Re: [squid-users] squid or iptables big problem !

Il 11/03/2010 9.21, Hubert Choma ha scritto:
> Hello
> Please check my configs. I don't know it's a problem with squid config
> (transparent 8080) or iptables. Pages are loading very very slow
> sometimes I receive error DNS timeout and clients can't connect to WWW
> sites. I open ports 53 UDP and TCP on my firewall CENTOS 5.4. My
> Linuxbox is configured as a router. I have redirected 80,21,9999(ssh)
> ports on my hardware router to linux 192.168.1.2
>
> How can I debug squid to check it is a firewall problem ?
>
> In resolv.conf I have write down IP of hardware router and IP's of my
> internet provider DNS so it shouldn't be a problem with DNS ?!
>
> resolv.conf
> nameserver 192.168.1.1
> nameserver 194.204.152.34
> nameserver 194.204.159.1
>
> My net topology
> 192.168.1.1(UTM hardware router)---192.168.1.2 CENOTS router with
> transparent squid--192.168.0.0/24 LAN clients
>
> eth0 WAN -192.168.1.2 (static IP)
> eth1 LAN -192.168.0.1 (static IP)
> Squid 2.6 stable 21
>
> Maybe its iptables config problem ? Please HELP
> Your help will be appreciated !!!
>
> iptables
>
> #!/bin/sh
> modprobe ip_nat
> modprobe ip_conntrack_ftp
> modprobe ip_conntrack
> iptables -F
> iptables -X
> iptables -t nat -F
> iptables -t nat -X
>
> iptables -P INPUT DROP
> iptables -P FORWARD DROP

IME you should start with an all-ACCEPT iptables config, with no
restriction on traffic, and concentrate on the redirect rules.
If you manage to make the whole thing work with that way, then you can
turn to DROP default policies and slectivily enable traffic.
On the other hand, if it doesn't work even with a permissive fw setup
then you know it's likely to be a squid problem.

> iptables -P OUTPUT ACCEPT
>
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>
>
> iptables -A INPUT -i lo -j ACCEPT
> #iptables -A OUTPUT -o lo -j ACCEPT it is necessary ??
>
> iptables -A INPUT -i eth1 -j ACCEPT
> iptables -A FORWARD -i eth1 -j ACCEPT

You are allowing all the traffic originating from the LAN to go to the
internet (I assume the UTM hw fw is the last hop before the 'net).
Nothing wrong with this, but beware that this means you are not blocking
any p2p, non-proxy http requests, IM protocols, etc.
Maybe the blocking is done at the UTM hardware router ?

> iptables -A OUTPUT -o eth1 -j ACCEPT
>
> # RDP
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3389 -j DNAT
> --to-destination 192.168.0.6:3389

RDP directly from the public IP to the internal machine ? Not very
secure IMHO.
I use ssh port forwarding.

> iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 3389 -j ACCEPT

Is this really needed ?

> #DraytekSyslog
> iptables -t nat -I PREROUTING -p udp -i eth0 -d 0/0 --dport 514 -j DNAT
> --to 192.168.0.6
> iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 514 -j ACCEPT
>

See above

>
> # DNS
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j DNAT
> --to-destination 192.168.0.1:53
> iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT
> --to-destination 192.168.0.1:53
> iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 53 -j ACCEPT
> iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 53 -j ACCEPT

Are you running a DNS for public use ?

> iptables -A INPUT -i eth1 -p tcp --dport 53 -j ACCEPT
> iptables -A INPUT -i eth1 -p udp --dport 53 -j ACCEPT

These two rules make sense. But they're superfluous since all traffic -i
eth1 is ACCEPTed in FORWARD chain.

