[Проблема] Нужна помощь в настройке Squid3+squidGuard и iptables

[German Stimban]

Сообщение от Aziz Madetov

Проблема в том, что ни один конфиг не понимает маски CIDR.

Что в логах пишет?

[german@localhost ~]$ sudo cat /etc/squid/squid.conf
http_port 3128
acl our_net src 192.168.3.0/24
acl tasix dst 10.0.0.0/21

http_access allow our_net tasix
http_access deny our_net
http_access deny all
[german@localhost ~]$ sudo service squid restart
Остановка squid: ................          [   ОК  ]
init_cache_dir ... Запуск squid: .        [   ОК  ]
[german@localhost ~]$ rpm -qa | grep squid
squid-3.1-14mdv2010.1
[german@localhost ~]$

[Aziz Madetov]

Сообщение от German Stimban

Что в логах пишет?

В общем, все сделал, как ты описал, выполнил squid3 -k reconfigure и получил вывод:

...
2012/12/29 17:05:56| WARNING: because of this '94.158.48.0/24' is ignored to keep splay tree searching predictable
2012/12/29 17:05:56| WARNING: You should probably remove '94.158.48.0/24' from the ACL named 'tasix'
2012/12/29 17:05:56| WARNING: (B) '94.158.49.0/24' is a subnetwork of (A) '94.158.49.0/24'
2012/12/29 17:05:56| WARNING: because of this '94.158.49.0/24' is ignored to keep splay tree searching predictable
2012/12/29 17:05:56| WARNING: You should probably remove '94.158.49.0/24' from the ACL named 'tasix'
2012/12/29 17:05:56| WARNING: (B) '94.158.49.0/24' is a subnetwork of (A) '94.158.49.0/24'
2012/12/29 17:05:56| WARNING: because of this '94.158.49.0/24' is ignored to keep splay tree searching predictable
...

Кроме того, сквид видимо не понял что ему делать со списком сетей, так как пускает в мир обе группы пользователей.

Пока пустил вторую группу пользователей через фильтр в iptables.

Будем искать... ©

[Aziz Madetov]

Сообщение от Aziz Madetov

Будем искать... ©

Проблема решена.

# cat /etc/squid3/squid.conf:

Скрытый текст:

http_port 192.168.0.1:3128 transparent
icp_port  3130

acl manager      proto     cache_object
acl localhost    src       127.0.0.1/32
acl to_localhost dst       127.0.0.0/8
acl group1       src       192.168.0.5-192.168.0.20
acl group2       src       192.168.0.21-192.168.0.254
acl tasix        dst       "/etc/squid3/tasix"       # Список сайтов Tas-IX
acl expressions  url_regex "/etc/squid3/expressions" # regexp доменов разных мессенджеров

acl SSL_ports  port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http

acl proto_https proto HTTPS

acl CONNECT method CONNECT

always_direct allow proto_https

http_access allow manager
http_access allow localhost
http_access allow group1
http_access allow group2 tasix
http_access allow group2 expressions
http_access deny  group2
http_access deny  !Safe_ports
http_access deny  CONNECT !SSL_ports

http_access deny all
icp_access  deny all
htcp_access deny all

hierarchy_stoplist cgi-bin ?

access_log   /var/log/squid3/access.log squid
coredump_dir /var/spool/squid3

cache_dir             ufs /var/spool/squid3 1024 16 256
cache_effective_user  proxy
cache_effective_group proxy
cache_mgr             webmaster@localhost

url_rewrite_program  /usr/bin/squidGuard -c /etc/squid/squidGuard.conf
url_rewrite_children 5
redirector_bypass    off

error_directory /usr/share/squid3/errors/Russian-1251

# cat /etc/squid/squidGuard.conf:

Скрытый текст:

dbhome /var/lib/squidguard/db
logdir /var/log/squid

# SOURCE ADDRESSES:

src admin {
    ip 192.168.0.5/32
}
src group1 {
    ip 192.168.0.6-192.168.0.20
}
src group2 {
    ip 192.168.0.21-192.168.0.254
}

# DESTINATION CLASSES:
dest adv {
    domainlist adv/domains
    urllist    adv/urls
    redirect   http://192.168.0.1/adv.html
}
dest dating {
    domainlist dating/domains
    urllist    dating/urls
    redirect   http://192.168.0.1/403.html
}
dest games-misc {
    domainlist games-misc/domains
    urllist    games-misc/urls
    redirect   http://192.168.0.1/403.html
}
dest games-online {
    domainlist games-online/domains
    urllist    games-online/urls
    redirect   http://192.168.0.1/403.html
}
dest movies {
    domainlist movies/domains
    urllist    movies/urls
    redirect   http://192.168.0.1/403.html
}
dest porn {
    domainlist porn/domains
    urllist    porn/urls
    redirect   http://192.168.0.1/warn.html
}
dest radiotv {
    domainlist radiotv/domains
    urllist    radiotv/urls
    redirect   http://192.168.0.1/403.html
}
dest socialnet {
    domainlist socialnet/domains
    urllist    socialnet/urls
    redirect   http://192.168.0.1/403.html
}
dest updatesites {
    domainlist updatesites/domains
    urllist    updatesites/urls
    redirect   http://192.168.0.1/false.html
}
dest webtv {
    domainlist webtv/domains
    urllist    webtv/urls
    redirect   http://192.168.0.1/403.html
}
dest tasix {
    domainlist tasix/domains
    redirect   http://192.168.0.1/403.html
}

acl {

    admin {
        pass !adv !dating !games-misc !games-online !movies !porn !radiotv !socialnet !webtv all
    }
	group1 {
        pass !adv !dating !games-misc !games-online !movies !porn !radiotv !socialnet !updatesites !webtv all
    }
    group2 {
        pass !adv !dating !games-misc !games-online !movies !porn !radiotv !socialnet !updatesites !webtv !messengers tasix
    }
    default {
        pass none
        redirect http://192.168.0.1/403.html
    }

}

В файлах /var/lib/squidguard/db/tasix/domains, /etc/squid3/tasix и /etc/squid3/expressions приведены списки доменов, сетей и доменов в виде регулярных выражений для фильтрации.

Обращение к модераторам:

Спасибо всем, кто помогал! Тему можно закрывать. С Новым годом!