Dúvida - WPAD [RESOLVIDO]
1. Dúvida - WPAD [RESOLVIDO]
lucascatani
(usa Ubuntu)
Enviado em 25/05/2012 - 22:12h
Estou com o seguinte problema.- Tenho um ip fixo na minha empresa ( 189.11.189.11) que chega no meu firewall.
- Meu firewall tem na interface de rede interna o ip 192.168.0.254 e distribui DHCP do 2 ao 200.
- Para a configuração do proxy eu uso o WPAD, via dhcp e dns (somente para intranet).
- TEnho um servidor WEB. De ip 192.168.0.214:8181.
- Ao acessarem o servidor web de "fora" da rede pelo ip EXTERNO eu fiz um DNAT redirecionando para o servidor web
- Ao acessarem internamente "sem proxy" pelo ip externo, eu fiz um SNAT redirecionando para o servidor web.
- O problema é quando o proxy está ativo. Os navagadores recebem a mensagem ERRO 111 - Connection refused;
Alguma dica do que pode ser feito? Talvez fazer como que ao acessarem de "dentro" da rede o wpad retorne DIRECT, ou no squid fazer essa liberação.
Segue meu squid.conf
http_port 3128
visible_hostname l9web.com.br
cache_mem 8 MB
maximum_object_size 1024 KB
cache_dir ufs /var/cache/squid3 1000 16 256
cache_access_log /var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
emulate_httpd_log on
error_directory /usr/share/squid3/errors/pt-br
#>>>>>>>>>>>>>>>>>> ACL GERAIS
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 #http
acl Safe_ports port 8080 #http
acl Safe_ports port 21 #ftp
acl Safe_ports port 443 563 #https, news
acl Safe_ports port 70 #gopher
acl Safe_ports port 210 #wais
acl Safe_ports port 1025-65535 #Unregistered ports
acl Safe_ports port 280 #http-mgmt
acl Safe_ports port 488 #gss-http
acl Safe_ports port 591 #filemaker
acl Safe_ports port 777 #multiling http
acl CONNECT method CONNECT
# >>>>>>>>>>>>>>>>> MINHAS ACL
acl network src 192.168.0.0/24
acl proibir_sites dstdomain "/etc/squid3/sites"
acl proibir_palavras url_regex -i "/etc/squid3/palavrasproibidas"
acl internetalunos src 192.168.0.8-192.168.0.10
delay_pools 1
delay_class 1 2
delay_parameters 1 70000/70000 7000/7000
delay_access 1 allow internetalunos
# >>>>>>>>>>>>>>>>> DIRETIVAS http_access
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# >>>>>>>>>>>>>>>>> REGRAS DAS MINHAS ACL's
http_access deny proibir_sites
http_access deny proibir_palavras
http_access allow network
http_access deny all
o meu script de firewall tb, pois nunca se sabe onde é o erro.
#!/bin/bash
##########################################################
# CARREGANDO MODULOS
##########################################################
modprobe ip_tables
modprobe iptable_nat
##########################################################
# LIMPANDO AS TABELAS
##########################################################
iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
iptables -X
iptables -Z
iptables -F -t mangle
iptables -X -t mangle
iptables -F -t nat
iptables -X -t nat
##########################################################
# POLITICA PADRAO - DROP
##########################################################
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
##########################################################
# REGRAS CONEXOES
##########################################################
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
##########################################################
# LIBERANDO A INTERNET
##########################################################
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
##########################################################
# LOGANDO PACOTES
##########################################################
iptables -A FORWARD -j LOG --log-prefix "FORWARD - "
iptables -A INPUT -j LOG --log-prefix "INPUT - "
iptables -A OUTPUT -j LOG --log-prefix "OUTPUT - "
##########################################################
# LIBERANDO CADEIA INPUT
##########################################################
# APACHE 80
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# DNS BIND9 53
iptables -A INPUT -p udp -m multiport --dports 53,5353,953 -j ACCEPT
iptables -A INPUT -p tcp --dport 953 -j ACCEPT
# DHCP ISC-DHCP-SERVER 67
iptables -A INPUT -p udp --dport 67 -j ACCEPT
# PROXY SQUID3 3128
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
##########################################################
# LIBERANDO A CADEIA OUTPUT
##########################################################
# APACHE 80
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
# DNS BIND9 53
iptables -A OUTPUT -p udp -m multiport --dports 53,5353,953 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 953 -j ACCEPT
# DHCP ISC-DHCP-SERVER 67
iptables -A OUTPUT -p udp --dport 67 -j ACCEPT
# PROXY SQUID3 3128
iptables -A OUTPUT -p tcp --dport 3128 -j ACCEPT
##########################################################
# LIBERANDO A CADEIA FORWARD
##########################################################
# PROXY SQUID3 3128
iptables -A FORWARD -p tcp --dport 3128 -j ACCEPT
##########################################################
# DROPANDO PACOTES
##########################################################
iptables -A FORWARD -p tcp --dport 80 -j DROP
iptables -A FORWARD -p tcp --dport 443 -j DROP