Proxy Transparent - réseaux et sécurité - Linux et OS Alternatifs
MarshPosté le 18-11-2005 à 12:25:23
Bonjour, Je voudrais rendre mon proxy tranparent. j'utilise la carte Eth0 pour la sortie vers internet et la carte Eth1 pour les adresses locaux (192.168.0.1). mes pcs sont sur le réseau 192.168.0.0
Voici ma config squid.conf http_port 8080 icp_port 0 cache_mem 64 MB cache_dir ufs /var/spool/squid 100 16 128 maximum_object_size 4096 KB cache_store_log none cache_access_log /var/log/squid/access.log hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY visible_hostname proxy acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 10000 acl Safe_ports port 80 acl Safe_ports port 21 acl Safe_ports port 443 563 acl Safe_ports port 70 acl Safe_ports port 210 acl Safe_ports port 1025-65535 acl Safe_ports port 280 acl Safe_ports port 488 acl Safe_ports port 591 acl Safe_ports port 777 acl Safe_ports port 901 acl purge method PURGE acl CONNECT method CONNECT acl LocalNet src 192.168.0.0/255.255.255.0 #acl Users proxy_auth REQUIRED http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost http_access allow LocalNet http_access deny all icp_access allow all log_fqdn on httpd_accel_with_proxy on httpd_accel_uses_host_header on httpd_accel_host virtual httpd_accel_port 80 error_directory /usr/share/squid/errors/French
// Mes règles de IP tables echo 1 > /proc/sys/net/ipv4/ip_forward
Marsh Posté le 18-11-2005 à 12:25:23
Bonjour,
Je voudrais rendre mon proxy tranparent. j'utilise la carte Eth0 pour la sortie vers internet et la carte Eth1 pour les adresses locaux (192.168.0.1). mes pcs sont sur le réseau 192.168.0.0
Voici ma config squid.conf
http_port 8080
icp_port 0
cache_mem 64 MB
cache_dir ufs /var/spool/squid 100 16 128
maximum_object_size 4096 KB
cache_store_log none
cache_access_log /var/log/squid/access.log
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
visible_hostname proxy
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563 10000
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443 563
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl Safe_ports port 901
acl purge method PURGE
acl CONNECT method CONNECT
acl LocalNet src 192.168.0.0/255.255.255.0
#acl Users proxy_auth REQUIRED
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow LocalNet
http_access deny all
icp_access allow all
log_fqdn on
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
httpd_accel_host virtual
httpd_accel_port 80
error_directory /usr/share/squid/errors/French
// Mes règles de IP tables
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -s 192.168.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 8080
Mais ça ne marche pas.
Aidez moi svp. Merci
NB: quand je fixe les paramêtres du proxy sur une machine ça marche.