Lentidão para fazer download

1. Lentidão para fazer download

forgottenn
(usa Debian)

Enviado em 07/02/2014 - 11:07h

Bom dia a todos
Preciso muito da ajuda de vcs, estou com um servidor com proxy não transparente e regras de firewall DROP que apresenta lentidão ao fazer download.
Se tento fazer download passando pelo squid ou até mesmo fora do squid (liberando porta 443 e 80 no firewall) ele não passa de 35 KBPS sendo que tenho internet de 35 MB da GVT.

Meu modem não esta em bridge então fiz o teste usando o IP do modem como GW no terminal e dessa forma atinge velocidades alta o que me da a certeza que o problema é no servidor.
Até mesmo usando WGET no servidor esta lento os downloads.

Alguém poderia me dar uma dica do que devo fazer para analisar e resolver esse problema? Sou novo no sistema linux.

Segue teste de download que fiz:
Usando GW do modem:
avast_free_antivirus_setup.exe 294 KB/s - 6,5 MB de 86,4 MB, 4 minutos restantes
http://files.avast.com/iavs5x/avast_free_antivirus_setup.exe

Usando GW do proxy:
avast_free_antivirus_setup.exe 24,6 KB/s - 12,0 MB de 86,4 MB, 51 minutos restantes
http://files.avast.com/iavs5x/avast_free_antivirus_setup.exe

Firewalll

#!/bin/bash

######################
# DECLARANDO AS VARIÁVEIS #
######################

# Interface de rede ligada a internet
IFACE_WEB=eth0

# Interface de rede ligada a rede interna
IFACE_REDE=eth1

# Rede interna
REDE_INTERNA=192.168.9.0/24

# Portas liberadas TCP
PORTAS_TCP=20,21,53,80,443

# Portas liberadas UDP
PORTAS_UDP=53

# Portas liberadas para a rede interna
PORTAS_REDE_INTERNA=25,110

############################################################
# FUNÇÃO START #
# Esta função limpa as regras criadas anteriormente, e insere as regras listadas na função
###########################################################

function start () {

#++++++++++++++++++++++
# LIMPA AS REGRAS EXISTENTES #
#+++++++++++++++++++++#

##CArregar modulos
modprobe ip_tables
modprobe iptable_nat
modprobe iptable_filter
modprobe iptable_mangle
#
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_gre
#
modprobe ipt_LOG
modprobe ipt_MARK
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_TCPMSS
modprobe ipt_TOS
modprobe ipt_NETMAP
#
modprobe ipt_limit
modprobe ipt_mac
modprobe ipt_multiport
modprobe ipt_owner
modprobe ipt_state
modprobe ipt_tos
modprobe ipt_mark
modprobe ipt_tcpmss
modprobe ipt_string
modprobe ipt_statistic
#
modprobe nf_nat_pptp
modprobe nf_nat_proto_gre

# Limpa as regras da tabela filter
iptables -Z # Zera as regras de todas as chains
iptables -F
#iptables -D INPUT -j LOGGING
#iptables -D FORWARD -j LOGGING
iptables -F LOGGING
iptables -X

# Limpa as regras da tabela nat
iptables -t nat -F

# DEFINE AS POLITICAS COMO DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# HABILITA O ROTEAMENTO NO KERNEL #
echo 1 > /proc/sys/net/ipv4/ip_forward

###LOG ultrasurf
for i in $(cat /etc/squid3/ipultrasurf);
do
iptables -A FORWARD -d $i -j LOG --log-prefix "=UltraSurf="
done

# CRIA A IDA E VOLTA DO ACESSO NAS CHAINS INPUT, OUTPUT E FORWARD, ASSIM NÃO PRECISAMOS CRIAR A IDA E VOLTA NAS REGRAS
# Não vamos nos aprofundar neste assunto, mas vale a pena dar uma estudada no módulo state ;-)
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

#iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 80 -j ACCEPT

#iptables -A FORWARD -i eth1 -p tcp -m tcp --dport 80 -d www.sedentario.org -j ACCEPT

