Outlook x Iptable x Squid

debian_proxy
(usa Debian)

Enviado em 09/07/2009 - 15:09h

Caros colegas
Estou com um pequeno problema aqui.
Configurei um Servidor proxy utilizando Squid e IP tables ja criei todas as regras necessarias porem nao consigo acessar o outlook pelas portas 25 e 110.
Se alguem puder me dar um auxilia ficarei muito grato.
Segue abaixo meu squid.conf

#PARAMEREOS DE CONFIGURACAO DO SQUID
#auth_param basic children 5
#auth param basic credentialsttl 1 hour
#auth param basic realm
#auth param basic case sensitive off

#REGRAS PADRAO DO SQUID

http_port 3128 transparent

#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin \?
#Apache to signal ETag correctly on such responses
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache

#To log the request via syslog specify a filepath of "syslog"
access_log /var/log/squid/access.log squid

#Suggested default:
refresh_pattern ^ftp: 1440 20 10080
refresh_pattern ^gopher: 1440 0 1440
refresh_pattern . 0 20 4320

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563

# http
acl Safe_ports port 80
acl Safe_ports port 25
acl Safe_ports port 110

# ftp
acl Safe_ports port 21

# https
acl Safe_ports port 443

# gopher
acl Safe_ports port 70

# wais
acl Safe_ports port 210

# unregistered ports
acl Safe_ports port 1025-65535

# http-mgmt
acl Safe_ports port 280

# gss-http
acl Safe_ports port 488

# filemaker
acl Safe_ports port 591

# multiling http
acl Safe_ports port 777
acl CONNECT method CONNECT
acl nega url_regex "/etc/squid/sitesbloqueados.txt"
#acl msn url_regex -i gateway.dll
#acl msn2 rep_mime_type ^application/x-msn-messenger$

acl our_networks src 192.168.0.0/24
acl libera url_regex "/etc/squid/sitesliberados.txt"
cache deny QUERY
acl NOCACHE url_regex "/etc/squid/direto.txt" \?
#acl imo url_regex "/etc/squid/bloqreject.txt"
acl imo url_regex -i imo.im:443 .o.imo.im imo.im

no_cache deny NOCACHE

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access allow libera
http_access deny imo
http_access deny nega
#http_access deny msn
#http_access deny msn2
http_access allow all
icp_access allow all

visible_hostname dominio
#Default:
# coredump_dir none
# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid
cache_dir ufs /var/cache/squid 100 16 256
cache_log /var/log/squid/cache.log
cache_mem 8 MB
cache_replacement_policy lru
cache_store_log /var/log/squid/store.log
cache_swap_high 95
cache_swap_low 90
client_lifetime 1 day
connect_timeout 2 minute
emulate_httpd_log off
error_directory /usr/share/squid/errors/Portuguese
ftp_passive on
maximum_object_size 4096 KB
memory_replacement_policy lru
minimum_object_size 0 KB

Agradeço antecipadamente.

JoseHenriqueRJ
(usa Red Hat)

Enviado em 09/07/2009 - 15:29h

Caro amigo, adicione essas regras no iptables:

libera conexões de fora pra dentro
# ----------------------------------------------------------------
$ipt -A INPUT -p tcp --dport 443 -j ACCEPT
$ipt -A IMPUT -p tcp --dport 563 -j ACCEPT
$ipt -A INPUT -p tcp --dport 20 -j ACCEPT
$ipt -A INPUT -p tcp --dport 21 -j ACCEPT
$ipt -A INPUT -p tcp --dport 22 -j ACCEPT
$ipt -A INPUT -p tcp --dport 25 -j ACCEPT
$ipt -A INPUT -p tcp --dport 110 -j ACCEPT
$ipt -A INPUT -p tcp --dport 443 -j ACCEPT
$ipt -A INPUT -p tcp --dport 563 -j ACCEPT

#----------------------------------------------------------------
#Liberar portas para o Correio
#----------------------------------------------------------------
$ipt -A FORWARD -p tcp -s $rede_interna -d $dnssmt --dport 53 -j ACCEPT
$ipt -A FORWARD -p tcp -s $rede_interna -d $dnspop --dport 53 -j ACCEPT
$ipt -A FORWARD -p tcp -s $dnssmt --sport 53 -d $rede_interna -j ACCEPT
$ipt -A FORWARD -p tcp -s $dnspop --sport 53 -d $rede_interna -j ACCEPT
$ipt -A FORWARD -p TCP -s $rede_interna --dport 25 -j ACCEPT
$ipt -A FORWARD -p TCP -s $rede_interna --dport 110 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 25 -j ACCEPT
$ipt -A FORWARD -p tcp --sport 110 -j ACCEPT

Abçs e diga se funcionou!