Bloquear msn
1. Bloquear msn
tiagoweber88
(usa Ubuntu)
Enviado em 22/02/2008 - 10:04h
GAlera nao entendooo trabalha aki na firma e quando entrei jah existia o squid porem tercerzado intao me pucei pra fussar e concigui tudo bloquear ips acesso restriot menos bloquear msn queria uma ajuda de vcs ver o q estade eerradopois jah coloque todas linha possiveis e naum concigooo
SQUID.CONF
http_port 3128 transparent
visible_hostname router.nutrilat.no-ip.org
cache_mem 16 MB
maximum_object_size_in_memory 128 KB
maximum_object_size 128 MB
minimum_object_size 130 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 2048 16 256
cache_access_log /var/log/squid/access.log
error_directory /usr/share/squid/errors/Portuguese
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl manager proto cache_object
acl localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl localnet src 192.168.0.0/255.255.255.0
acl acesso_total src "/etc/squid/acesso_total"
acl acesso_restrito src "/etc/squid/acesso_restrito"
acl sites_bloqueados url_regex -i "/etc/squid/sites_bloqueados"
acl sites_liberados url_regex -i "/etc/squid/sites_liberados"
acl download url_regex -i "/etc/squid/download"
acl inicio_expediente time MTWHFS 6:00-7:30
acl expediente_manha time MTWHFS 7:30-12:00
acl expediente_tarde time MTWHF 13:30-17:30
acl almoco time MTWHFS 12:00-13:30
acl final_expediente time MTWHF 17:30-20:00
acl tiago src 192.168.0.10
acl proibido_msn url_regex "/etc/squid/msn"
http_access deny proibido_msn !tiago
http_access allow sites_bloqueados inicio_expediente
http_access allow sites_bloqueados almoco
http_access allow sites_bloqueados final_expediente
http_access allow acesso_total
http_access deny sites_bloqueados
http_access deny download
http_access allow sites_liberados
http_access allow acesso_restrito
http_access allow manager localhost
http_access deny all
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny sites_bloqueados
http_access allow localnet
http_access deny all
#Aqui você irá definir o IP da sua rede interna
acl redelocal src 192.168.0.0/24
http_access allow redelocal
# Bloqueia navegacao. So libera pra faixa definida na "acl redelocal".
http_access deny all
http_access allow localhost
# Proxy Transparente
# httpd_accel_host virtual
# httpd_accel_port 80
# httpd_accel_with_proxy on
# httpd_accel_uses_host_header on
rc.firewall
echo Carregando regras para iptables!!!
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -N LOG_DROP
modprobe ipt_MASQUERADE
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_tables
modprobe iptable_filter
modprobe ipt_limit
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo Regras de INPUT
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A INPUT -i eth0 -p icmp --icmp-type ping -j DROP
iptables -A INPUT -p tcp -i eth0 --dport 3128 -j DROP
echo Regras de OUTPUT
# itables -A OUTPUT -p tcp -o eth1 --dport 22 -j ACCEPT
# iptables -A OUTPUT -p tcp --dport 1863 -j DROP
echo Regras de POSTROUTING
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
echo Regras de PREROUTING
iptables -A PREROUTING -t nat -p tcp -d 0/0 --dport 22 -j DNAT --to 192.168.0.198:22
iptables -A PREROUTING -t nat -p tcp -d 0/0 --dport 21 -j DNAT --to 192.168.0.198:21
echo Regras de FORWARD
iptables -A FORWARD -mstate --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -j ACCEPT
# Syn-flood
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
# Port Scanner
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 22 -d 192.168.0.198 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 21 -d 192.168.0.198 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
echo Regras de NAT
# Squid Transparente
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
eh isso algume me ajudaaa a criar as regras
abraco