Всем привет, у меня стоит FreeBSD 6.2, из портов поставил Squid, настроил Squid.conf, rc.firewall, rc.conf ....при выключенном фаерволе в rc.conf и в IE стоит прокси 192.168.1.1 порт 3128 работает все нормально, прокси отрубает те IP и сайты которые запрещены. При включении Фаервола и отключении в IE прокси Squid не работает. Пропускается все и вся. Открываются сайты и работают блокированные IP. В фаерволе стоит перенапровление с 3128 на 80 8080 поры, мне не надо прописывать прокси в IE. нужно чтоб все шло через Фаервол и перенаправлялось в Squid. Самое главное на другом серваке все теже настройки и все работает отлично. Я уж не знаю где и что я пропустил...*************************************Squid.conf******************************************
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl me src 192.168.1.2
acl vip src 192.168.1.3
acl black_list src 192.168.1.20
acl allowed_hostnames src 192.168.1.0/255.255.255.0
acl Fishki dstdomain "/etc/sites.conf"
acl Porno dstdom_regex cmex smeh blya udaf padonak bugaga bugaka romantic prikol stopme xoxma funny reality dagdan dom2 mercenaries combats tube igray 1ove yumor funpix rapidshare kiss ledi lady cekc kolobok qip flash soft lady woman diet fitne play anekdot chat dosug damochka horoscop sex porn porno erotic xxx dating love passion warez prostitutki individualki mp3 game znakomst bride kolobok
acl Media urlpath_regex -i \.mp3$ \.asf$ \.wma$ \.avi$ \.wav$ \.mov$ \.exe$ \.swf$ \.wmv$ \.bat$ \.scr$ \.kit$ \.3gp$
acl flv urlpath_regex -i \.flv$
acl SSL method CONNECT
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#Default:
# http_access deny all
#
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access deny me
http_access allow manager localhost
http_access deny manager
http_access deny Media
http_access allow vip
http_access deny black_list
http_access deny Fishki
http_access deny Porno
http_access deny flv
*****************************************************************************************
*************************************rc.firewall*****************************************
[Ss][Ii][Mm][Pp][Ll][Ee])
############
# This is a prototype setup for a simple firewall. Configure this
# machine as a DNS and NTP server, and point all the machines
# on the inside at this machine for those services.
############
# set these to your outside interface network and netmask and ip
oif="rl0"
onet="192.168.0.0"
omask="255.255.255.0"
oip="192.168.0.2"
# set these to your inside interface network and netmask and ip
iif="sk0"
inet="192.168.1.0"
imask="255.255.255.0"
iip="192.168.1.1"
setup_loopback
# Divert
#$(fwcmd) add deny all from any 80 to any
#${fwcmd} add deny all from any to any 80
${fwcmd} add fwd 127.0.0.1,3128 tcp from any to any 80,8080 in
#${fwcmd} add allow all from any 3128 to any
#${fwcmd} add allow all from any to any 3128
${fwcmd} add divert natd all from any to any via ${oif}
#${fwcmd} add fwd 127.0.0.1,3128 tcp from 192.168.10.0/24 to any 80,8080
${fwcmd} add pass ICMP from any to any
${fwcmd} add deny icmp from any to any frag
${fwcmd} add pass all from any to any via lo0
#VIP
${fwcmd} add pass all from any 1723 to any
${fwcmd} add pass all from any to any 1723
${fwcmd} add allow gre from any to any
#Admin
${fwcmd} add allow tcp from me 22 to any
${fwcmd} add allow tcp from any to me 22 via rl0
#Pipe
#${fwcmd} add pipe 2 ip from any to any
#${fwcmd} add pipe 2 ip from any to 192.168.10.0/24
#${fwcmd} add pipe 2 ip from any to 192.168.30.0/24
#${fwcmd} add pipe 2 ip from 192.168.10.0/24 to any
#${fwcmd} add pipe 2 ip from 192.168.20.0/24 to any
#${fwcmd} add pipe 2 ip from 192.168.30.0/24 to any
#${fwcmd} pipe 1 config bw 512Kbit/s
#${fwcmd} pipe 2 config bw 512Kbit/s
${fwcmd} add pass all from any to any via ${iif}
#${fwcmd} add pass all from any to any via ${iif2}
#smtp
${fwcmd} add pass all from any to any 25
${fwcmd} add pass all from any 25 to any
#pop
${fwcmd} add pass all from any to any 110
${fwcmd} add pass all from any 110 to any
#ftp
${fwcmd} add pass all from any to me 21
${fwcmd} add pass all from me 21 to any
${fwcmd} add pass all from any to ${inet} 20,21
${fwcmd} add pass all from ${inet} 20,21 to any
#ICQ
${fwcmd} add pass tcp from any to any 5190
${fwcmd} add pass tcp from any 5190 to any
#DNS
${fwcmd} add pass udp from any to any 53
${fwcmd} add pass udp from any 53 to any
#HTTP
${fwcmd} add pass all from any to any 80
${fwcmd} add pass all from any 80 to any
${fwcmd} add pass tcp from any to any 8080
${fwcmd} add pass tcp from any 8080 to any
${fwcmd} add pass tcp from any to any 8101
${fwcmd} add pass tcp from any 8101 to any
${fwcmd} add pass tcp from any to any 8181
${fwcmd} add pass tcp from any 8181 to any
${fwcmd} add pass tcp from any to any 443
${fwcmd} add pass tcp from any 443 to any
${fwcmd} add pass all from any 9091 to any
${fwcmd} add pass all from any to any 9091
${fwcmd} add pass udp from any to any 8080
${fwcmd} add pass udp from any 8080 to any
${fwcmd} add pass udp from any to any 8101
${fwcmd} add pass udp from any 8101 to any
${fwcmd} add pass udp from any to any 8181
${fwcmd} add pass udp from any 8181 to any
${fwcmd} add pass udp from any to any 443
${fwcmd} add pass udp from any 443 to any
#CS
${fwcmd} add pass all from any to any 27015
${fwcmd} add pass all from any 27015 to any
case ${natd_enable} in
*****************************************************************************************
**************************************rc.conf********************************************
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
gateway_enable="YES"
hostname="unix"
defaultrouter=192.168.0.1
ifconfig_rl0="inet 192.168.0.2 netmask 255.255.255.0"
ifconfig_sk0="inet 192.168.1.1 netmask 255.255.255.0"
squid_enable="YES"
natd_enable="YES"
natd_interface="rl0"
natd_flags="-f /etc/natd.conf"
firewall_enable="YES"
firewall_type="SIMPLE"
#firewall_type="OPEN"
firewall_script="/etc/rc.firewall"
#squid_enable="YES"
inetd_enable="YES"
ipv6_enable="YES"
keymap="ru.koi8-r"
linux_enable="YES"
mousechar_start="3"
moused_enable="YES"
nfs_client_enable="YES"
nfs_server_enable="YES"
rpcbind_enable="YES"
saver="daemon"
sshd_enable="YES"
usbd_enable="YES"
|