>
> # SERVICES
> iptables -A INPUT -i eth0 -d 192.168.1.2 -p tcp --dport 80 -j ACCEPT
> iptables -A INPUT -i eth0 -d 192.168.1.2 -p tcp --dport 5432 -j ACCEPT
> iptables -A INPUT -i eth0 -d 192.168.1.2 -p tcp --dport 9999 -j ACCEPT
> iptables -A INPUT -i eth0 -d 192.168.1.2 -p tcp --dport 21 -j ACCEPT
>
> #NAT
> iptables -t nat -A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp
> --dport 80 -j DNAT --to-destination 192.168.0.1:8080
> iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j SNAT
> --to-source 192.168.1.2
>
>
> squid.conf
>
> http_port 192.168.0.1:8080 transparent
> dns_nameservers 192.168.1.1 194.204.152.34 194.204.159.1
> acl localnet src 192.168.0.0/24
> acl windowsupdate dstdomain windowsupdate.microsoft.com
> acl windowsupdate dstdomain .update.microsoft.com
> acl windowsupdate dstdomain download.windowsupdate.com
> acl windowsupdate dstdomain redir.metaservices.microsoft.com
> acl windowsupdate dstdomain images.metaservices.microsoft.com
> acl windowsupdate dstdomain c.microsoft.com
> acl windowsupdate dstdomain www.download.windowsupdate.com
> acl windowsupdate dstdomain wustat.windows.com
> acl windowsupdate dstdomain crl.microsoft.com
> acl windowsupdate dstdomain sls.microsoft.com
> acl windowsupdate dstdomain productactivation.one.microsoft.com
> acl windowsupdate dstdomain ntservicepack.microsoft.com
>
> acl CONNECT method CONNECT
> acl wuCONNECT dstdomain www.update.microsoft.com
> acl wuCONNECT dstdomain sls.microsoft.com
>
> http_access allow CONNECT wuCONNECT localnet
> http_access allow windowsupdate localnet
> range_offset_limit -1
> quick_abort_min -1
>
> acl ftp proto FTP
> http_access allow ftp
> cache_vary on
>
> #MY ACL's (only allowed sites in file dozwolone.txt are allowed for
> ograniczone_komputery other sites are prohibited)
> acl all src 0.0.0.0/0.0.0.0
> cache allow all
> acl dozwolone dstdomain -i "/etc/squid/dozwolone.txt"
> acl ograniczone_komputery src 192.168.0.2 192.168.0.3 192.168.0.4
> 192.168.0.9 192.168.0.10
> acl nieograniczone src 192.168.0.5 192.168.0.6 192.168.0.7 192.168.0.8
> acl poczta dstdom_regex .*poczta. .*mail.
>
> http_access allow dozwolone ograniczone_komputery !poczta
> http_access allow nieograniczone
> http_access deny all
>
>
> # DEFAULT ACL
> #acl all src 0.0.0.0/0.0.0.0
> acl manager proto cache_object
> cache_mgr hubert_at_wp.pl
> cachemgr_passwd mypassword
> acl localhost src 127.0.0.1/255.255.255.255
> acl dostep_stats src 192.168.0.0/24
>
> http_access allow manager localhost
> http_access allow manager dostep_stats
> #http_access deny manager
> http_access allow all
>
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
>
>
> #http_access allow all
> ##http_access allow manager localhost
> ##http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localhost
> http_access deny all
> icp_access allow all
>
>
> #hierarchy_stoplist cgi-bin ?
> #acl QUERY urlpath_regex cgi-bin \?
> #cache deny QUERY
> cache_mem 20 MB
> maximum_object_size_in_memory 8 MB
> maximum_object_size 750 MB
>
> #cache on XFS partition
> cache_dir aufs /mnt/sdb/squid 2000 16 256
> access_log /var/log/squid/access.log squid
> error_directory /usr/share/squid/errors/Polish
> refresh_pattern ^ftp: 1440 20% 10080
> #refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
> refresh_pattern . 0 20% 4320
>
> acl apache rep_header Server ^Apache
> broken_vary_encoding allow apache
> coredump_dir /var/spool/squid
>
>

HTH

Marcello
Received on Thu Mar 11 2010 - 13:03:52 MST