Minha Configuração do Squid em Paralelo ao MK
O que pude notar na versão 2.9.27 quando faz cache paralelo usando o Web-Proxy com cache full mesmo tendo colocado parent-proxy e parent-port vc continua mandando o cache pro proprio MK e o MK continuavam o problema de não suportar as requisições ao Web-Proxy.
Então andei estudando como não usar o Web-Proxy e mandar as requisições direto e consegui dessa forma, esta funcionando sem problemas
MK
Redirecionamento do Proxy
Código :
ip firewall nat add chain=dstnat protocol=tcp dst-port=80 in-interface=redeclientes \ action=redirect to-port=3030
IP
Código :
ip address add address=10.10.10.1/30 interface=linux
NAT SQUID
Código :
ip firewall nat add chain=srcnat src-address=10.10.10.0/30 action=masquerade
Regra do Alexandre Correa
MANGLE
Código :
ip firewall mangle
add chain=output protocol=tcp src-port=8080 content="X-Cache: HIT" action=mark-connection \
new-connection-mark=conn_squid-up passthrough=yes comment="CACHE FULL" disabled=no
add chain=output connection-mark=conn_squid-up action=mark-packet new-packet-mark=pacotes_squid-up \
passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp dst-port=8080 action=mark-connection new-connection-mark=conn_squid-down \
passthrough=yes comment="" disabled=no
add chain=prerouting connection-mark=conn_squid-down action=mark-packet new-packet-mark=pacotes_squid-down \
passthrough=yes comment="" disabled=no
Regra do Alexandre Correa
QUEUE TREE
Código :
/queue tree
add name="\[CACHE-FULL\] - Download" parent=global-in packet-mark=pacotes_squid-down limit-at=0 queue=default \
priority=1 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="\[CACHE-FULL\] - Upload" parent=global-out packet-mark=pacotes_squid-up limit-at=0 queue=default \
priority=1 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s
IP Proxy (não eh no WEB-PROXY)
Código :
enabled: yes
port: 3030
parent-proxy: 10.10.10.2:3128
maximal-client-connecions: 1000
maximal-server-connectons: 1000
Squid3 Instalado no Debian
Configurando a rede
Código :
ifconfig eth0 10.10.10.2 netmask 255.255.255.252 up
Configurando o route
Código :
route del default
route add default gw 192.168.10.1 dev eth0
Instalar o Squid3
Quando o Squid3 instalar ele vai para essa pasta
Squid.conf
Código :
http_port 3128
visible_hostname Squid
cache_mem 80 MB
maximum_object_size_in_memory 80 KB
maximum_object_size 20 MB
minimum_object_size 0 KB
cache_swap_low 80
cache_swap_high 90
cache_dir ufs /var/spool/squid3 40000 16 256
cache_access_log /var/log/squid3/access.log
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl redelocal src 10.10.10.0/24
http_access allow localhost
http_access allow redelocal
http_access deny all
Outra coisa tbm instalei o Sarg, ele emiti os relatórios de acessos
mas, como o Proxy fica em uma rede separada dos cliente e os clientes
acessam o proxy por meio do mk, nos relatorios do Sarg só vai aparecer o ip do MK, caso queria colocar o proxy na mesma rede fica a critério de vocês mas, há outras forma de se emitir relatorio de acessos dos clientes, só fiz isso para fazer um teste, pois vi que seria uma implementação mais rapida, mas não a correta que eh para ter o ip de cada cliente vendo que eles acessam.
Aqui para emitir relatórios de acessos dos clientes.
http://wiki.mikrotik.com/wiki/Proxyl...etting_Started
http://wiki.mikrotik.com/wiki/Proxylizer/Concepts
http://wiki.mikrotik.com/wiki/Proxylizer/Web_Page
amigo acho q vc repetiu as regras
amigo acho q vc repetiu as regras
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Regra do Alexandre Correa
MANGLE
Código:
ip firewall mangle
add chain=output protocol=tcp src-port=8080 content="X-Cache: HIT" action=mark-connection \
new-connection-mark=conn_squid-up passthrough=yes comment="CACHE FULL" disabled=no
add chain=output connection-mark=conn_squid-up action=mark-packet new-packet-mark=pacotes_squid-up \
passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp dst-port=8080 action=mark-connection new-connection-mark=conn_squid-down \
passthrough=yes comment="" disabled=no
add chain=prerouting connection-mark=conn_squid-down action=mark-packet new-packet-mark=pacotes_squid-down \
passthrough=yes comment="" disabled=no
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Regra do Alexandre Correa
QUEUE TREE
Código:
/ ip firewall mangle
add chain=output protocol=tcp src-port=8080 content="X-Cache: HIT" action=mark-connection \
new-connection-mark=conn_squid-up passthrough=yes comment="CACHE FULL" disabled=no
add chain=output connection-mark=conn_squid-up action=mark-packet new-packet-mark=pacotes_squid-up \
passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp dst-port=8080 action=mark-connection new-connection-mark=conn_squid-down \
passthrough=yes comment="" disabled=no
add chain=prerouting connection-mark=conn_squid-down action=mark-packet new-packet-mark=pacotes_squid-down \
passthrough=yes comment="" disabled=no
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
haveria a possibilidade vc vc rever isso
