Messenger 2011 está passando "por fora" do proxy [RESOLVIDO]
1. Messenger 2011 está passando "por fora" do proxy [RESOLVIDO]
lucascatani
(usa Ubuntu)
Enviado em 16/06/2012 - 19:37h
Tenho um servidor rodando um proxy e um firewall.As estações usam o proxy definido no navegador.
No firewall tenho somente:
#!/bin/bash
INTERNET="eth1"
REDELOCAL="eth0"
modprobe ip_tables
modprobe iptable_nat
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp -m multiport --dports 80,8080 -j DROP
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp -m multiport --dports 443 -j LOG
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp -m multiport --dports 443 -j DROP
# Compartilhando a internet com a REDELOCAL
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
Sites, está tudo certinho. Passam pelo squid, tanto 443, quanto 80.
O detalhe é que o MESSENGER 2011 está passando por fora do SQUID, sendo bloqueado na porta 443 do FW.
Segue o squid
cache_mem 1024 MB
maximum_object_size 4096 KB
cache_dir ufs /var/cache/squid 20000 16 256
cache_access_log /var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
emulate_httpd_log on
error_directory /usr/share/squid3/errors/Portuguese
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
acl manager url_regex -i ^cache_object:// +i ^https?://[^/]+/squid-internal-mgr/
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 192.168.0.0/24 # REDE
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
####################################################
# acl pessoais
####################################################
acl proibir_sites dstdomain -i "/etc/squid3/sites"
acl proibir_palavras url_regex -i "/etc/squid3/palavras.txt"
####################################################
# Política das acls pessoais
####################################################
http_access deny proibir_sites
http_access deny proibir_palavras
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
http_access deny all
Por que o MSN 2011 não está passando pelo squid, se ele usa a porta 443? Como eu faço para ele passar?