Quedas constantes e Acesso externo bloqueado

joaov1tor
(usa Outra)

Enviado em 14/10/2014 - 08:02h

Bom dia pessoal, olha eu aqui novamente para encher a paciência de vocês... hehe.
Há pouco tempo que mexo com squid e sou administrador da rede de uma pequena empresa, antes era outra empresa que prestava serviços para nós. Segue abaixo as config. do squid e do firewall( que não sei o motivo foi divido, eu percebi que se eu alterar o Iptables e não alterar o compartilhamento não funfa...) Fico aguardando a ajuda de vocês!!!

Squid.conf

http_port 3128 transparent
cache_mem 64 MB
maximum_object_size_in_memory 64 KB
maximum_object_size 512 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 2048 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
pid_filename /var/run/squid.pid
error_directory /usr/share/squid/errors/pt-br
emulate_httpd_log on
visible_hostname GRUPO_GUARDIA
cache_mgr suporte@2mtecnologia.com.br

cache_effective_user squid
cache_effective_group squid

refresh_pattern ^ftp: 360 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

# acl - Recomendadas
#*******************
acl all src
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/32
acl SSL_ports port 443 563 # https, snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
#
# acl - Personalizadas
#*********************
#
# *** Define portas liberadas
acl Safe_ports port 3050 # Interbase/Firebird
acl Safe_ports port 23000 # Serpro
acl Safe_ports port 13352 # SIRF
acl Safe_ports port 500 # FAP Digital
acl Safe_ports port 5017 # PREV

acl redelocal src 10.1.1.0/24

acl mac_liberado arp "/etc/squid/files/mac"
http_access allow mac_liberado

acl ips_liberados src "/etc/squid/files/ips_liberados"
http_access allow ips_liberados

acl sites_liberados url_regex -i "/etc/squid/files/sites_liberados"
http_access allow sites_liberados

acl sites_bloqueados url_regex -i "/etc/squid/files/sites_bloqueados"
http_access deny sites_bloqueados

http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow redelocal
http_access deny all

================================================================================
Iptables

#!/bin/sh
#
# iptables Start iptables firewall
#
# chkconfig: 2345 08 92
# description: Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
#
### BEGIN INIT INFO
# Provides: iptables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop iptables firewall
# Description: Start, stop and save iptables firewall
### END INIT INFO

# Source function library.
. /etc/init.d/functions

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES

# only usable for root
[ $EUID = 0 ] || exit 4

if [ ! -x /sbin/$IPTABLES ]; then
echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
exit 5
fi

# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
&& NEW_MODUTILS=1 \
|| NEW_MODUTILS=0

# Default firewall configuration:
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"
IPTABLES_SYSCTL_LOAD_LIST=""

# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"

# Netfilter modules
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6

# Get active tables
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)


rmmod_r() {
# Unload module with all referring modules.
# At first all referring modules will be unloaded, then the module itself.
local mod=$1
local ret=0
local ref=

# Get referring modules.
# New modutils have another output format.
[ $NEW_MODUTILS = 1 ] \
&& ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
|| ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)

# recursive call for all referring modules
for i in $ref; do
rmmod_r $i
let ret+=$?;
done

# Unload module.
# The extra test is for 2.6: The module might have autocleaned,
# after all referring modules are unloaded.
if grep -q "^${mod}" /proc/modules ; then
modprobe -r $mod > /dev/null 2>&1
res=$?
[ $res -eq 0 ] || echo -n " $mod"
let ret+=$res;
fi

return $ret
}

flush_n_delete() {
# Flush firewall rules and delete chains.
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

# Check if firewall is configured (has tables)
[ -z "$NF_TABLES" ] && return 1

echo -n $"${IPTABLES}: Flushing firewall rules: "
ret=0
# For all tables
for i in $NF_TABLES; do
# Flush firewall rules.
$IPTABLES -t $i -F;
let ret+=$?;

# Delete firewall chains.
$IPTABLES -t $i -X;
let ret+=$?;

# Set counter to zero.
$IPTABLES -t $i -Z;
let ret+=$?;
done

[ $ret -eq 0 ] && success || failure
echo
return $ret
}

set_policy() {
# Set policy for configured tables.
policy=$1

# Check if iptable module is loaded
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

# Check if firewall is configured (has tables)
tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
[ -z "$tables" ] && return 1

echo -n $"${IPTABLES}: Setting chains to policy $policy: "
ret=0
for i in $tables; do
echo -n "$i "
case "$i" in
raw)
$IPTABLES -t raw -P PREROUTING $policy \
&& $IPTABLES -t raw -P OUTPUT $policy \
|| let ret+=1
;;
filter)
$IPTABLES -t filter -P INPUT $policy \
&& $IPTABLES -t filter -P OUTPUT $policy \
&& $IPTABLES -t filter -P FORWARD $policy \
|| let ret+=1
;;
nat)
$IPTABLES -t nat -P PREROUTING $policy \
&& $IPTABLES -t nat -P POSTROUTING $policy \
&& $IPTABLES -t nat -P OUTPUT $policy \
|| let ret+=1
;;
mangle)
$IPTABLES -t mangle -P PREROUTING $policy \
&& $IPTABLES -t mangle -P POSTROUTING $policy \
&& $IPTABLES -t mangle -P INPUT $policy \
&& $IPTABLES -t mangle -P OUTPUT $policy \
&& $IPTABLES -t mangle -P FORWARD $policy \
|| let ret+=1
;;
*)
let ret+=1
;;
esac
done

