Servidor proxy + firewall = navegação lenta [RESOLVIDO]
1. Servidor proxy + firewall = navegação lenta [RESOLVIDO]
leo4b
(usa Outra)
Enviado em 01/08/2012 - 23:25h
Ola boa noite.Bom montei aqui um servidor proxy rodando squid3 com um firewall "+-" rodando no debian.
O problema é que em alguns casos, quando entro em uma pagina, ela tem um delay para começar a carregar, é coisa de 30 s e o problema acontece uma vez ou outra, fora to proxy fica tudo ok.... Segue minhas configurações para analise, aceito sugestões para melhora e organização das configs também.
Tanto o firewall quanto o proxy são para testes, não tenho anda ativo ainda porém uso o server todo dia.
####################################################
############### SQUID AUTENTICADO ##################
##### Leonardo Ortiz ###############################
####################################################
http_port 3128
visible_hostname linux
error_directory /usr/share/squid3/errors/pt-br
httpd_suppress_version_string on
cache_mgr servidor@formigari.com
dns_nameservers 8.8.8.8 200.175.5.139
mime_table /usr/share/squid3/mime.conf
#strip_query_terms off
pipeline_prefetch on
half_closed_clients off
######### rede, #######
acl rede src 192.168.254.0/24
http_access deny !rede
########## liberar msn para todo mundo #########
acl msn urlpath_regex -i gateway.dll
acl msn urlpath_regex -i passport.com
http_access allow msn
######## users autenticados que nao recebem bloqueios #########
acl permitidos proxy_auth leo
http_access allow permitidos
########## bloqueio #######
#acl almoco time 12:00-13:30
acl bloqueados url_regex -i "/etc/squid3/config/bloqueados"
#http_access allow bloqueados almoco
http_access deny bloqueados
########## autenticao ########
auth_param basic realm Pimenta
auth_param basic program /usr/lib/squid3/ncsa_auth /etc/squid3/squid_passwd
acl autenticados proxy_auth REQUIRED
http_access allow autenticados
######### cache #########
cache_mem 2048 MB
maximum_object_size_in_memory 4 MB
maximum_object_size 100 MB
minimum_object_size 4 KB
cache_dir diskd /squid/cache 40000 128 512 Q1=64 Q2=72
cache_access_log /var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
cache_swap_low 90
cache_swap_high 95
refresh_pattern ^ftp: 15 20% 1440
refresh_pattern ^gopher: 15 0% 1440
refresh_pattern . 15 20% 1440
cache_replacement_policy heap LRU
hierarchy_stoplist cgi-bin?
ipcache_size 2048
ipcache_low 90
ipcache_high 95
acl manager proto cache_object
#acl all src all
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 1863 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
FIREWALL
#!/bin/bash
echo Script criado por: Leonardo Ortiz
PTLB="/etc/FIREWALL/liberadas"
iniciar(){
#### Limpar regras ##
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -X
#### Politica padrã####
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
######## Abilita roteamento e redireciona para o Squid ####
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
##iptables -t nat -A PREROUTING -s 192.168.254.0/255.255.255.0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#### LIBERA TRAFEGO ####
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --syn -s 192.168.254.0/255.255.255.0 -j ACCEPT
########## protecoes ################
######## BLOQUEIO PING DA MORTE #
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -m limit --limit 1/s -j DROP
######## BLOQUEIO SYN-FLOD ######
echo "0" > /proc/sys/net/ipv4/tcp_syncookies #faz o servidor responder um syn com um cookie que identifica o cliente
#iptables -A INPUT -p tcp --syn -j DROP
#iptables -A INPUT -m limit --limit 1/s --limit-burst 4 -j DROP
####### ANTI-SPOOFING #########
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter #responder a pacotes na interface que foram originados
####### SCANNERS ##############
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
####### Bloquear pacotes invalidos ####
iptables -A INPUT -m state --state INVALID -j DROP
######### bloqueio de sites diversos ###########
###### bloquear facebook ######
iptables -A FORWARD -m string --algo bm --string "facebook" -m time --timestart 12:00 --timestop 13:30 -j ACCEPT
iptables -A FORWARD -m string --algo bm --string "facebook" -j DROP
########### Liberar Portas e state ##############
###### FLUXO DE PACOTES #####
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
####### Liberar Portas INPUT ######
for lib in `cat $PTLB`; do
iptables -A INPUT -p tcp -m multiport --port $lib -j LOG --log-prefix "INPUT"
iptables -A INPUT -p tcp -m multiport --port $lib -j ACCEPT
iptables -A INPUT -p udp -m multiport --port $lib -j ACCEPT
done
####### liberar FORWARD #
for lib in `cat $PTLB`; do
iptables -A FORWARD -p tcp -m multiport --dport $lib -j LOG --log-prefix "FORMARD"
iptables -A FORWARD -p tcp -m multiport --dport $lib -j ACCEPT
iptables -A FORWARD -p udp -m multiport --dport $lib -j ACCEPT
done
}
parar(){
iptables -X
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F
iptables -F -t nat
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parâtros start ou stop"
esac