+ Responder ao Tópico



  1. Boa tarde a todos. Estou com um problemão, que sozinho não consegui resolver.
    Preciso liberar o acesso a sites https. Não sei o porque esta sendo bloqueado.
    É tudo muito simples, navegação completa com apenas alguns sites bloqueados.

    Agradeço desde ja a ajuda de todos.
    Segue abaixo meu firewall, bem como squid.

    #!/bin/sh
    IPTABLES="/sbin/iptables"
    WAN=ppp0
    LAN=eth1
    REDE="192.168.0.0/24"

    #Carregando modulos do iptables
    modprobe iptable_nat
    modprobe iptable_mangle
    modprobe iptable_filter

    #limpando tudo
    $IPTABLES -t filter -F
    $IPTABLES -t nat -F
    $IPTABLES -t mangle -F
    $IPTABLES -t filter -X
    $IPTABLES -t nat -X
    $IPTABLES -t mangle -X

    #politica padrao
    $IPTABLES -t filter -P INPUT DROP
    $IPTABLES -t filter -P OUTPUT ACCEPT
    $IPTABLES -t filter -P FORWARD DROP

    #ativando roteamento de pacote
    echo "1" > /proc/sys/net/ipv4/ip_forward
    $IPTABLES -t nat -A POSTROUTING -o $WAN -j MASQUERADE
    $IPTABLES -t nat -A PREROUTING -i $LAN -p tcp --dport 80 -j REDIRECT --to 3128

    #evita problemas de conexao quando o ip externo for dinamico (programa diald)
    echo "1" > /proc/sys/net/ipv4/ip_dynaddr

    #bloqueio a syn-flood, ip spoofing, port scanner e icmp falsos
    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
    echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
    echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

    #permite que conexoes ja criadas pela LAN retornem sem criar novas regras
    $IPTABLES -t filter -A INPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPTABLES -t filter -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

    #bloqueando synfloods e port scanners
    $IPTABLES -t filter -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
    $IPTABLES -t filter -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
    $IPTABLES -t filter -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP

    #liberando acesso ao servidor
    $IPTABLES -t filter -A INPUT -i lo -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -o lo -j ACCEPT

    #liberando passagem de pacotes entre interfaces
    $IPTABLES -t filter -A FORWARD -i $LAN -o $WAN -j ACCEPT

    #aceitando e protegendo ping
    echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
    $IPTABLES -t filter -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
    $IPTABLES -t filter -A INPUT -p icmp -m state --state INVALID -j DROP
    $IPTABLES -t filter -A OUTPUT -p icmp -m state --state INVALID -j DROP
    $IPTABLES -t filter -A FORWARD -p icmp -m state --state INVALID -j DROP

    #liberandos portas para acesso interno
    $IPTABLES -t filter -A INPUT -i $LAN -p tcp -m multiport --dports 80,3128,10000 -j ACCEPT
    $IPTABLES -t filter -A INPUT -i $LAN -p udp -m multiport --dports 80,3128,10000 -j ACCEPT

    #liberando samba para a rede interna
    $IPTABLES -t filter -A INPUT -i $LAN -s $REDE -p tcp -m multiport --dports 137,138,139,445 -j ACCEPT
    $IPTABLES -t filter -A INPUT -i $LAN -s $REDE -p udp -m multiport --dports 137,138,139,445 -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -o $LAN -s $REDE -p tcp -m multiport --dports 137,138,139,445 -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -o $LAN -s $REDE -p udp -m multiport --dports 137,138,139,445 -j ACCEPT

    #liberando acesso externo ao webmin
    $IPTABLES -t filter -A INPUT -i $WAN -p tcp --dport 10000 -j ACCEPT

    #liberando DNS
    $IPTABLES -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -i $LAN -p udp --dport 53 -j ACCEPT

    #liberando HTTPS
    $IPTABLES -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -i $LAN -p tcp --dport 443 -j ACCEPT

    #liberando SMTP/POP para a LAN
    $IPTABLES -t filter -A FORWARD -i $LAN -p tcp --dport 25 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -i $LAN -p tcp --dport 110 -j ACCEPT

    #liberando entrada/retorno do SSH
    $IPTABLES -t filter -A INPUT -p tcp --dport 1226 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -p tcp --dport 1226 -j ACCEPT

    #liberando TS
    $IPTABLES -t filter -A INPUT -p tcp --dport 3389 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -p tcp --dport 3389 -j ACCEPT
    $IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 3389 -j DNAT --to 192.168.0.2:3389

