6سپاس
LinkBack URL
About LinkBacks
قبل از سلام
اگر جای پست ایراد داره . ناظر و مدیر محترم سایت و انجمن من رو ببخشن .
با سلام
امیدوارم که خسته نباشید و همچنین زیر سایه پروردگار خوش و موفق باشید
طبق معمول سوال و مشکلی برای من پیش اومده که مزاحم شدم!!!
من تو محل کارم یک سرور لینوکس دارک که nat -squid-B.W controlling-و ..... رو انجام میده
که فدورا ۵ هست
من میخوام ارتباط کامپیوترهایی که از داخل به خارج هست با محدودیت باشه .
یعنی : کسی بیرون رو حتی نتوینه پینگ کنه .و فقط این پورتها باز باشه
و های dns مخابرات
و این ای پی ها
tcp: 80-443-20-22-21
----------------------------------------------------------------------
من یه کانفیگ رو آماده کردم ولی کار نکرد -اگر میشه راهنمایی کنین
eth0:80.181.57.2/255.255.255.224
eth1:192.168.1.1/255.255.252.0
eth2:80.181.57.65/255.255.255.192
80.181.57.120 -->>mail server : port :3000
80.181.57.72 -->>mail server : port :3000
#!/bin/sh
ip="/usr/sbin/iptables"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
#alias ip
ip address add 80.181.57.2 dev eth0
ip address add 80.181.57.3 dev eth0
ip address add 80.181.57.4 dev eth0
ip address add 80.181.57.5 dev eth0
ip address add 80.181.57.6 dev eth0
ip address add 80.181.57.7 dev eth0
ip address add 80.181.57.8 dev eth0
ip address add 80.181.57.9 dev eth0
ip address add 80.181.57.10 dev eth0
ip address add 80.181.57.11 dev eth0
ip address add 80.181.57.12 dev eth0
ip address add 80.181.57.13 dev eth0
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#echo
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
#New Roules
iptables -N bad_tcp_packets
iptables -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
iptables -N allowed
iptables -A allowed -p tcp --syn -j ACCEPT
iptables -A allowed -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A allowed -p tcp -j DROP
iptables -N icmp_packets
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#POSTROUTING
iptables -A POSTROUTING -t nat -s 192.168.1.2/192.168.1.45 -o eth0 -j SNAT --to-source 80.181.57.2
iptables -A POSTROUTING -t nat -s 192.168.1.46/192.168.1.80 -o eth0 -j SNAT --to-source 80.181.57.3
iptables -A POSTROUTING -t nat -s 192.168.1.81/192.168.1.120 -o eth0 -j SNAT --to-source 80.181.57.4
iptables -A POSTROUTING -t nat -s 192.168.1.121/192.168.1.160 -o eth0 -j SNAT --to-source 80.181.57.5
iptables -A POSTROUTING -t nat -s 192.168.1.161/192.168.1.200 -o eth0 -j SNAT --to-source 80.181.57.6
iptables -A POSTROUTING -t nat -s 192.168.1.201/192.168.1.254 -o eth0 -j SNAT --to-source 80.181.57.7
iptables -A POSTROUTING -t nat -s 192.168.2.2/192.168.2.40 -o eth0 -j SNAT --to-source 80.181.57.8
iptables -A POSTROUTING -t nat -s 192.168.2.41/192.168.2.80 -o eth0 -j SNAT --to-source 80.181.57.9
iptables -A POSTROUTING -t nat -s 192.168.2.81/192.168.2.120 -o eth0 -j SNAT --to-source 80.181.57.10
iptables -A POSTROUTING -t nat -s 192.168.2.121/192.168.2.160 -o eth0 -j SNAT --to-source 80.181.57.11
iptables -A POSTROUTING -t nat -s 192.168.2.161/192.168.2.200 -o eth0 -j SNAT --to-source 80.181.57.12
iptables -A POSTROUTING -t nat -s 192.168.2.201/192.168.2.254 -o eth0 -j SNAT --to-source 80.181.57.13
#PREROUTING
iptables -A PREROUTING -t nat -p tcp -s 192.168.1.0/24 --dport 80 -j REDIRECT --to-port 3128
iptables -A PREROUTING -t nat -p tcp -s 192.168.2.0/24 --dport 80 -j REDIRECT --to-port 3128
iptables -A PREROUTING -t nat -p tcp -s 192.168.1.0/24 --dport 80 -j REDIRECT --to-port 8080
iptables -A PREROUTING -t nat -p tcp -s 192.168.2.0/24 --dport 80 -j REDIRECT --to-port 8080
#LOOPBACK
iptables -A INPUT -p all -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p all -i lo -s 192.168.1.1 -j ACCEPT
iptables -A INPUT -p all -i lo -s 192.168.2.1 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.2 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.3 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.4 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.5 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.6 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.7 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.8 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.9 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.10 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.11 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.12 -j ACCEPT
