Вопрос::Где проблема - в сквиде или в фаэрволе? Куда рыть? >ipfw add 29 divert natd ip from any to any out via WAN_IF
на шлюзе поднят dhcp,dns,ipfw,squid сервера + два интерфейса em0 и fxp0
запросы dns выполняются, dhcp делает свое дело, ipfw благополучно защищает, все остальное не работает, шлюз не пропускает в интернет. Ни одно проавило deny не срабатывает в этот момент. а на squid видны ошибки такого вида TCP_MISS/200 или TCP_MISS/000
ps ax| grep squid
>888 ?? Is 0:00.00 /usr/local/sbin/squid -D
>891 ?? S 0:00.12 (squid) -D (squid)
Все порты такое ощущение, что перекрыты, несмотря на firewall_type="OPEN"
{squid.conf}
http_port 3128
icp_port 0
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 128 MB
maximum_object_size 8092 KB
maximum_object_size_in_memory 512 KB
cache_dir ufs /usr/local/squid/cache 2048 64 256
cache_access_log /usr/local/etc/squid/access.log
cache_log /usr/local/etc/squid/cache.log
cache_store_log /usr/local/etc/squid/store.log
cache_mgr mail@local.ru
visible_hostname ssbind.local
#tcp_outgoing_address 222.222.222.222
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
#redirect_program /usr/local/etc/squid/redirect.pl
#redirect_children 10
pid_filename /spool/squid.pid
#auth_param basic children 5
#auth_param basic realm Squid proxy-caching web server
#auth_param basic credentialsttl 2 hours
#auth_param basic casesensitive off
acl all src 0.0.0.0/0.0.0.0
acl limited_ip src "/usr/local/etc/squid/limited_ip.conf"
acl denied_sites dstdomain "/usr/local/etc/squid/dsites.conf"
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl proxyhost src 192.168.0.55
acl our_net src 192.168.0.0/255.255.255.0
http_access allow manager localhost
#http_access deny manager
#http_access deny !Safe_ports
#http_access deny CONNECT !SSL_ports
#http_access deny denied_sites
#http_access deny limited_ip
http_access allow proxyhost
http_access allow our_net
#http_access deny all
http_access allow all
http_reply_access allow all
icp_access allow all
#transparent proxy
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
coredump_dir /usr/local/squid/cache
{ipfw.conf}
#!/bin/sh
fw="/sbin/ipfw"
lan="em0"
wan="fxp0"
wip="192.168.1.3"
lip="192.168.0.55"
net="192.168.0.0/24"
${fw} -f flush
${fw} add 100 check-state
${fw} add 101 allow ip from any to any via lo0
${fw} add 113 fwd 127.0.0.1,3128 tcp from any to any http via ${wan}
${fw} add 114 divert natd ip from ${net} to any out via ${wan}
${fw} add 115 divert natd ip from any to ${wip} in via ${wan}
${fw} add 65000 allow ip from any to any
{rc.conf}
hostname="ssbind.local"
defaultrouter="192.168.1.1"
ifconfig_fxp0="inet 192.168.1.3 netmask 255.255.255.0"
ifconfig_em0="inet 192.168.0.55 netmask 255.255.255.0"
keymap="ru.koi8-r"
linux_enable="YES"
sshd_enable="YES"
usbd_enable="YES"
sendmail_enable="NO"
named_enable="YES"
named_flags="-u bind"
named_pidfile="/var/run/named/named.pid"
named_chrootdir="/var/named"
named_chroot_autoupdate="YES"
named_symlink_enable="YES"
squid_enable="YES"
dhcpd_enable="YES"
natd_enable="YES"
natd_interface="fxp0"
firewall_enable="YES"
firewall_script="/etc/ipfw.sh"
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(ok) on 01-Окт-07, 11:03 