##############
# REGRAS DE NAT #
#############

# COMPARTILHA A INTERNET #
iptables -t nat -A POSTROUTING -s $REDE_INTERNA -o $IFACE_WEB -j MASQUERADE

echo "Definindo NAT.......................................[OK]"
## Redireciona SQUID rede INT ##
#iptables -t nat -A PREROUTING -i $IFACE_REDE -s 192.168.9.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -s 192.168.9.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128

# REDIRECIONA O ACESSO RDP PARA OUTRO SERVIDOR DENTRO DA REDE INTERNA#
iptables -t nat -A PREROUTING -p tcp --dport 33891 -j LOG --log-prefix "**CONEXAO RDP**"
iptables -A FORWARD -p tcp --dport 33891 -j LOG --log-prefix "**CONEXAO RDP 33891**"

iptables -t nat -A PREROUTING -s 0/0 -d 192.168.25.252 -p tcp --dport 33891 -j DNAT --to-destination 192.168.9.16:3389

# Libera Loopback (para funcionar o SQSTAT)
iptables -A FORWARD -s 0/0 -d 0/0 -j ACCEPT -i lo
iptables -A INPUT -s 0/0 -d 0/0 -j ACCEPT -i lo

echo 'Fechando porta ultrasurf'
iptables -A INPUT -p tcp -m tcp --dport 9666 -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 9666 -j DROP
iptables -A OUTPUT -p tcp -m tcp --dport 9666 -j DROP
#iptables -t nat -A PREROUTING -p tcp -s $REDE_INTERNA --dport 9666 -j DROP

###############
# REGRAS DE INPUT #
###############

# Libera o acesso SSH de qualquer origem
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 7340 -j ACCEPT

iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

## Libera FTP
iptables -A INPUT -p tcp --dport 21 -j LOG --log-prefix "**INPUT Conexão FTP**"
iptables -A INPUT -p tcp -m multiport --dports 20,21 -j ACCEPT

iptables -A FORWARD -p tcp -m multiport --dports 20,21 -j LOG --log-prefix "**FORWARD Conexão FTP**"
iptables -A FORWARD -p tcp -m multiport --dports 20,21 -j ACCEPT

#team viewer#
iptables -t filter -A FORWARD -p tcp --dport 5938 -j ACCEPT

# Libera o squid a partir da rede interna
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

##Liberar Apache
#iptables -A INPUT -p tcp --dport 10443 -d 192.168.25.252 -j LOG --log-prefix "**INPUT Conexão APACHE**"
iptables -A INPUT -p tcp --dport 10443 -d 192.168.25.252 -j ACCEPT
iptables -A INPUT -p tcp -s $REDE_INTERNA --dport 10443 -d 192.168.9.169 -j ACCEPT

# Aceita ping apenas da rede interna
iptables -A INPUT -s $REDE_INTERNA -p icmp --icmp-type 8 -j ACCEPT

################
# REGRAS DE OUTPUT #
################

# Libera as portas constantes na variável $PORTAS_TCP (para liberar mais portas, basta inserir as mesmas na variável citada)
iptables -A OUTPUT -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT

iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT

# Libera ping para qualquer lugar
iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

##################
# REGRAS DE FORWARD #
#################
### Liberar MAC para não passar pelo SQUID
#iptables -t filter -A FORWARD -d 0/0 -m mac --mac-source 5C:F3:FC:FD:77:25 -p tcp -m multiport --dports 443 -j LOG --log-prefix "**SERVIDOR BANCO**"
#iptables -t filter -A FORWARD -d 0/0 -m mac --mac-source 5C:F3:FC:FD:77:25 -p tcp -m multiport --dports 443 -j ACCEPT
iptables -t filter -A FORWARD -d 0/0 -m mac --mac-source 08:00:27:58:32:04 -p tcp -m multiport --dports 80,443 -j ACCEPT

iptables -t filter -A FORWARD -d 189.38.115.0/24 -s 192.168.9.0/24 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -t filter -A FORWARD -d 50.17.213.0/24 -s 192.168.9.0/24 -p tcp -m multiport --dports 80,443 -j ACCEPT

#iptables -A FORWARD -p tcp --dport 3128 -j ACCEPT

# Libera as portas constantes em na variável $PORTAS_REDE_INTERNA (para liberar mais portas, basta inserir as mesmas na variável citada)
iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_REDE_INTERNA -j ACCEPT