[ $ret -eq 0 ] && success || failure
echo
return $ret
}

load_sysctl() {
# load matched sysctl values
if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
echo -n $"Loading sysctl settings: "
ret=0
for item in $IPTABLES_SYSCTL_LOAD_LIST; do
fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null
let ret+=$?;
done
[ $ret -eq 0 ] && success || failure
echo
fi
return $ret
}

start() {
# Do not start if there is no config file.
[ ! -f "$IPTABLES_DATA" ] && return 6

# check if ipv6 module load is deactivated
if [ "${_IPV}" = "ipv6" ] \
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
echo $"${IPTABLES}: ${_IPV} is disabled."
return 150
fi

echo -n $"${IPTABLES}: Applying firewall rules: "

OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

$IPTABLES-restore $OPT $IPTABLES_DATA
if [ $? -eq 0 ]; then
success; echo
else
failure; echo;
if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
echo -n $"${IPTABLES}: Applying firewall fallback rules: "
$IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
if [ $? -eq 0 ]; then
success; echo
else
failure; echo; return 1
fi
else
return 1
fi
fi

# Load additional modules (helpers)
if [ -n "$IPTABLES_MODULES" ]; then
echo -n $"${IPTABLES}: Loading additional modules: "
ret=0
for mod in $IPTABLES_MODULES; do
echo -n "$mod "
modprobe $mod > /dev/null 2>&1
let ret+=$?;
done
[ $ret -eq 0 ] && success || failure
echo
fi

# Load sysctl settings
load_sysctl

touch $VAR_SUBSYS_IPTABLES
return $ret
}

stop() {
# Do not stop if iptables module is not loaded.
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

# Set default chain policy to ACCEPT, in order to not break shutdown
# on systems where the default policy is DROP and root device is
# network-based (i.e.: iSCSI, NFS)
set_policy ACCEPT
# And then, flush the rules and delete chains
flush_n_delete

if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
echo -n $"${IPTABLES}: Unloading modules: "
ret=0
for mod in ${NF_MODULES[*]}; do
rmmod_r $mod
let ret+=$?;
done
# try to unload remaining netfilter modules used by ipv4 and ipv6
# netfilter
for mod in ${NF_MODULES_COMMON[*]}; do
rmmod_r $mod >/dev/null
done
[ $ret -eq 0 ] && success || failure
echo
fi

rm -f $VAR_SUBSYS_IPTABLES
return $ret
}

save() {
# Check if iptable module is loaded
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

# Check if firewall is configured (has tables)
[ -z "$NF_TABLES" ] && return 6

echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "

OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

ret=0
TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
&& chmod 600 "$TMP_FILE" \
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|| ret=1
if [ $ret -eq 0 ]; then
if [ -e $IPTABLES_DATA ]; then
cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
&& chmod 600 $IPTABLES_DATA.save \
&& restorecon $IPTABLES_DATA.save \
|| ret=1
fi
if [ $ret -eq 0 ]; then
mv -f $TMP_FILE $IPTABLES_DATA \
&& chmod 600 $IPTABLES_DATA \
&& restorecon $IPTABLES_DATA \
|| ret=1
fi
fi
rm -f $TMP_FILE
[ $ret -eq 0 ] && success || failure
echo
return $ret
}

status() {
if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
echo $"${IPTABLES}: Firewall is not running."
return 3
fi

# Do not print status if lockfile is missing and iptables modules are not
# loaded.
# Check if iptable modules are loaded
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
echo $"${IPTABLES}: Firewall modules are not loaded."
return 3
fi

# Check if firewall is configured (has tables)
if [ -z "$NF_TABLES" ]; then
echo $"${IPTABLES}: Firewall is not configured. "
return 3
fi

NUM=
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
VERBOSE=
[ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
COUNT=
[ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

for table in $NF_TABLES; do
echo $"Table: $table"
$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
done

return 0
}

reload() {
# Do not reload if there is no config file.
[ ! -f "$IPTABLES_DATA" ] && return 6

# check if ipv6 module load is deactivated
if [ "${_IPV}" = "ipv6" ] \
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
echo $"${IPTABLES}: ${_IPV} is disabled."
return 150
fi

echo -n $"${IPTABLES}: Trying to reload firewall rules: "

OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

$IPTABLES-restore $OPT $IPTABLES_DATA
if [ $? -eq 0 ]; then
success; echo
else
failure; echo; echo "Firewall rules are not changed."; return 1
fi

