jorgevisentini
(usa CentOS)
Enviado em 27/10/2014 - 11:09h
acl redeLOCAL src xxx.xxx.xxx.xxx/22
acl rede1 dst xxx.xxx.xxx.xxx/xx
acl rede2 dst xxx.xxx.xxx.xxx/xx
acl SSL_ports port 443
acl SSL_ports port 444
acl SSL_ports port 10000
acl SSL_ports port 1863
acl SSL_ports port 8530
acl Safe_ports port 80 # http
acl Safe_ports port 81
acl Safe_ports port 8080 # http
acl Safe_ports port 8530 # WSUS
acl Safe_ports port 37777 # Intelbras
acl Safe_ports port 444
acl Safe_ports port 21 # ftp
acl Safe_ports port 631 # cups
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 9876 # Autenticacao Amadeus
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
###################################################
# CONTROLE DE DOWNLOADS - TESTE - NAO FUNCIONA POR ENQUANTO
delay_pools 1 #SIGNIFICA QUE POSSUI 1 POOL
delay_class 1 3 #SIGNIFICA QUE O POOL 1 PERTENCE E UMA DELAY CLASS 3
delay_access 1 allow redeLOCAL #
#625000*8/1000 - SETA A TAXA LIMITE DE TODA A REDE EM 500kbit/s
#2000*8/1000 - SETA O LIMITE POR SUB-RED EM 160kbit/s
#2500*8/1000 - SETA O LIMITE POR USUARIO EM 10kbit/s
delay_parameters 1 62500/62500 20000/20000 1250/1250
#delay_parameters 1 50000/50000 -1/-1 24000/24000
####################################################
#SE ESTIVER NO AD - AUTENTICA AUTOMATICAMENTE
#auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
#auth_param ntlm children 200 startup=0 idle=1
#auth_param ntlm keep_alive on
#SE NAO ESTIVER NO AD - PEDE SENHA
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 200 startup=0 idle=1
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
auth_param basic realm Controle de Acesso a Internet - Informe seu usuario e senha
#BUSCA GRUPO NO AD
external_acl_type ad_group ipv4 %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl
#ACL DOS GRUPOS NO AD
#NOME ACL TIPO NOME DO GRUPO NO AD
acl grupoCCO external ad_group poa-internet-cco
acl grupoCOMERCIAL external ad_group poa-internet-comercial
acl grupoDHO external ad_group poa-internet-dho
acl grupoDIRETORIA external ad_group poa-internet-diretoria
acl grupoEXPEDICAO external ad_group poa-internet-expedicao
acl grupoFINANCEIRO external ad_group poa-internet-financeiro
acl grupoLIBERADOS external ad_group poa-internet-liberados
acl grupoMARKETING external ad_group poa-internet-marketing
acl grupoMOTOSERVICE external ad_group poa-internet-motoservice
acl grupoPENDENCIA external ad_group poa-internet-pendencia
acl grupoREDESSOCIAIS external ad_group poa-internet-redessociais
acl grupoSEMRESTRICAO external ad_group poa-internet-semrestricao
acl grupoTECNICO external ad_group poa-internet-tecnico
acl grupoSEGTRABALHO external ad_group poa-internet-segtrabalho
acl grupoTI external d_group poa-internet-ti
acl grupoTMK external ad_group poa-internet-tmk
acl grupoYOUTUBE external ad_group poa-internet-youtube
acl grupoSKYPE external ad_group poa-internet-skype
#SITES
#CHUNCHU SKYPE
#acl MSNserver req_mime_type ^application/x-msn-messenger$
#acl MSNpath urlpath_regex -i gateway.dll
#acl MSNdominios dstdomain "/etc/squid/sites/msn.txt"
#acl SkypeDom dstdomain "/etc/squid/sites/skype.txt"
#BLOQUEADOS
acl sitesBANIDOS dstdomain "/etc/squid/sites/banidos.txt"
