squid+认证 能正常运行，但我的IPTABLE 一旦启动，SQUID就出现了怪问题

pressley

我的一台 服务器 安装了 SQUID 并且使用 webmin 认证

auth_param basic children 40
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hour
auth_param basic casesensitive off
auth_param basic program /etc/webmin/squid/squid-auth.pl /etc/webmin/squid/users

启动squid 后，可以正常使用

我启动了 我的 IPTABLE 之后，重启SQUID就会失败，我查看cache.log，日志显示如下

2008/04/30 10:53:33| Starting Squid Cache version 2.5.STABLE14 for i686-redhat-linux-gnu...
2008/04/30 10:53:33| Process ID 3072
2008/04/30 10:53:33| With 1024 file descriptors available
2008/04/30 10:53:33| DNS Socket created at 0.0.0.0, port 32770, FD 5
2008/04/30 10:53:33| Adding nameserver XXX.XXX.XXX.XXX from /etc/resolv.conf
2008/04/30 10:53:33| Adding nameserver XXX.XXX.XXX.XXX from /etc/resolv.conf
2008/04/30 10:53:33| helperOpenServers: Starting 40 'squid-auth.pl' processes

就一直停在那里了，过了很长时间
2008/04/30 11:05:13| WARNING: Cannot run '/usr/lib/squid/ncsa_auth' process.

这是为什么啊？是不是IPTABLE 要针对 SQUID 做什么设置，希望大家帮帮我，THX！

[ 本帖最后由 pressley 于 2008-4-30 18:29 编辑 ]

hew

端口被iptables 封了？

pressley

端口被封！是啊！我也这么觉得！但是SQUID用的3128端口开着的啊！还要开什么别的端口吗？

# Generated by iptables-save v1.2.11 on Thu Jan 24 12:11:08 2008
*nat
REROUTING ACCEPT [655:38556]
OSTROUTING ACCEPT [9:560]
:OUTPUT ACCEPT [9:560]
COMMIT
# Completed on Thu Jan 24 12:11:08 2008
# Generated by iptables-save v1.2.11 on Thu Jan 24 12:11:08 2008
*mangle
REROUTING ACCEPT [2194:568790]
:INPUT ACCEPT [2194:568790]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2252:1242137]
OSTROUTING ACCEPT [2252:1242137]
COMMIT
# Completed on Thu Jan 24 12:11:08 2008
# Generated by iptables-save v1.2.11 on Thu Jan 24 12:11:08 2008
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1024:65535 --sport 80 ! --tcp-flags SYN,ACK,RST SYN -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1024:65535 --sport 21 ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1024:65535 --sport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1024:65535 --sport 1024:65535 ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 21 --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 20 --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 25 --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
-A FORWARD -m state -i eth0 -o eth1 --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eh0 -j ACCEPT
-A FORWARD -p tcp -m tcp -m state ! --tcp-flags SYN,RST,ACK SYN --state NEW -j DROP
-A FORWARD -m limit -f --limit 100/sec --limit-burst 100 -j ACCEPT
-A FORWARD -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 10000 -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 --sport 1024:65535 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 --sport 1024:65535 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 --sport 1024:65535 ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 1024:65535 --sport 1024:65535 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3128 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -p tcp -m tcp --sport 110 -j ACCEPT
COMMIT
# Completed on Thu Jan 24 12:11:08 2008

[ 本帖最后由 pressley 于 2008-5-2 16:20 编辑 ]