IPTABLES com proxy transparente não funciona

1. IPTABLES com proxy transparente não funciona

Adonist
(usa Debian)

Enviado em 20/07/2011 - 00:07h

E ae pessoal estou com um problema aqui. Configurei um servidor Proxy numa maquina virtual, e na mesma máquina estou tentando configurar o IP tables para fazer um proxy transparente, porém não funciona.
Segue o proxy:

http_port 3128 transparent
visible_hostname servidor
cache_mgr webmaster@localhost

error_directory /usr/share/squid/errors/Portuguese

hierarchy_stoplist cgi-bin ?
cache_mem 32 MB
maximum_object_size_in_memory 64 KB
maximum_object_size 100 MB

cache_dir ufs /var/log/squid/cache 2048 16 256

refresh_pattern ^ftp: 360 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

access_log /var/log/squid/logs/access.log
cache_log /var/log/squid/logs/cache.log

acl localhost src 127.0.0.1/32
acl localnet src 192.168.2.0/24

acl manager proto cache_object

http_access allow manager localhost
http_access deny manager

acl purge method PURGE
http_access allow purge localhost
http_access deny purge

acl Safe_ports port 21 70 80 210 280 443 488 563 591 631 777 873 901 1025-65535
http_access deny !Safe_ports

acl connect method CONNECT

acl SSL_ports port 443
acl SSL_ports port 563
acl SSL_ports port 873

http_access deny connect !SSL_ports

acl domains dstdomain "/etc/squid/domains"
http_access deny domains

acl words url_regex -i "/etc/squid/words"
http_access deny words

acl extensions urlpath_regex -i "/etc/squid/extensions"
http_access deny extensions

http_access allow localnet
http_access allow localhost
http_access deny all

e o iptables que está em rc.firewall :

#!/bin/bash

IPT="iptables"
LAN_IFACE="eth0"
NET_IFACE="eth0"
LAN_RANGE="192.168.2.0/24"

modprobe iptable_filter
modprobe iptable_mangle
modprobe iptable_nat
modprobe iptable_MASQUERADE

$IPT -F
$IPT -t nat -F

$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -A INPUT -i lo -j ACCEPT
$IPT -t filter -P INPUT DROP
$IPT -A INPUT -i $LAN_IFACE -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
$IPT -t nat -A POSTROUTING -o $NET_IFACE -j MASQUERADE

$IPT -A FORWARD -s $LAN_RANGE -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -t nat -A PREROUTING -s 192.168.2.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128

alguem tem alguma dica ?
espero que possam me ajudar
valeu !

0 0

Quote