog_program="/sbin/pflogd" #frox_enable="YES" ifconfig_sis0="inet 213.183.104.220 netmask 255.255.255.248" #cloned_interfaces="if0 if1" ifconfig_xl0="inet 192.168.1.175 netmask 255.255.0.0" ifconfig_xl0_alias0="inet 192.168.0.175 netmask 255.255.0.0" #ifconfig_if1="inet 192.168.1.175 netmask 255.255.255.0" defaultrouter="213.183.104.217" # DNS server #named_enable="YES" #Vrubaem DHCP servak !!! # net/isc_dhcp30_server #dhcpd_enable="YES" #dhcpd_ifaces="xl0" #dhcpd_conf="/usr/local/etc/dhcpd.conf" #Vrubaem PROXY xerver squid_enable="YES" mpd_enable="YES" mpd_flags="-b" gateway_enable="YES" hostname="www.ojsc-manotom-tomsk.net.tomline.ru" keymap="ru.koi8-r" moused_enable="YES" moused_port="/dev/psm0" moused_type="auto" scrnmap="NO" #Cinxronizacia time pri zagruzke ntpdate_enable="YES" ntpdate_flags="-b ntp.tomsk.ru" и потом на утро или когда у меня появляется возможность я сам в ручную делаю pfctl - f /etc/pf.conf, недавно появилась мысль засунуь это в крон и чтобы выполнялось каждые 10 минут, но по ходу это изврат... и наконец squid.conf: acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 192.168.1.0/24    # RFC1918 possible internal network acl vpn_full src "/usr/local/etc/squid/vpn_full" acl vpn_256 src "/usr/local/etc/squid/vpn_128" acl Admin src "/usr/local/etc/squid/admins" acl SSL_ports port 443        # icq acl SSL_ports port 5190        # icq acl SSL_ports port 6669        # irc acl SSL_ports port 7770        # irc acl Safe_ports port 80        # http acl Safe_ports port 20        # ftp 1 acl Safe_ports port 21        # ftp 2 acl Safe_ports port 443        # https acl Safe_ports port 70        # gopher acl Safe_ports port 210        # wais acl Safe_ports port 1025-65535    # unregistered ports acl Safe_ports port 280        # http-mgmt acl Safe_ports port 488        # gss-http acl Safe_ports port 591        # filemaker acl Safe_ports port 777        # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports acl banlist url_regex -i http://tbe.tom.ru/ http_access deny banlist acl banners url_regex -i "/usr/local/etc/squid/banners" http_access deny banners Admin http_access deny banners vpn_256 http_access deny banners localnet deny_info http://pogodavtomske.ru/informer.php banners Admin deny_info http://pogodavtomske.ru/informer.php banners vpn_256 deny_info http://pogodavtomske.ru/informer.php banners localnet acl tomsk_serfers src 192.168.0.2/32 acl tomsk_serfers src 192.168.0.33/32 http_access allow localnet http_access allow tomsk_serfers acl pogodavtomske url_regex -i http://pogodavtomske.ru/informer.php http_access allow pogodavtomske acl tomsk_networks dst "/etc/tomsk_networks" http_access deny tomsk_networks http_access allow Admin http_access allow vpn_full http_access allow vpn_256 http_access deny all icp_access allow localnet icp_access deny all htcp_access allow localnet htcp_access deny all http_port 213.183.104.220:3128 transparent http_port 127.0.0.1:3128 transparent hierarchy_stoplist cgi-bin ? cache_mem 192 MB maximum_object_size_in_memory 10 KB memory_replacement_policy lru cache_dir ufs /usr/local/squid/cache 10240 16 256 minimum_object_size 0 KB maximum_object_size 10240 KB cache_swap_low 90 cache_swap_high 95 logformat squid %ts.tu %6tr %>a %Ss/Hs %<st %rm %ru %un %Sh/%<A %mt access_log /usr/local/squid/logs/access.log logfile_rotate 10 emulate_httpd_log on log_ip_on_direct off mime_table /usr/local/etc/squid/mime.conf log_mime_hdrs off pid_filename /usr/local/squid/logs/squid.pid debug_options ALL log_fqdn on buffered_logs on ftp_user Squid@squid.ru ftp_passive on ftp_sanitycheck on ftp_telnet_protocol off reload_into_ims on refresh_pattern \.au$           43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.pdf$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.dat$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.djvu$         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.avi$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mov$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.wmv$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mid$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.rm$           43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.wma$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.asf$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.qt$           43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.divx$         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.vob$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.bz2$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.rpm$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.exe$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.gif$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.gz$           43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.ico$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.jpg$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.jpeg$         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mid$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mp3$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mp2$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mpa$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.mpg$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.wav$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.swf$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.flv$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.tar$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.tgz$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.zip$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.rar$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.zoo$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.doc$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.docx$         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.odt$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.xls$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.xlt$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.ods$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.xml$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://ad\.       &n... 100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://ads\.       &... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://adv\.       &... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://click\.       ... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://count\.       ... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://counter\.      &nb... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://engine\.      &nbs... 100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://img\.readme\.ru    &nbs... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern http://userpic\.livejournal\.com   43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.ru/bf-analyze                    43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern \.ru/bf-si                         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern /advs/                             43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern /banners/                          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern /cgi-bin/iframe/                   43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache ignore-no-store ignore-private ignore-auth refresh-ims refresh_pattern ^ftp:                 1440     20%     10080 refresh_pattern ^gopher:             1440     0%     1440 refresh_pattern .                0    80%    14400 cache_mgr admin@squid.ru visible_hostname 213.183.104.220 acl 512 src 192.168.0.1-192.168.0.25 acl 256 src 192.168.0.26-192.168.0.50 delay_pools 1 delay_class 1 2 delay_access 1 allow 256 delay_access 1 deny all delay_parameters 1 512000/512000 128000/256000 icp_port 3130 error_directory /usr/local/etc/squid/errors/templates dns_children 16 coredump_dir /usr/local/squid/cache ВНИМАНИЕ ВОПРОС: Ни кто не сталкивался с такой проблемой сквида и PF, а точнее где и каким образом PF режет доступ сквиду так что он не может не только перезапуститься, но даже не в силах перечитать спокойно логи.