网络过滤 - squid+iptables建立internet网关
squid+iptables建立internet网关
2004-04-23 15:18 pm来自：Linux文档
现载：Www.8s8s.coM
地址：无名
系统环境:
RedHat 7.2
squid (http://squid-cache.org/)
1. 系统设置：
运行：setup
选择server
默认情况下iptables 和 ipchains都已经被选择了。请把ipchains去掉，只让iptables运行
2. 安装squid
建议从RedHat的安装光盘上安装
mount /mnt/cdrom
cd /mnt/cdrom/RedHat/RPMS/
rpm -ivh squid-2.4.2.STABLE2-8.i386.rpm
启动squid：/etc/rc.d/init.d/squid start
***一般情况下默认安装的squid不用更改squid.conf文件就可以工作。
3. 为配合iptables做透明网关更改squid.conf文件
vi /etc/squid/squid.conf
更改以下行：
http_port 3128
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
4. iptables设置：
建议从这个脚本设置iptables规则。见附件。
./iptables
然后执行：
service iptables save
这样系统就会把刚才执行脚本的命令保存在 /etc/sysconfig/iptables里。下次系统就会
自动加载这些规则
如果你用这个脚本在你的系统上无法执行，可能是文件没有执行权限。
chmod a+x iptables使之可执行。（不要把这个文件拷贝到/etc/rc.d/init.d/下执行。）
#!/bin/sh
INET_IP="222.222.222.1" #代理服务器的internet ip地址
INET_IFACE="eth0" #代理服务的网卡设备
LAN_IP="192.168.100.4" #代理服务器的内部地址
LAN_IP_RANGE="192.168.100.0/16" #局域网的ip网段
LAN_BCAST_ADRESS="192.168.100.255" #局域网的广播地址
LAN_IFACE="eth1" 代理服务器内部网卡设备
LO_IFACE="lo"
LO_IP="127.0.0.1"
#
# IPTables Configuration.
#
IPTABLES="/sbin/iptables"
###########################################################################
#
# 2. Module loading.
#
#
# Needed to initially load modules
#
/sbin/depmod -a
#
# 2.1 Required modules
#加载需要的模块
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
#
# 2.2 Non-Required modules
#
#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ipt_MASQUERADE
#/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc
###########################################################################
#
# 3. /proc set up.
#
#
# 3.1 Required proc configuration
#设置ip forward
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# 3.2 Non-Required proc configuration
#
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr
###########################################################################
#
# 4. rules set up.
#
######
# 4.1 Filter table
#
#
# 4.1.1 Set policies
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#
# 4.1.2 Create userspecified chains
#
#
# Create chain for bad tcp packets
#
$IPTABLES -N bad_tcp_packets
#
# Create separate chains for ICMP, TCP and UDP to traverse
#
$IPTABLES -N allowed
$IPTABLES -N icmp_packets
$IPTABLES -N tcp_packets
$IPTABLES -N udpincoming_packets
#
# 4.1.3 Create content in userspecified chains
#
#
# bad_tcp_packets chain
#
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
#
# allowed chain
#
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
#
# ICMP rules
#
# Changed rules totally
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#
# TCP rules
#
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
#
# UDP ports
#
# nondocumented commenting out of these rules
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
#$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j DROP #禁止客户使用OICQ
#
# 4.1.4 INPUT chain
#
#
# Bad TCP packets we don't want.
#
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
#
# Rules for incoming packets from the internet.
#
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets
#
# Rules for special networks not part of the Internet
#
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED
-j ACCEPT
#
# Log weird packets that don't match the above.
#
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level DEBUG --log-prefix "IPT INPUT packet died: "
#
# 4.1.5 FORWARD chain
#
#
# Bad TCP packets we don't want
#
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
#
# Accept the packets we actually want to forward
#
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Log weird packets that don't match the above.