## Liberando DNS ( UDP ) para rede interna ##
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -j ACCEPT

## Liberando PING para rede interna ##
iptables -A FORWARD -p icmp -j ACCEPT

##Libera portas altas
#iptables -A FORWARD -i eth0 -o eth1 -s 192.168.9.0/24 -p tcp --dport 1024:65535 -j ACCEPT

#iptables -A INPUT -p tcp --dport 1024:65535 -j LOG --log-prefix "** INPUT PORTA ALTAS **"
#iptables -A FORWARD -p tcp --dport 1024:65535 -j LOG --log-prefix "** FORWARD PORTA ALTAS **"
#iptables -A INPUT -s 192.168.9.0/24 -p tcp --dport 1024:65535 -j ACCEPT
iptables -A FORWARD -s 192.168.9.0/24 -p tcp --dport 1024:65535 -j ACCEPT

### VNC ###
iptables -t nat -A PREROUTING -p tcp -m multiport --dports 5500,5502,5501 -j LOG --log-level debug --log-prefix "ACESSO VNC"
iptables -A FORWARD -p tcp -m multiport --dports 5500,5501,5502 -j LOG --log-level debug --log-prefix "FORWARD VNC"

#iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 5501 -j DNAT --to-destination 192.168.9.102:5501
#iptables -A FORWARD -i eth0 -p tcp -m tcp -d 192.168.9.102 --dport 5501 -m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -s 0/0 -p tcp -d 192.168.25.252 --dport 5501 -j DNAT --to-destination 192.168.9.102:5501
iptables -A FORWARD -p tcp -d 192.168.9.102 --dport 5501 -j ACCEPT

iptables -t nat -A PREROUTING -s 0/0 -p tcp -d 192.168.25.252 --dport 5502 -j DNAT --to-destination 192.168.9.105:5502
iptables -A FORWARD -p tcp -d 192.168.9.105 --dport 5502 -j ACCEPT

#iptables -t nat -A PREROUTING -s 0/0 -p tcp -d 192.168.25.252 -i eth1 --dport 5500 -j DNAT --to-destination 192.168.9.103:5500
#iptables -A FORWARD -i eth1 -p tcp -d 192.168.9.103 --dport 5500 -j ACCEPT

iptables -t nat -A PREROUTING -s 0/0 -p tcp -d 192.168.25.252 --dport 5500 -j DNAT --to-destination 192.168.9.103:5500
iptables -A FORWARD -p tcp -d 192.168.9.103 --dport 5500 -j ACCEPT

## Liberar TS rede ##
iptables -A FORWARD -p tcp -s $REDE_INTERNA -m multiport --dports 3389,33891,33890,33892 -j LOG --log-prefix "**Conexao TS FW**"
iptables -A FORWARD -p tcp -s $REDE_INTERNA --dport 3389 -j ACCEPT
iptables -A FORWARD -p tcp -s $REDE_INTERNA --dport 33890 -j ACCEPT
iptables -A FORWARD -p tcp -s $REDE_INTERNA --dport 33891 -j ACCEPT
iptables -A FORWARD -d $REDE_INTERNA -p tcp -s 0/0 --dport 33891 -j ACCEPT
iptables -A FORWARD -d $REDE_INTERNA -p tcp -s 0/0 --dport 3389 -j ACCEPT

###Atualização AVAST
iptables -A FORWARD -p tcp -s $REDE_INTERNA -d 77.234.42.0/24 -j ACCEPT

## gerando arquivo com IPs do facebook ##
whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | grep ^[0-9] > facebook.ip
for i in $(cat facebook.ip);
do
#iptables -I FORWARD -s 192.168.9.167 -d $i -j ACCEPT
iptables -I FORWARD -s $i -j LOG --log-prefix "**DROP facebook **"
iptables -I FORWARD -s $i -j DROP
done

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A FORWARD -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP

# FINAL DA FUNÇÃO START #
}

SQUID.CONF

http_port 3128
visible_hostname proxyct.org

############## LOGS ##############
access_log /var/log/squid3/access.log squid
cache_log /var/log/squid3/cache.log
cache_store_log none

hierarchy_stoplist cgi-bin ?