# Load additional modules (helpers)
if [ -n "$IPTABLES_MODULES" ]; then
echo -n $"${IPTABLES}: Loading additional modules: "
ret=0
for mod in $IPTABLES_MODULES; do
echo -n "$mod "
modprobe $mod > /dev/null 2>&1
let ret+=$?;
done
[ $ret -eq 0 ] && success || failure
echo
fi

# Load sysctl settings
load_sysctl

return $ret
}

restart() {
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
stop
start
}


case "$1" in
start)
[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
start
RETVAL=$?
;;
stop)
[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
stop
RETVAL=$?
;;
restart|force-reload)
restart
RETVAL=$?
;;
reload)
[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
RETVAL=$?
;;
condrestart|try-restart)
[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
restart
RETVAL=$?
;;
status)
status
RETVAL=$?
;;
panic)
set_policy DROP
RETVAL=$?
;;
save)
save
RETVAL=$?
;;
*)
echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
RETVAL=2
;;
esac

exit $RETVAL

==============================================================================================
Compartilhamento
#!/bin/bash

#liberando encaminhamento de pacotes
echo "1" > /proc/sys/net/ipv4/ip_forward

# adicionando módulos no kernel
modprobe ip_tables
modprobe iptable_nat

# limpando todas as regras pré-existentes no iptables

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t mangle -F

# habilitando o encaminhamento de pacoes via iptables
# lembre-se que se estiver usando uma outra interface troque
# a eth0 pela qual estiver você estiver usando no momento da configuração
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

#Habilitando a troca de porta do proxy
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

#liberando terminal service
iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth0 -j DNAT --to 10.1.1.2
iptables -t nat -A PREROUTING -p tcp --dport 3390 -i eth0 -j DNAT --to 10.1.1.3:3389

# liberando ssh
iptables -t nat -A PREROUTING -p tcp --dport 22 -i eth0 -j DNAT --to 10.1.1.1

# liberando DVR
iptables -t nat -A PREROUTING -p tcp --dport 9001 -i eth0 -j DNAT --to 10.1.1.4
iptables -t nat -A PREROUTING -p udp --dport 9001 -i eth0 -j DNAT --to 10.1.1.4
iptables -t nat -A PREROUTING -p tcp --dport 9002 -i eth0 -j DNAT --to 10.1.1.4
iptables -t nat -A PREROUTING -p udp --dport 9002 -i eth0 -j DNAT --to 10.1.1.4
iptables -t nat -A PREROUTING -p tcp --dport 9003 -i eth0 -j DNAT --to 10.1.1.5
iptables -t nat -A PREROUTING -p udp --dport 9003 -i eth0 -j DNAT --to 10.1.1.5
iptables -t nat -A PREROUTING -p tcp --dport 9004 -i eth0 -j DNAT --to 10.1.1.5
iptables -t nat -A PREROUTING -p udp --dport 9004 -i eth0 -j DNAT --to 10.1.1.5

#placa ethernet pabc
iptables -t nat -A PREROUTING -p tcp --dport 61000 -i eth0 -j DNAT --to 10.1.1.255

# liberando webmin
iptables -t nat -A PREROUTING -p tcp --dport 10000 -i eth0 -j DNAT --to 10.1.1.1

# liberando totvs
iptables -t nat -A PREROUTING -p tcp --dport 5555 -i eth0 -j DNAT --to 10.1.1.3
iptables -t nat -A PREROUTING -p tcp --dport 6666 -i eth0 -j DNAT --to 10.1.1.3
iptables -t nat -A PREROUTING -p tcp --dport 1237 -i eth0 -j DNAT --to 10.1.1.3
iptables -t nat -A PREROUTING -p tcp --dport 1247 -i eth0 -j DNAT --to 10.1.1.3
iptables -t nat -A PREROUTING -p tcp --dport 2244 -i eth0 -j DNAT --to 10.1.1.3

#bloqueio facebook
iptables -A FORWARD -i eth0 -d 10.1.1.0/24 -m string --algo bm --string "facebook.com" -j DROP #BLOQUEIA GERAL
iptables -A FORWARD -i eth0 -d 10.1.1.0/24 -m string --algo bm --string "twitter.com" -j DROP #BLOQUEIA GERAL
iptables -I FORWARD -m string --algo bm --string "facebook.com" -j DROP

joaov1tor
(usa Outra)

Enviado em 14/10/2014 - 17:27h

Alguem pode me ajudar???
A net ta caindo de 5 em 5 minutos ai tenho que usar o comando squid -k reconfigure

px
(usa Debian)

Enviado em 14/10/2014 - 18:48h

Você usa o ssh? se não alguém da outra empresa pode estar te "derrubando" para você recontrata-los...

Poste o log do squid aqui e se tiver o log do iptables

joaov1tor
(usa Outra)

Enviado em 14/10/2014 - 19:26h

Como que pego o log do iptables? E como alterou a senha do root?

joaov1tor
(usa Outra)

Enviado em 15/10/2014 - 10:48h

Alguem por favor me de uma luz, estou agora com a internet caindo de minuto em minuto. Verifiquei no gerenciador de DNS que o ip que encaminha para o servidor squid/iptables nao acha o dns e os dns do google localiza....