WCCP Squid

dvladimir
(usa Suse)

Enviado em 29/03/2012 - 06:42h

Aos expert em linux (principalmente iptables) queria uma orientação no sentido de saber se estou certo ou preciso de ajustes.
Estou implementando o protocolo <WCCP> (Web Cache Control Protocol. Bom, configurei meu router, tá funcionando para essa finalidade, meu problema é no squid (versão 2.7) que roda num server Suse. Eu recebo os pacotes (RX), mas não envia(TX).

1) interface criada:
mirage:/etc/sysconfig/network # cat ifcfg-gre0
DEVICE='wccp0'
STARTMODE='onboot'
BOOTPROTO='static'
TYPE='gre'
TUNNEL='gre'
TUNNEL_LOCAL_IPADDR='172.16.250.5' // IP do squid
TUNNEL_REMOTE_IPADDR='172.16.250.1' // IP do Router
NETMASK='255.255.255.240'
IPADDR='127.0.0.2'
TUNNEL_TTL='64'
USERCONTROL='no'
DEVICETYPE='tunnel'

2) Percebe-se a placa recebendo os pacotes
mirage:/etc # ifconfig gre0
gre0 Link encap:Não Especificado Endereço de HW 00-00-00-00-00-00-89-9A-00-00-00-00-00-00-00-00
inet end.: 127.0.0.2 Masc:255.255.255.240
UP RUNNING NOARP PROMISC MTU:1476 Métrica:1
RX packets:3030 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:153512 (149.9 Kb) TX bytes:0 (0.0 b)

3) Dump dos pacotes
mirage:/etc # tcpdump -nn -i gre0|more
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on gre0, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
12:44:33.995109 IP 172.16.40.5.65305 > 65.126.84.32.80: Flags [S], seq 740503515
, win 8192, options [mss 1260,nop,wscale 2,nop,nop,sackOK], length 0
12:44:36.999785 IP 172.16.40.5.65305 > 65.126.84.32.80: Flags [S], seq 740503515
, win 8192, options [mss 1260,nop,wscale 2,nop,nop,sackOK], length 0

4) Parando squid
mirage:/etc/sysconfig/network # rcsquid stop
Shutting down WWW-proxy squid - wait a minute or two... .............done

5)Configuração rp_filter e ip_forwarding/redirect pacotes para squid
mirage:/etc/sysconfig/network # echo 0 >/proc/sys/net//ipv4/conf/gre0/rp_filter mirage:/etc/sysconfig/network # echo 0 >/proc/sys/net//ipv4/conf/eth1/rp_filter mirage:/etc/sysconfig/network # echo 1 >/proc/sys/net//ipv4/ip_forward mirage:/etc/sysconfig/network # ipt
iptables iptables-multi iptables-xml
iptables-apply iptables-restore iptc
iptables-batch iptables-save iptunnel
mirage:/etc/sysconfig/network # iptables -t nat -A PREROUTING -i gre0 -p tcp --dport 80 -j REDIRECT --to-port 8080
mirage:/etc/sysconfig/network # iptables -t nat -A POSTROUTING -j MASQUERADE
mirage:/etc/sysconfig/network # iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 313 packets, 20357 bytes)
pkts bytes target prot opt in out source destination
0 0 REDIRECT tcp -- gre0 any anywhere anywhere tcp dpt:http redir ports 8080

Chain INPUT (policy ACCEPT 295 packets, 18704 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any any anywhere anywhere

6) Inicializando Squid
mirage:/etc/sysconfig/network # rcsquid start
Starting WWW-proxy squid done

7) Analisando iptables
mirage:/etc/sysconfig/network # iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 619 packets, 41646 bytes)
pkts bytes target prot opt in out source destination
2 104 REDIRECT tcp -- gre0 any anywhere anywhere tcp dpt:http redir ports 8080

Chain INPUT (policy ACCEPT 525 packets, 33040 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 54 packets, 3351 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
54 3351 MASQUERADE all -- any any anywhere anywhere
mirage:/etc/sysconfig/network #

Falta alguma regra no iptables? Aonde preciso corrigir?

Forte abraço,
Vladimir