#
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "
#
# 4.1.6 OUTPUT chain
#
#
# Bad TCP packets we don't want.
#
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
#
# Special OUTPUT rules to decide which IP's to allow.
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
#
# Log weird packets that don't match the above.
#
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
######
# 4.2 nat table
#
#
# 4.2.1 Set policies
#
#
# 4.2.2 Create user specified chains
#
#
# 4.2.3 Create content in user specified chains
#
#
# 4.2.4 PREROUTING chain
#
$IPTABLES -t nat -I PREROUTING -m mac --mac-source 00:50:4c:3b:e6:fb -j DROP #禁止网卡的MAC为
#00:50:4c:3b:e6:fb访问internet
#
# 4.2.5 POSTROUTING chain
#
#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
#
$IPTABLES -t nat -A PREROUTING -s 192.168.100.0/24 -d 0/0 -p tcp --dport 80 -j DNAT --to 192.168.100.4:3128
#把客户的http的请求转发到squid的3128端口上（透明代理）
# Enable simple IP Forwarding and Network Address Translation
#
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
#
# 4.2.6 OUTPUT chain
#
######
# 4.3 mangle table
#
#
# 4.3.1 Set policies
#
#
# 4.3.2 Create user specified chains
#
#
# 4.3.3 Create content in user specified chains
#
#
# 4.3.4 PREROUTING chain
#
$IPTABLES -t nat -A PREROUTING -s 0/0 -d 0/0 -p udp --destination-port 8000 -j DROP
#禁止客户访问OICQ服务器
文章选项： 友善列印 将这篇文章放置于备忘录中，待有空时回覆 通知板主
linux
注册会员
Reged: 11/11/02
篇文章: 17
Re: squid+iptables建立internet网关 [re: linux]
11/12/02 03:28 PM ()
编辑文章 编辑 回应这篇文章 回覆
# NETWORK OPTIONS
# -----------------------------------------------------------------------------
#http_port 3128
#icp_port 3130
#htcp_port 4827
#mcast_groups 239.128.16.128
#
#tcp_outgoing_address 0.0.0.0
#udp_incoming_address 0.0.0.0
#udp_outgoing_address 0.0.0.0
#cache_peer hostname type 3128 3130
#icp_query_timeout 0
#maximum_icp_query_timeout 2000
#mcast_icp_query_timeout 2000
#dead_peer_timeout 10 seconds
#hierarchy_stoplist cgi-bin ?
#acl QUERY urlpath_regex cgi-bin ?
#no_cache deny QUERY
cache_mem 16 MB
#cache_swap_low 90
#cache_swap_high 95
#maximum_object_size 4096 KB
#ipcache_size 1024
#ipcache_low 90
#ipcache_high 95
# TAG: fqdncache_size (number of entries)
# Maximum number of FQDN cache entries.
#fqdncache_size 1024
#
cache_dir ufs /var/spool/squid 100 16 256
cache_access_log /var/log/squid/access.log
#cache_log /var/log/squid/cache.log
#
#cache_store_log /var/log/squid/store.log
#
#cache_swap_log
#emulate_httpd_log off
#mime_table /etc/squid/mime.conf
#log_mime_hdrs off
#useragent_log none
#pid_filename /var/run/squid.pid
#debug_options ALL,1
#log_fqdn off
#client_netmask 255.255.255.255
#ftp_user Squid@
#ftp_list_width 32
#ftp_passive on
#cache_dns_program /usr/lib/squid/dnsserver
#dns_children 5
#dns_defnames off
#dns_nameservers none
#unlinkd_program /usr/lib/squid/unlinkd
#pinger_program /usr/lib/squid/pinger
#redirect_program none
#redirect_children 5
#redirect_rewrites_host_header on
#authenticate_children 5
#authenticate_ttl 3600
#authenticate_ip_ttl 0
#wais_relay_host localhost
#wais_relay_port 8000
#request_header_max_size 10 KB
#
#request_body_max_size 1 MB
#reply_body_max_size 0
#Default:
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
#replacement_policy LFUDA
#
#reference_age 1 year
#quick_abort_min 16 KB
#quick_abort_max 16 KB
#quick_abort_pct 95
#negative_ttl 5 minutes
#positive_dns_ttl 6 hours
#negative_dns_ttl 5 minutes
#range_offset_limit 0 KB