############## DESEMPENHO/DISCO ##############
cache_mem 1876 MB
maximum_object_size_in_memory 128 KB
memory_replacement_policy lru
cache_replacement_policy lru
maximum_object_size 512 MB
minimum_object_size 0 KB
cache_dir ufs /home/squid/cache 100000 16 256
coredump_dir /home/squid/cache
#memory_replacement_policy heap GDSF
#cache_replacement_policy heap LFUDA

dns_nameservers 8.8.8.8 208.67.222.222

### Limpa cache ###
cache_swap_low 90
cache_swap_high 95

###Sites sem cache
acl NOCACHE url_regex "/etc/squid3/nocache"
no_cache deny NOCACHE
always_direct allow NOCACHE

###Sites BANCOS
acl bancos dstdomain "/etc/squid3/banco"
http_access allow bancos
always_direct allow bancos

### Icones ###
icon_directory /usr/share/squid3/icons
short_icon_urls on

### Errors configuracao ###
error_directory /usr/share/squid3/errors/Portuguese

############## ACL PORTAS ##############
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl webserver src 192.168.9.169/32
#### REDE LOCAL####
acl redelocal src 192.168.9.0/24

acl SSL_ports port 443 563 873 10443 444 447 7443 10000
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 5500 # vnc
acl Safe_ports port 5501 # vnc
acl Safe_ports port 5502 # vnc

acl windowsupdate dstdomain windowsupdate.microsoft.com
acl windowsupdate dstdomain .update.microsoft.com
acl windowsupdate dstdomain download.windowsupdate.com
acl windowsupdate dstdomain redir.metaservices.microsoft.com
acl windowsupdate dstdomain images.metaservices.microsoft.com
acl windowsupdate dstdomain c.microsoft.com
acl windowsupdate dstdomain www.download.windowsupdate.com
acl windowsupdate dstdomain wustat.windows.com
acl windowsupdate dstdomain crl.microsoft.com
acl windowsupdate dstdomain sls.microsoft.com
acl windowsupdate dstdomain productactivation.one.microsoft.com
acl windowsupdate dstdomain ntservicepack.microsoft.com

acl purge method PURGE
acl CONNECT method CONNECT

acl wuCONNECT dstdomain www.update.microsoft.com
acl wuCONNECT dstdomain sls.microsoft.com

http_access allow CONNECT wuCONNECT redelocal
http_access allow windowsupdate redelocal

http_access allow manager webserver
http_access allow manager localhost
#cache allow all
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports

##WU
acl winup dst "/etc/squid3/wu"
http_access allow redelocal winup

acl skype_80 dstdom_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:80
acl skype_443 dstdom_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:443
acl validUserAgent browser \^Skype+
http_access allow validUserAgent

http_access allow CONNECT skype_80 validUserAgent
http_access allow CONNECT skype_443 validUserAgent

# // LIBERA > ".gov.br"
acl governo dstdomain .gov.br
http_access allow governo

http_access deny CONNECT !SSL_ports

# // NEGA > DOWNLOADS
acl extensoes urlpath_regex -i "/var/www/fw/squid/files/bloqueados/extensoes/ext_bloqueadas"
#acl extensoes urlpath_regex -i \.mp3($|\?|\&)
http_access deny all extensoes

http_access allow localhost

### ACL ###
# ---- Sites diretos que nao passam pelo Cache ----
acl sites_diretos url_regex "/var/www/fw/squid/files/liberados/s_senha/s_senha"

# // LIBERADO TOTAL - COMPUTADORES POR MAC ADRESS
#acl mac_liberados arp "/var/www/squid/files/liberados/ip/ip"
acl ip_liberados src "/var/www/fw/squid/files/liberados/ip/ip"

# // Bloqueia IP
acl ip_bloqueados src "/var/www/fw/squid/files/bloqueados/ip/ip_bloqueados"

# // LIBERADO > ALGUNS SITES A TODOS
acl sitesliberados dstdomain "/var/www/fw/squid/files/liberados/dominios/sites_liberados

