squid+iptables建立internet网关

系统环境:

RedHat 7.2

squid (http://squid-cache.org/)

1. 系统设置：

运行：setup

选择server

默认情况下iptables 和 ipchains都已经被选择了。请把ipchains去掉，只让iptables运行

2. 安装squid

建议从RedHat的安装光盘上安装

mount /mnt/cdrom

cd /mnt/cdrom/RedHat/RPMS/

rpm -ivh squid-2.4.2.STABLE2-8.i386.rpm

启动squid：/etc/rc.d/init.d/squid start

***一般情况下默认安装的squid不用更改squid.conf文件就可以工作。

3. 为配合iptables做透明网关更改squid.conf文件

vi /etc/squid/squid.conf

更改以下行：

http_port 3128

httpd_accel_host virtual

httpd_accel_port 80

httpd_accel_with_proxy on

httpd_accel_uses_host_header on

4. iptables设置：

建议从这个脚本设置iptables规则。见附件。

./iptables

然后执行：

service iptables save

这样系统就会把刚才执行脚本的命令保存在 /etc/sysconfig/iptables里。下次系统就会

自动加载这些规则

如果你用这个脚本在你的系统上无法执行，可能是文件没有执行权限。

chmod a+x iptables使之可执行。（不要把这个文件拷贝到/etc/rc.d/init.d/下执行。）

#!/bin/sh

INET_IP="222.222.222.1" #代理服务器的internet ip地址

INET_IFACE="eth0" #代理服务的网卡设备

LAN_IP="192.168.100.4" #代理服务器的内部地址

LAN_IP_RANGE="192.168.100.0/16" #局域网的ip网段

LAN_BCAST_ADRESS="192.168.100.255" #局域网的广播地址

LAN_IFACE="eth1" 代理服务器内部网卡设备

LO_IFACE="lo"

LO_IP="127.0.0.1"

# IPTables Configuration.

IPTABLES="/sbin/iptables"

###########################################################################

# 2. Module loading.

# Needed to initially load modules

/sbin/depmod -a

# 2.1 Required modules

#加载需要的模块

/sbin/modprobe ip_tables

/sbin/modprobe ip_conntrack

/sbin/modprobe iptable_filter

/sbin/modprobe iptable_mangle

/sbin/modprobe iptable_nat

/sbin/modprobe ipt_LOG

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_state

# 2.2 Non-Required modules

#/sbin/modprobe ipt_owner

#/sbin/modprobe ipt_REJECT

#/sbin/modprobe ipt_MASQUERADE

#/sbin/modprobe ip_conntrack_ftp

#/sbin/modprobe ip_conntrack_irc

###########################################################################

# 3. /proc set up.

# 3.1 Required proc configuration

#设置ip forward

echo "1" > /proc/sys/net/ipv4/ip_forward

# 3.2 Non-Required proc configuration

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp

#echo "1" > /proc/sys/net/ipv4/ip_dynaddr

###########################################################################

# 4. rules set up.

######

# 4.1 Filter table

# 4.1.1 Set policies

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IPTABLES -P FORWARD DROP

# 4.1.2 Create userspecified chains

# Create chain for bad tcp packets

$IPTABLES -N bad_tcp_packets

# Create separate chains for ICMP, TCP and UDP to traverse

$IPTABLES -N allowed

$IPTABLES -N icmp_packets

$IPTABLES -N tcp_packets

$IPTABLES -N udpincoming_packets

# 4.1.3 Create content in userspecified chains

# bad_tcp_packets chain

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG

--log-prefix "New not syn:"

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

# allowed chain

$IPTABLES -A allowed -p TCP --syn -j ACCEPT

$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP -j DROP

# ICMP rules

# Changed rules totally

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# TCP rules

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed

# UDP ports

# nondocumented commenting out of these rules

$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT

#$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT

$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT

$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j DROP #禁止客户使用OICQ

# 4.1.4 INPUT chain

# Bad TCP packets we don't want.

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

# Rules for incoming packets from the internet.

$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets

$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets

# Rules for special networks not part of the Internet

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT

$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED

-j ACCEPT

# Log weird packets that don't match the above.

$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG

--log-level DEBUG --log-prefix "IPT INPUT packet died: "

# 4.1.5 FORWARD chain

# Bad TCP packets we don't want

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

# Accept the packets we actually want to forward

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log weird packets that don't match the above.

