尊请好心人看一下我的squid的透明代理,能代不能透

newhope

小弟初学linux,兴头正猛,突然被透明代理给拦住,苦思一周毫无进展,头发都开始掉了,5555.希望有达人能解决.
以下是我的步骤:
安装FC4,安装为服务器模式 选择软件包的时候把gnome squid打勾
安装配置网卡时防火墙时选择不使用,然后进入图形界面配置外网卡的ip,gateway还有dns以及内网ip地址,在终端下setup启用iptables
以下是我的配置:
eth0外网固定ip 1.2.3.4 eth1 192.168.0.1/22
设置squid.conf
(其中其它默认的项目都用#注释掉,没有改动)
http_port 192.168.1.201:3128
cache_mem 64 MB
cache_swap_low 85
cache_swap_high 90
maximum_object_size 8192 KB
maximum_object_size_in_memory 4096 KB
cache_dir ufs /var/squid/cache 20000 16 256
#限制bt下载的种子以及连接数
acl pass src 192.168.0.1-192.168.3.254/22
acl localhost src 127.0.0.1/255.255.255.255
acl btbt urlpath_regex \.torrent$
acl conncount maxconn 3
acl all src 0.0.0.0/0
http_access deny btbt
http_access allow localhost
http_access allow pass
http_access deny all
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_user_host_header on


iptables的firewall脚本:
#!/bin/sh
echo "Enable IP Forwarding...."
echo "1">/proc/sys/net/ipv4/ip_forward
echo "Starting iptables rules..."
/sbin/modprobe iptable_filter
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
#Refresh all chains
/sbin/iptables -F -t nat
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o eth0 -s 192.168.0.0/22 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -s 192.168.0.0/22 -o eth0 -j SNAT --to 1.2.3.4

rc.local的最后一行添加上了/etc/rc.d/firewall
客户端填上当地ISP的DNS,网关是指向ETH1

问题是这样的:
没起用防火墙时,客户端在浏览器里面设置192.168.0.1:3128代理可以上网.只要我把IPTABLES的服务打开,把IE的代理取消就上不到网
只要一关iptables,又可以用代理的方式上网
.....超级郁闷

hew

iptables -P INPUT DROP

都DROP 掉了，你的数据怎么进？

newhope

请问要实现缓存透明代理我的firewall的脚本该怎么样改捏,小弟谢过先,iptables太复杂了.........
如果有哪位大哥大姐的可以贴一个能用的firewall出来的话,小弟万分感激

newhope

路过的兄弟都来给点意见嘛
浏览次数600多次,就只有一位老大给意见的....................

newhope

按照论坛里的方法在终端下setup进入防火墙界面把定制里面的最下面一行加上了53端口我把
iptables -P INPUT DROP
iptables -P FORWARD DROP 改成
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT或者取消也不行
小弟走了很多地方,查了很多文档,还是没找到解决的办法........太郁闷了
如果可以,请哪位大哥大姐高人达人路人甲........可以帮帮小弟,或者发一个firewall的脚本给小弟,先谢谢了.
不行,谢一次不够诚心,我多谢几次...谢谢,谢谢!!

newhope

今天我重新下载了FC5来安装问题依旧，我开启了IPTABLES后加载了防火墙脚本的状态如下
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT all -- 192.168.0.0/22 0.0.0.0/0 to:218.12.101.226

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
3 ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:631
7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:631
8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
10 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

救命呀，怎么搞的呀，难道没人救我吗，5555555
防火墙脚本为:
#!/bin/bash
#!/bin/sh
echo "Enable IP Forwarding...."
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Starting iptables rules..."
/sbin/iptables -F -t nat
iptables -t nat -A PREROUTING -i eht1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -s 192.168.0.0/22 -o eth0 -j SNAT --to 218.12.101.226

newhope

今天我重新下载了FC5来安装问题依旧，我开启了IPTABLES后加载了防火墙脚本的状态如下
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT all -- 192.168.0.0/22 0.0.0.0/0 to:218.12.101.226

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
3 ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:631
7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:631
8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
10 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

救命呀，怎么搞的呀，难道没人救我吗，5555555
防火墙脚本为:
#!/bin/bash
#!/bin/sh
echo "Enable IP Forwarding...."
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Starting iptables rules..."
/sbin/iptables -F -t nat
iptables -t nat -A PREROUTING -i eht1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -s 192.168.0.0/22 -o eth0 -j SNAT --to 218.12.101.226

Henry_Wu

同情+支持

hexing

你是不是就想让内网的机器连到外网？
如果是的话
iptables -t nat -A POSTROUTING -i eth1 -j SNAT --to $inetip
其中eth1是你局域网的ip，$inetip是外网ip

icy_cold

iptables -P INPUT DROP
第一条，怎么是这个呀 粗规则该放到后面啊.

lio1981

写得有点乱，不过很明显问题出在防火墙，你在设置iptables的时候，已经把客户端对服务器80端口的请求转发到了squid监听的端口3128，那么这时你就要通知iptables让这个端口的请求通过
iptables -I INPUT -p tcp --dport 3128 -j ACCEPT