# //LIBERA > PALAVRAS LIBERADAS
acl palavrasliberadas url_regex -i "/var/www/fw/squid/files/liberados/palavras/pl_liberados"

# // NEGA > SITES PROIBIDOS
acl sitesbloqueados dstdomain "/var/www/fw/squid/files/bloqueados/dominios/sites_bloqueados"

# // NEGA > PALAVRAS PROIBIDAS
acl palavrasbloqueadas url_regex "/var/www/fw/squid/files/bloqueados/palavras/pl_bloqueadas"

###SKYPE
acl siteskype dstdomain "/etc/squid3/skype"

##Regras valida a todos
http_access deny redelocal sitesbloqueados
http_access allow redelocal sites_diretos

http_access allow redelocal siteskype
http_access allow siteskype
http_access deny redelocal palavrasbloqueadas

###Regras de acesso IP VIP
http_access allow ip_liberados

##resto da rede
#http_access allow redelocal sites_diretos
#ttp_access allow redelocal siteskype

###Regras de acesso IP limitado
http_access allow ip_bloqueados sites_diretos
http_access allow ip_bloqueados sitesliberados
http_access allow ip_bloqueados palavrasliberadas

http_access deny all

#Cache windowsupdate
refresh_pattern windowsupdate.com/.*\.(cab|psf|wmu|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|psf|wmu|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern www.download.microsoft.com/.*\.(cab|psf|wmu|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern www.microsoft.com/.*\.(cab|psf|wmu|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|psf|wmu|exe|dll|msi) 4320 100% 43200 reload-into-ims
refresh_pattern download.windowsupdate.com/.*\.(cab|psf|wmu|exe|dll|msi) 4320 100% 43200 reload-into-ims
refresh_pattern www.download.windowsupdate.com/.*\.(cab|psf|wmu|exe|dll|msi) 4320 100% 43200 reload-into-ims
range_offset_limit 200 MB windowsupdate

#Cache atulizacao avira
refresh_pattern personal.avira-update.com/.*\.(cab|exe|dll|msi|gz) 10080 100% 43200 reload-into-ims

# DONT MODIFY THESE LINES
refresh_pattern \^ftp: 1440 20% 10080
refresh_pattern \^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
refresh_pattern -i \.index.(html|htm)$ 0 40% 10080
refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320

#TAG: quick_abort_min (KB)
#Default:
quick_abort_min -1

#TAG: quick_abort_max (KB)
#Default:
quick_abort_max 100 MB
quick_abort_pct 0

debug_options ALL,2
# Coloque aqui o e-mail do administrador.
# Ã‰para este endereÃ§que os e-mails serÃ£enviados quando o
# cache morrer.
#Default:
# cache_mgr webmaster
#Default:
httpd_suppress_version_string off # suprime a versÃ£do Squid
visible_hostname ProxyCPD # Cria um nome para o Squid.

0 0

Quote

2. Re: Lentidão para fazer download

danniel-lara
(usa Fedora)

Enviado em 07/02/2014 - 11:13h

tu não esta usando os DNS do google né ?
altera os DNS usa da operadora

0 0

Quote

3. Re: Lentidão para fazer download

forgottenn
(usa Debian)

Enviado em 07/02/2014 - 11:18h

Devo mudar o DNS no squid.conf, resolv.conf e dhcpd.conf?

0 0

Quote

4. Re: Lentidão para fazer download

danniel-lara
(usa Fedora)

Enviado em 07/02/2014 - 11:30h

forgottenn escreveu:

Devo mudar o DNS no squid.conf, resolv.conf e dhcpd.conf?

no local onde tu definiu as configurações do dns

0 0

Quote

5. Re: Lentidão para fazer download

forgottenn
(usa Debian)

Enviado em 07/02/2014 - 11:30h

Se alguém de bom coração poder me ajudar a revisar as configurações que postei e ver se estão certas.
meu servidor tem as seguinte configurações:
Versao do Kernel 3.11-0.bpo.2-amd64 (SMP) x86_64
Distribuicao GNU/Linux 7.3 (wheezy)
Intel(R) Xeon(R) CPU X3430 @ 2.40GHz
Memória 4GB
HDD 500 GB

0 0

Quote