squid透明代理和访问控制-047
透明代理
客户端不需要指定代理
#vim /etc/squid/squid.conf
919 http_port 3128 transparent
把端口重定向
[root@server ~]# iptables -t nat -A PREROUTING -s 192.168.2.0/24 -p tcp --dport
80 -j REDIRECT --to-port 3128
[root@server ~]# iptables -t nat -A POSTROUTING -s 192.168
Dns 过不了代理服务器，需要通过nat转换
[root@server ~]# iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -p udp --dport 53 -o eth0 -j MASQUERADE
数据包转发功能要打开
[root@server ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@server ~]# sysctl –p
Squid 的访问控制：
不规则的ip地址范围和某个地址，NETMASK 要写 255.255.255.255
192.168.2.1/255.255.255.255
192.168.2.1-192.168.2.10/255.255.255.255
控制标准网段后面跟标准网段的NETMASK
192.168.2.0/255.255.255.0
基于mac地址的控制是 arp
418 # acl aclname src ip-address/netmask ... (clients IP address)
419 # acl aclname src addr1-addr2/netmask ... (range of addresses)
420 # acl aclname dst ip-address/netmask ... (URL host's IP address)
421 # acl aclname myip ip-address/netmask ... (local socket IP addres s)
423 # acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation)
432 # acl aclname srcdomain .foo.com ... # reverse lookup, client IP
433 # acl aclname dstdomain .foo.com ... # Destination server from U RL
434 # acl aclname srcdom_regex [-i] xxx ... # regex matching client nam e
435 # acl aclname dstdom_regex [-i] xxx ... # regex matching server
440 # acl aclname time [day-abbrevs] [h1:m1-h2:m2]
441 # day-abbrevs:
442 # S - Sunday
443 # M - Monday
444 # T - Tuesday
445 # W - Wednesday
446 # H - Thursday
447 # F - Friday
448 # A - Saturday
449 # h1:m1 must be less than h2:m2
--基于前部分http://的控制
450 # acl aclname url_regex [-i] ^http:// ... # regex matching on whole U RL
--基于后部分 .gif的控制
451 # acl aclname urlpath_regex [-i] \.gif$ ... # regex matching on URL path
452 # acl aclname urllogin [-i] [^a-zA-Z0-9] ... # regex matching on URL login field
--基于多个端口的控制，空格隔开多个
453 # acl aclname port 80 70 21 ...
454 # acl aclname port 0-1024 ... # ranges allowed
455 # acl aclname myport 3128 ... # (local socket TCP port)
Eg.
1.禁止子网192.168.1.0/24网段的客户机上网
Acl denycilent src 192.168.1.0/24
http_access deny denyclient
2.禁止用户访问ip地址为222.8.8.8的网站
Acl denyserver dst 222.8.8.8
http_access deny denyserver
3.禁止用户访问域名为www.xxx.com的网站
Acl denydomain dstdomain www.xxx.com
http_access deny denydomain
4.禁止用户访问域名含有 xxx.com的网站
Acl badurl url_regex –i xxx.com
http_access deny badurl
5.禁止访问含有xxx关键字的url
Acl denyurl url_regex –i xxx
http_access deny denyurl
6.限制ip为192.168.1.100的客户机最大连接数为2 所以客户机在周一到周五的 9:0-18:00上网
Acl clientconn src 192.168.1.100
Acl conn maxconn 2
Acl worktime time MTWHF 9:00-18:00
http_access deny clientconn conn worktime
7.禁止下载 *.MP3
Acl denydownload urlpath_regex –i \.mp3$
http_access deny denydownload
8.禁止qq通过代理上网
Acl qq url_regex –i tencent.com
http_access deny qq