    #liberando servidor das cameras
    $IPTABLES -t filter -A INPUT -p tcp --dport 2550 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -p tcp --dport 2550 -j ACCEPT
    $IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 2550 -j DNAT --to 192.168.0.3:2550

    #liberando acesso remoto via radmin
    $IPTABLES -t filter -A INPUT -p tcp --dport 60020 -j ACCEPT
    $IPTABLES -t filter -A FORWARD -p tcp --dport 60020 -j ACCEPT
    $IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 60020 -j DNAT --to 192.168.0.20:61145

    #setando alta prioridade para a porta 1433
    $IPTABLES -t mangle -A INPUT -p tcp --dport 1433 -j TOS --set-tos 16
    $IPTABLES -t mangle -A OUTPUT -p tcp --dport 1433 -j TOS --set-tos 16
    $IPTABLES -t mangle -A FORWARD -p tcp --dport 1433 -j TOS --set-tos 16
    $IPTABLES -t mangle -A PREROUTING -p tcp --dport 1433 -j TOS --set-tos 16

    #fim das regras


    SQUID.CONF

    http_port 3128 transparent
    visible_hostname LINUX
    hierarchy_stoplist cgi-bin?
    acl QUERY urlpath_regex cgi-bin \?
    no_cache deny QUERY
    cache_mem 1024 MB
    maximum_object_size_in_memory 100 KB
    maximum_object_size 15360 KB
    minimum_object_size 0 KB
    ipcache_size 1024
    ipcache_low 90
    ipcache_high 95
    cache_replacement_policy lru
    memory_replacement_policy lru
    logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
    access_log /var/log/squid/access.log squid
    cache_swap_low 90
    cache_swap_high 95
    cache_dir ufs /var/spool/squid 3000 16 256
    cache_access_log /var/log/squid/access.log
    cache_log /var/log/squid/cache.log
    cache_swap_log /var/spool/squid/swap.log
    error_directory /usr/share/squid/errors/Portuguese
    coredump_dir /var/spool/squid
    refresh_pattern ^ftp: 1440 20% 10080
    refresh_pattern ^gopher: 1440 0% 1440
    refresh_pattern . 0 20% 4320
    dns_nameservers 200.204.0.10 200.204.0.138

    # >> ACLs <<
    acl all src 0.0.0.0/0.0.0.0
    acl rede src 192.168.0.0/24
    acl manager proto cache_object
    acl localhost src 127.0.0.1/255.255.255.255
    acl to_localhost dst 127.0.0.0/8
    acl SSL_ports port 443 563
    acl Safe_ports port 80
    acl Safe_ports port 21
    acl Safe_ports port 443 563
    acl Safe_ports port 70
    acl Safe_ports port 210
    acl Safe_ports port 1025-65535
    acl Safe_ports port 280
    acl Safe_ports port 488
    acl Safe_ports port 591
    acl Safe_ports port 777
    acl Safe_ports port 407
    acl Safe_ports port 25
    acl Safe_ports port 110
    acl purge method PURGE
    acl CONNECT method CONNECT

    acl SitesBloqueados url_regex -i "/etc/squid/sites.deny"
    acl SemCache url_regex -i "/etc/squid/sites.nocache"

    http_access allow manager localhost
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !Safe_ports
    http_access deny CONNECT !SSL_ports
    http_access allow localhost
    http_access deny to_localhost

    no_cache deny SemCache
    http_access deny SitesBloqueados
    http_access allow rede
    http_access deny all

  2. amigo bom dia, da uma olhada no seu conf do squid vc esta com duas acls para a porta 443 usada para o SSL um esta sendo liberada e outra esta sendo bloqueada, verifica sua conf

    post o resultados ai depois






Tópicos Similares

  1. Problemas com HTTPS no MK
    Por Sloth no fórum Redes
    Respostas: 5
    Último Post: 15-03-2008, 19:47
  2. Problemas com proxy e https
    Por maverick_cba no fórum Servidores de Rede
    Respostas: 8
    Último Post: 16-08-2005, 06:46
  3. Proxy Transparente HTTPS Problema com MSN
    Por tabajara no fórum Servidores de Rede
    Respostas: 14
    Último Post: 25-04-2005, 14:12
  4. problema com https
    Por coradeli no fórum Servidores de Rede
    Respostas: 2
    Último Post: 29-07-2004, 06:53
  5. Problemas com http + Red Hat 9
    Por no fórum Servidores de Rede
    Respostas: 5
    Último Post: 25-02-2004, 18:11

Visite: BR-Linux ·  VivaOLinux ·  Dicas-L