iptables -A INPUT -p all -i lo -s 80.181.57.13 -j ACCEPT
##Anti Trace
iptables -A INPUT -p icmp -i eth0 --icmp-type time-exceeded -j ACCEPT
# deny Ping And show the chunks .. Anti Ping-Of-Death
iptables -A INPUT -i eth0 -d 80.181.57.2/25 -p icmp -f -j DROP
#Anti Spoofing
iptables -A INPUT -i eth1 ! -s 192.168.1.0/24 -j LOG
iptables -A INPUT -i eth1 ! -s 192.168.2.0/24 -j LOG
iptables -A INPUT -i eth1 ! -s 192.168.1.0/24 -j DROP
iptables -A INPUT -i eth1 ! -s 192.168.2.0/24 -j DROP
# Anti Spoofing out Of Your Lan Addree
iptables -A INPUT ! -i eth1 -s 192.168.1.0/24 -j DROP
iptables -A INPUT ! -i eth1 -s 192.168.2.0/24 -j DROP
#Anti Spoof oh lo
iptables -A INPUT ! -i lo -s 127.0.0.1/255.0.0.0 -j DROP
#Anti Spoof oh lo
iptables -A INPUT -i lo -j ACCEPT
#INPUT
iptables -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
iptables -A INPUT -i eth0 -d 224.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -p udp -d 80.181.57.255 --dport 135:139 -j DROP
iptables -A INPUT -i eth1 -p ICMP -j icmp_packets
iptables -A INPUT -i eth0 -p tcp --dport 22 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.127.104 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.127.104 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.127.105 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.127.105 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.127.106 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.127.106 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.155.104 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.155.104 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.155.105 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.155.105 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 217.218.155.106 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 217.218.155.106 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 195.146.32.65 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 195.146.32.65 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 120-21-22-80-44392.9.9.3 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 192.9.9.3 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p tcp -s 4.2.2.4 --dport 53 -j allowed
iptables -A INPUT -i eth0 -p udp -s 4.2.2.4 --dport 53 -j allowed
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 20 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 20 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 21 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 21 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 25 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 25 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -p udp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -p udp -s 192.168.2.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 143 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 143 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 289 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 289 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 366 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 366 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 465 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 465 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 993 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 993 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 995 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 995 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 3128 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 3128 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 8080 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -s 192.168.2.0/24 --dport 8080 -j ACCEPT
#OUTPUT
iptables -A OUTPUT -m limit --limit 5/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
iptables -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
#Anti Spoofing
iptables -A FORWARD -i eth1 ! -s 192.168.1.0/24 -j DROP
iptables -A FORWARD -i eth1 ! -s 192.168.2.0/24 -j DROP