#connect_timeout 120 seconds
#peer_connect_timeout 30 seconds
#siteselect_timeout 4 seconds
#read_timeout 15 minutes
#request_timeout 30 seconds
#client_lifetime 1 day
#half_closed_clients on
#pconn_timeout 120 seconds
#ident_timeout 10 seconds
#shutdown_lifetime 30 seconds
# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#Examples:
#acl myexample dst_as 1241
#acl password proxy_auth REQUIRED
#
#Defaults:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 21 443 563 70 210 1025-65535
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl chat url_regex -i chat sex oicq
http_access deny chat
#禁止访问url里带chat,sex,oicq词的网站
# TAG: http_access
#Default configuration:
#http_access allow manager localhost
#http_access deny manager
#http_access deny !Safe_ports
#http_access deny CONNECT !SSL_ports
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
http_access allow lan
# TAG: icp_access
# Reply to all ICP queries we receive
#
icp_access allow all
miss_access allow all
#proxy_auth_realm Squid proxy-caching web server
#ident_lookup_access deny all
#
cache_mgr [email protected]
cache_effective_user squid
cache_effective_group squid
#visible_hostname www-cache.foo.org
#unique_hostname www-cache1.foo.org
# TAG: hostname_aliases
# A list of other DNS names that your cache has.
#announce_period 1 day
#announce_host tracker.ircache.net
#announce_port 3131
# HTTPD-ACCELERATOR OPTIONS
# -----------------------------------------------------------------------------
httpd_accel_host 192.168.10.251
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
#dns_testnames netscape.com internic.net nlanr.net microsoft.com
#logfile_rotate 0
#append_domain .yourdomain.com
#tcp_recv_bufsize 0 bytes
#err_html_text
#memory_pools on
#forwarded_for on
#log_icp_queries on
#icp_hit_stale off
#minimum_direct_hops 4
#cachemgr_passwd secret shutdown
#cachemgr_passwd lesssssssecret info stats/objects
#cachemgr_passwd disable all
#store_avg_object_size 13 KB
#store_objects_per_bucket 50
#client_db on
#
#netdb_low 900
#netdb_high 1000
#netdb_ping_period 5 minutes
#query_icmp off
#test_reachability off
#buffered_logs off
#reload_into_ims off
#anonymize_headers
#fake_user_agent none
#error_directory /etc/squid/errors
#minimum_retry_timeout 5 seconds
#maximum_single_addr_tries 3
#snmp_port 3401
#Example:
#snmp_access allow snmppublic localhost
#snmp_access deny all
#snmp_incoming_address 0.0.0.0
#snmp_outgoing_address 0.0.0.0
#wccp_router 0.0.0.0
#wccp_version 4
#wccp_incoming_address 0.0.0.0
#wccp_outgoing_address 0.0.0.0
#delay_pools 0
#delay_pools 2 # 2 delay pools
#delay_class 1 2 # pool 1 is a class 2 pool
#delay_class 2 3 # pool 2 is a class 3 pool
#
#
#delay_access 1 allow some_big_clients
#delay_access 1 deny all
#delay_access 2 allow lotsa_little_clients
#delay_access 2 deny all
#delay_parameters 1 -1/-1 8000/8000
#delay_parameters 2 32000/32000 8000/8000 600/64000
#delay_initial_bucket_level 50
#incoming_icp_average 6
#incoming_http_average 4
#min_icp_poll_cnt 8
#min_http_poll_cnt 8
#uri_whitespace strip
#acl buggy_server url_regex ^http://....
#broken_posts allow buggy_server
nderstand what you are doing.
#prefer_direct on
#ignore_unknown_nameservers on
#digest_generation on
#digest_bits_per_entry 5
#digest_rewrite_period 1 hour
#digest_swapout_chunk_size 4096 bytes
#digest_rebuild_chunk_percentage 10
#client_persistent_connections on
#server_persistent_connections on