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG

--log-level DEBUG --log-prefix "IPT FORWARD packet died: "

# 4.1.6 OUTPUT chain

# Bad TCP packets we don't want.

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

# Special OUTPUT rules to decide which IP's to allow.

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

# Log weird packets that don't match the above.

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG

--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

######

# 4.2 nat table

# 4.2.1 Set policies

# 4.2.2 Create user specified chains

# 4.2.3 Create content in user specified chains

# 4.2.4 PREROUTING chain

$IPTABLES -t nat -I PREROUTING -m mac --mac-source 00:50:4c:3b:e6:fb -j DROP #禁止网卡的MAC为

#00:50:4c:3b:e6:fb访问internet

# 4.2.5 POSTROUTING chain

#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

$IPTABLES -t nat -A PREROUTING -s 192.168.100.0/24 -d 0/0 -p tcp --dport 80 -j DNAT --to 192.168.100.4:3128

#把客户的http的请求转发到squid的3128端口上（透明代理）

# Enable simple IP Forwarding and Network Address Translation

$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

# 4.2.6 OUTPUT chain

######

# 4.3 mangle table

# 4.3.1 Set policies

# 4.3.2 Create user specified chains

# 4.3.3 Create content in user specified chains

# 4.3.4 PREROUTING chain

$IPTABLES -t nat -A PREROUTING -s 0/0 -d 0/0 -p udp --destination-port 8000 -j DROP

#禁止客户访问OICQ服务器

文章选项：友善列印将这篇文章放置于备忘录中，待有空时回覆通知板主

linux

注册会员

Reged: 11/11/02

篇文章: 17

Re: squid+iptables建立internet网关 [re: linux]

11/12/02 03:28 PM ()

编辑文章编辑回应这篇文章回覆

# NETWORK OPTIONS

# -----------------------------------------------------------------------------

#http_port 3128

#icp_port 3130

#htcp_port 4827

#mcast_groups 239.128.16.128

#tcp_outgoing_address 0.0.0.0

#udp_incoming_address 0.0.0.0

#udp_outgoing_address 0.0.0.0

#cache_peer hostname type 3128 3130

#icp_query_timeout 0

#maximum_icp_query_timeout 2000

#mcast_icp_query_timeout 2000

#dead_peer_timeout 10 seconds

#hierarchy_stoplist cgi-bin ?

#acl QUERY urlpath_regex cgi-bin ?

#no_cache deny QUERY

cache_mem 16 MB

#cache_swap_low 90

#cache_swap_high 95

#maximum_object_size 4096 KB

#ipcache_size 1024

#ipcache_low 90

#ipcache_high 95

# TAG: fqdncache_size (number of entries)

# Maximum number of FQDN cache entries.

#fqdncache_size 1024

cache_dir ufs /var/spool/squid 100 16 256

cache_access_log /var/log/squid/access.log

#cache_log /var/log/squid/cache.log

#cache_store_log /var/log/squid/store.log

#cache_swap_log

#emulate_httpd_log off

#mime_table /etc/squid/mime.conf

#log_mime_hdrs off

#useragent_log none

#pid_filename /var/run/squid.pid

#debug_options ALL,1

#log_fqdn off

#client_netmask 255.255.255.255

#ftp_user Squid@

#ftp_list_width 32

#ftp_passive on

#cache_dns_program /usr/lib/squid/dnsserver

#dns_children 5

#dns_defnames off

#dns_nameservers none

#unlinkd_program /usr/lib/squid/unlinkd

#pinger_program /usr/lib/squid/pinger

#redirect_program none

#redirect_children 5

#redirect_rewrites_host_header on

#authenticate_children 5

#authenticate_ttl 3600

#authenticate_ip_ttl 0

#wais_relay_host localhost

#wais_relay_port 8000

#request_header_max_size 10 KB

#request_body_max_size 1 MB

#reply_body_max_size 0

#Default:

refresh_pattern ^ftp: 1440 20% 10080

refresh_pattern ^gopher: 1440 0% 1440

refresh_pattern . 0 20% 4320

#replacement_policy LFUDA

#reference_age 1 year

#quick_abort_min 16 KB

#quick_abort_max 16 KB

#quick_abort_pct 95

#negative_ttl 5 minutes

#positive_dns_ttl 6 hours

#negative_dns_ttl 5 minutes

#range_offset_limit 0 KB

#connect_timeout 120 seconds

#peer_connect_timeout 30 seconds

#siteselect_timeout 4 seconds

#read_timeout 15 minutes

#request_timeout 30 seconds

#client_lifetime 1 day

#half_closed_clients on

#pconn_timeout 120 seconds

#ident_timeout 10 seconds

#shutdown_lifetime 30 seconds

# ACCESS CONTROLS

# -----------------------------------------------------------------------------

#Examples:

#acl myexample dst_as 1241

#acl password proxy_auth REQUIRED

#Defaults:

acl all src 0.0.0.0/0.0.0.0

acl manager proto cache_object

acl localhost src 127.0.0.1/255.255.255.255

acl SSL_ports port 443 563

acl Safe_ports port 80 21 443 563 70 210 1025-65535

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

acl chat url_regex -i chat sex oicq

http_access deny chat

#禁止访问url里带chat,sex,oicq词的网站

# TAG: http_access

#Default configuration:

#http_access allow manager localhost

#http_access deny manager

#http_access deny !Safe_ports

#http_access deny CONNECT !SSL_ports

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

http_access allow lan

# TAG: icp_access

# Reply to all ICP queries we receive

icp_access allow all

miss_access allow all

#proxy_auth_realm Squid proxy-caching web server

#ident_lookup_access deny all

cache_mgr master@cctk.net

cache_effective_user squid

cache_effective_group squid

#visible_hostname www-cache.foo.org

#unique_hostname www-cache1.foo.org

# TAG: hostname_aliases

# A list of other DNS names that your cache has.

#announce_period 1 day

#announce_host tracker.ircache.net

#announce_port 3131

# HTTPD-ACCELERATOR OPTIONS

# -----------------------------------------------------------------------------

httpd_accel_host 192.168.10.251

httpd_accel_port 80

httpd_accel_with_proxy on

httpd_accel_uses_host_header on

#dns_testnames netscape.com internic.net nlanr.net microsoft.com

#logfile_rotate 0

#append_domain .yourdomain.com

#tcp_recv_bufsize 0 bytes

#err_html_text

#memory_pools on

#forwarded_for on

#log_icp_queries on

#icp_hit_stale off

#minimum_direct_hops 4

#cachemgr_passwd secret shutdown

#cachemgr_passwd lesssssssecret info stats/objects

#cachemgr_passwd disable all

#store_avg_object_size 13 KB

#store_objects_per_bucket 50

#client_db on

#netdb_low 900

#netdb_high 1000

#netdb_ping_period 5 minutes

#query_icmp off

#test_reachability off

#buffered_logs off

#reload_into_ims off

#anonymize_headers

#fake_user_agent none

#error_directory /etc/squid/errors

#minimum_retry_timeout 5 seconds

#maximum_single_addr_tries 3

#snmp_port 3401

#Example:

#snmp_access allow snmppublic localhost

#snmp_access deny all

#snmp_incoming_address 0.0.0.0

#snmp_outgoing_address 0.0.0.0

#wccp_router 0.0.0.0

#wccp_version 4

#wccp_incoming_address 0.0.0.0

#wccp_outgoing_address 0.0.0.0

#delay_pools 0

#delay_pools 2 # 2 delay pools

#delay_class 1 2 # pool 1 is a class 2 pool

#delay_class 2 3 # pool 2 is a class 3 pool

#delay_access 1 allow some_big_clients

#delay_access 1 deny all

#delay_access 2 allow lotsa_little_clients

#delay_access 2 deny all

#delay_parameters 1 -1/-1 8000/8000

#delay_parameters 2 32000/32000 8000/8000 600/64000

#delay_initial_bucket_level 50

#incoming_icp_average 6

#incoming_http_average 4

#min_icp_poll_cnt 8

#min_http_poll_cnt 8

#uri_whitespace strip

#acl buggy_server url_regex ^http://....

#broken_posts allow buggy_server

nderstand what you are doing.

#prefer_direct on

#ignore_unknown_nameservers on

#digest_generation on

#digest_bits_per_entry 5

#digest_rewrite_period 1 hour

#digest_swapout_chunk_size 4096 bytes

#digest_rebuild_chunk_percentage 10

#client_persistent_connections on

#server_persistent_connections on