# deny Ping And show the chunks .. Anti Ping-Of-Death
iptables -A FORWARD -i eth0 -d 80.181.57.2/255.255.255.224 -p icmp -f -j DROP
#Tatabog dar har secend
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# Anti Spoofing out Of Your Lan Addree
iptables -A FORWARD ! -i eth1 -s 192.168.1.0/24 -j DROP
iptables -A FORWARD ! -i eth1 -s 192.168.1.0/24 -j DROP
#Anti Spoof oh lo
iptables -A FORWARD ! -i lo -s 127.0.0.1/255.0.0.0 -j DROP
#FORWARD
iptables -A FORWARD -m limit --limit 5/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
iptables -A FORWARD -p tcp -j bad_tcp_packets
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 20 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 20 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 21 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 21 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 22 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 25 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 25 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p udp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p udp -s 192.168.2.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 143 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 143 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 289 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 289 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 366 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 366 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 443 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 443 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 465 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 465 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 993 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 993 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 995 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 995 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 3128 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 3128 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.1.0/24 --dport 8080 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 192.168.2.0/24 --dport 8080 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp -s 80.181.57.0/26 -j ACCEPT
iptables -A FORWARD -i eth1 -o lo -p tcp -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -i eth1 -o lo -p tcp -s 192.168.2.0/24 -j ACCEPT
iptables -A FORWARD -i eth1 -o lo -p tcp -s 80.181.57.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p tcp -d 80.181.57.--dport 3000 -j allowed
iptables -A FORWARD -i eth0 -o eth1 -p tcp -d 80.181.57.120 --dport 3000 -j allowed
iptables -A FORWARD -i eth1 -s 192.168.1.0/24 -p tcp -d 80.181.57.72 --dport 3000 -j allowed
iptables -A FORWARD -i eth1 -s 192.168.1.0/24 -p tcp -d 80.181.57.120 --dport 3000 -j allowed
iptables -A FORWARD -i eth1 -s 192.168.2.0/24 -p tcp -d 80.181.57.72 --dport 3000 -j allowed
iptables -A FORWARD -i eth1 -s 192.168.2.0/24 -p tcp -d 80.181.57.120 --dport 3000 -j allowed
#"Allowing established outbound connections back in..."
iptables -t filter -A INPUT -i eth0 -m state --state ESTABLISHED -j ACCEPT
# RELATED on high ports only for security
iptables -t filter -A INPUT -i eth0 -p tcp --dport 1024:65535 -m state --state RELATED -j ACCEPT
iptables -t filter -A INPUT -i eth0 -p udp --dport 1024:65535 -m state --state RELATED -j ACCEPT
#-Packet Mangling-
iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 255
#TOS
iptables -t mangle -A OUTPUT -p tcp --dport 23 -j TOS --set-tos Minimize-Delay
iptables -t mangle -A OUTPUT -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
iptables -t mangle -A OUTPUT -p tcp --dport 20 -j TOS --set-tos Minimize-Cost
iptables -t mangle -A OUTPUT -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
iptables -t mangle -A OUTPUT -p udp --dport 4000:7000 -j TOS --set-tos Minimize-Delay
این چند خط آخر هم یعنی چی ؟ مخصوصا
#-Packet Mangling-
iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 255
-------------------------------------------------------------------------------------------------------------------------------------------
این هم کانفیگ اسکویید:
http_port 3128 8080
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
# Physical Memory Usage
cache_mem 32 MB
#cache dir
cache_dir ufs /var/spool/squid 3000 16 256
# cache logfile
cache_access_log /cache/log/squid/access.log
cache_store_log /cache/log/squid/store.log
cache_log /cache/log/squid/cache.log
cache_swap_log /cache/log/squid/swap.log
# The Of Who Works With Squid
cache_effective_user squid
cache_effective_group squid
# Ftp
ftp_user Info@Squid-Cache.org
refresh_pattern ^ftp: 1440 40% 10080
refresh_pattern ^gopher: 1440 20% 1440
refresh_pattern . 320 40% 43200
# Aborts
quick_abort_min 64 KB
quick_abort_max 512 KB
quick_abort_pct 70%
# More Commands
negative_ttl 5 minutes
connect_timeout 2 minutes
read_timeout 15 minutes
request_timeout 30 seconds
shutdown_lifetime 10 seconds
half_closed_clients off
cache_swap_high 100%
cache_swap_low 80%
shutdown_lifetime 3 seconds
# Nimda ....
acl nimda1 urlpath_regex -i \.elm$
acl nimda2 urlpath_regex -i root.exe
acl nimda3 urlpath_regex -i cmd.exe
acl nimda4 urlpath_regex -i ^http://.*www
acl nimda5 urlpath_regex -i readme.exe
acl nimda6 urlpath_regex -i default.id
acl nimda7 urlpath_regex -i :25
# Authentication
#auth_param basic children 5
#auth_param basic realm Squid proxy-caching web server
#auth_param basic credentialsttl 2 hours
#authenticate_ttl 1 hour
#authenticate_ip_ttl 1 second
#request_header_max_size 7 KB
#client_lifetime 14 hours
# Listen ports
http_port 3128
icp_port 3130
# Cache defaults
cache_mgr WebMaster
visible_hostname Cache_Of_00pE
# More Rotates
logfile_rotate 3
forwarded_for on
emulate_httpd_log on
log_fqdn on
# Cache replacement policy
cache_replacement_policy GDSF
# Access List With Two Land In One
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl scope1 src 192.168.1.0/24
acl scope2 src 192.168.2.0/24
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 20 # Dftp
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 3000 # MAIL
acl CONNECT method CONNECT
#Http Access
http_access allow manager
http_access allow localhost
http_access allow scope1
http_access allow scope2
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all
#More Http Access
http_access deny nimda1
http_access deny nimda2
http_access deny nimda3
http_access deny nimda4
http_access deny nimda5
http_access deny nimda6
http_access deny nimda7
#Icp Access
icp_access allow localhost
icp_access allow scope1
icp_access allow scope2
icp_access deny all
#Avoid caching cgi scripts
acl QUERY urlpath_regex cgi-bin
no_cache deny QUERY
acl magic_words1 url_regex -i 192.168
acl magic_words2 url_regex -i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov
acl day time 08:00-16:30
# Delay Pool
delay_pools 2
#B.W Controlling
delay_class 1 2
delay_parameters 1 256000/256000 15000/256000
delay_access 1 allow magic_words2
delay_access 1 allow scope1
delay_access 1 allow scope2
delay_class 2 2
delay_parameters 2 -1/-1 -1/-1
delay_access 2 allow magic_words1
#snmp stuff
acl snmppublic snmp_community public
snmp_access allow snmppublic localhost
snmp_access deny all
# Cache Peer
#cache_peer <proxy> parent 3128 3130 proxy-only
#cache_peer parent.foo.net parent 3128 3130 proxy-only
#cache_peer sib1.foo.net sibling 3128 3130 proxy-only
#cache_peer sib2.foo.net sibling 3128 3130 proxy-only
#icp_access allow lan
#icp_access deny all
# Microsoft Update Refresh Time
refresh_pattern http://*.windowsupdate.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://office.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://windowsupdate.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://wxpsp2.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://xpsp1.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://w2ksp4.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://download.microsoft.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://download.macromedia.com/ 0 80% 20160 reload-into-ims
refresh_pattern ftp://ftp.nai.com/ 0 80% 20160 reload-into-ims
refresh_pattern http://ftp.software.ibm.com/ 0 80% 20160 reload-into-ims
در انتها از همه ممنون هستم مخصوصا پیمان
موضوعات مشابه:
- مشکل با iptables در هنگام نصب squid
- squid- PF- iptables
- تنظیمات iptables بعد از نصب squid
- مشکل با Iptables و Squid
- Iptables$Squid
!!Alux!!
نوشته اصلی توسط webgard3