acl sitesBLOQUEADOS dstdomain "/etc/squid/sites/bloqueados.txt"
acl extensoes urlpath_regex -i "/etc/squid/sites/extensoes.txt"
#LIBERADOS
acl sitesLIBERADOS dstdomain "/etc/squid/sites/liberados.txt"
acl sitesINTERNOS dstdomain "/etc/squid/sites/internos.txt"
acl sitesSEMAUTENTICACAO dstdomain "/etc/squid/sites/semAUTENTICACAO.txt"
acl sitesCOMERCIAL dstdomain "/etc/squid/sites/comercial.txt"
acl sitesDHO dstdomain "/etc/squid/sites/dho.txt"
acl sitesEXPEDICAO dstdomain "/etc/squid/sites/expedicao.txt"
acl sitesFINANCEIRO dstdomain "/etc/squid/sites/financeiro.txt"
acl sitesMOTOSERVICE dstdomain "/etc/squid/sites/motoservice.txt"
acl sitesPENDENCIA dstdomain "/etc/squid/sites/pendencia.txt"
acl sitesREDESSOCIAIS dstdomain "/etc/squid/sites/redesSOCIAIS.txt"
acl sitesTECNICO dstdomain "/etc/squid/sites/tecnico.txt"
acl sitesSEGTRABALHO dstdomain "/etc/squid/sites/segTRABALHO.txt"
acl sitesTMK dstdomain "/etc/squid/sites/tmk.txt"
acl sitesYOUTUBE dstdomain "/etc/squid/sites/youtube.txt"
#APLICACAO DAS ACL
http_access allow manager localhost
http_access allow rede2 #PERMITE ACESSO SEM AUTENTICACAO
http_access allow sitesINTERNOS #PERMITE ACESSO SEM AUTENTICACAO
http_access allow sitesSEMAUTENTICACAO #PERMITE ACESSO SEM AUTENTICACAO
http_access deny manager
#BLOQUEIA PORTAS NAO SEGURAS
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow grupoSEMRESTRICAO
http_access allow grupoYOUTUBE sitesYOUTUBE
#http_access allow netChat MSNserver
#http_access allow netChat MSNdominios
#http_access allow netChat MSNpath
#http_access allow netChat redemsn
#http_access allow netChat SkypeDom
http_access allow grupoREDESSOCIAIS sitesREDESSOCIAIS
http_access deny sitesBANIDOS
http_access allow grupoLIBERADOS
http_access allow grupoTI
http_access allow grupoDIRETORIA
http_access deny extensoes
#http_access allow grupoCCO
http_access allow grupoMARKETING
http_access allow grupoMOTOSERVICE
http_access allow grupoCOMERCIAL
http_access deny grupoEXPEDICAO !sitesEXPEDICAO
http_access deny grupoPENDENCIA !sitesPENDENCIA
http_access deny grupoTMK !sitesTMK
http_access allow grupoFINANCEIRO sitesFINANCEIRO
http_access allow grupoDHO sitesDHO
http_access allow grupoTECNICO sitesTECNICO
http_access allow grupoSEGTRABALHO sitesSEGTRABALHO
http_access deny sitesBLOQUEADOS
http_access allow sitesLIBERADOS
http_access allow localhost
http_access deny all
http_port 3128
cache_mem 512 MB
half_closed_clients off
#maximum_object_size 4096 KB
maximum_object_size 50 MB
maximum_object_size_in_memory 64 KB
#memory_pools off
detect_broken_pconn on #CONEXOES PERSISTENTES
pipeline_prefetch 1 #GANHO DE PERFORMANCE AO USAR CONEXOES PIPELINE
#fqdncache_size 1024 #CACHE DE FQDN
logfile_rotate 10 #CONTROLE DO ARQUIVO DE LOG
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir diskd /var/cache/squid 10240 16 256
coredump_dir /var/cache/squid
error_directory /usr/share/squid/errors/pt-br
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
Está ai meu squid.conf. Tirei/alterei apenas algumas informações referente aos meus ips.
Meu conf está 100% funcional. Gostaria apenas de adicionar o limite de banda.
Valeu pelo interesse em ajudar!
