Salve Salve Galera!!!!
Seguinte, to com um problema em uma das empresas que dou suporte. Tem um
software que faz envio de pedidos de revelação de Fotos, já fiz todas as
liberações no firewall mas o mesmo continua dando erro:
Segue abaixo o meu firewall, squid e o tcpdump.
FIREWALL
#!/bin/bash
# Modulos de Compartilhamento da Conexão
/sbin/modprobe ip_nat_amanda
/sbin/modprobe ip_nat_h323
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_sip
/sbin/modprobe ip_nat_tftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ip_nat_pptp
/sbin/modprobe ip_nat_snmp_basic
/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack_ftp
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
INTERNET="ppp0"
REDELOCAL="eth1"
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#Regras de nat para Servicos Convide Eventos
iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d alphaeditora.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d redenetworks.net.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d convideeventos.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d hayangroup.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d zyoncore.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d servidor01.zyoncore.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d locaweb.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d xxxdnn1252.locaweb.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d cabald.sites.uol.com.br -j MASQUERADE
iptables -t nat -I POSTROUTING -d webgeral.com -j MASQUERADE
iptables -t nat -I POSTROUTING -d ns1.webgeral.com -j MASQUERADE
iptables -t nat -I POSTROUTING -d ns2.webgeral.com -j MASQUERADE
iptables -t nat -I POSTROUTING -d akamai.com -j MASQUERADE
iptables -t nat -I POSTROUTING -d 189.1.162.21 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 186.202.10.40 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 189.1.161.55 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 189.1.161.50 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.45.247.66 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.17.68.200 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.61.11.122 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.0.211.215 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 187.45.202.30 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.219.246.7 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 189.126.119.93 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 189.126.116.18 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.223 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.224 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.225 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.226 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.227 -j MASQUERADE
iptables -t nat -I POSTROUTING -d 200.140.198.228 -j MASQUERADE
#Regra de bloqueio ao acesso externo do proxy
iptables -A INPUT -p tcp -i $INTERNET -m multiport --destination-port 3128
-j DROP
#Porta SSL
iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE
#TEAMVIEWER
iptables -t nat -I POSTROUTING -p tcp --dport 5930 -j MASQUERADE
#FTP
iptables -t nat -I POSTROUTING -p tcp --dport 21 -j MASQUERADE
#SQUID redirect
iptables -t nat -A PREROUTING -p tcp -i $REDELOCAL --dport 80 -j REDIRECT
--to-port 3128
SQUID
http_port 3128 transparent
visible_hostname cache-convide
error_directory /usr/share/squid/errors/Portuguese
cache_access_log /var/log/squid/access.log
cache_dir ufs /var/spool/squid 80240 32 512
maximum_object_size 512 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
dns_nameservers 208.67.222.222
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 21 80 443 563 70 210 280 488 59 777 901 1025-65535
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl NOCACHE url_regex 192.168.0.1 \?
no_cache deny NOCACHE
# ACLs
acl redelocal src 192.168.0.0/24
acl manha time 06:00-08:00
acl noite time 19:00-20:00
acl almoco time 12:00-14:00
#ACLs para permissao de acesso
acl acesso_ouro src "/etc/squid/ips_ouro.txt"
acl acesso_prata src "/etc/squid/ips_prata.txt"
acl acesso_bronze src "/etc/squid/ips_bronze.txt"
#ACLs sites liberados
acl sites_bronze url_regex "/etc/squid/sites_bronze.txt"
acl sites_prata url_regex "/etc/squid/sites_prata.txt"
#Execucao das ACLS
#Libera o acesso aos sites liberados
http_access allow sites_bronze
http_access allow sites_prata
#Primeiro nivel de acesso a internet
http_access allow acesso_ouro
#Segundo nivel de acesso a internet
http_access allow manha
http_access allow noite
http_access allow almoco
#Segundo nivel de bloqueio
http_access deny redelocal
#Terceiro nivel de bloqueio
http_access deny all
TCPDUMP
12:25:01.491009 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [S], seq
2717378554, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length
0
12:25:01.491039 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [S.], seq
2083647526, ack 2717378555, win 5840, options [mss
1460,nop,nop,sackOK,nop,wscale 7], length 0
12:25:01.491205 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], ack
1, win 16425, length 0
12:25:01.492790 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], seq
1:325, ack 1, win 16425, length 324
12:25:01.492808 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], ack
325, win 54, length 0
12:25:01.493040 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [P.], seq
325:756, ack 1, win 16425, length 431
12:25:01.493055 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], ack
756, win 63, length 0
12:25:01.697631 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], seq
1:408, ack 756, win 63, length 407
12:25:01.697655 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [.], seq
408:1868, ack 756, win 63, length 1460
12:25:01.697666 IP 200.140.198.224.80 > 192.168.0.29.51763: Flags [P.], seq
1868:1919, ack 756, win 63, length 51
12:25:01.698248 IP 192.168.0.29.51763 > 200.140.198.224.80: Flags [.], ack
1919, win 16425, length 0
12:25:01.891401 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [S], seq
1498805634, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length
0
12:25:01.891423 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [S.], seq
2101414921, ack 1498805635, win 5840, options [mss
1460,nop,nop,sackOK,nop,wscale 7], length 0
12:25:01.891642 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack
1, win 16425, length 0
12:25:01.892585 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], seq
1:332, ack 1, win 16425, length 331
12:25:01.892602 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], ack
332, win 54, length 0
12:25:01.892841 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [P.], seq
332:734, ack 1, win 16425, length 402
12:25:01.892856 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [.], ack
734, win 63, length 0
12:25:02.087377 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq
1:408, ack 734, win 63, length 407
12:25:02.087397 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq
408:1570, ack 734, win 63, length 1162
12:25:02.087657 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq
1570:2153, ack 734, win 63, length 583
12:25:02.087884 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack
1570, win 16425, length 0
12:25:02.210895 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [S], seq
598358245, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length
0
12:25:02.210917 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [S.], seq
2090396113, ack 598358246, win 5840, options [mss
1460,nop,nop,sackOK,nop,wscale 7], length 0
12:25:02.211131 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [.], ack 1,
win 16425, length 0
12:25:02.211807 IP 192.168.0.29.51765 > 187.45.202.30.80: Flags [P.], seq
1:714, ack 1, win 16425, length 713
12:25:02.211825 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [.], ack
714, win 57, length 0
12:25:02.289333 IP 200.140.198.224.80 > 192.168.0.29.51764: Flags [P.], seq
1570:2153, ack 734, win 63, length 583
12:25:02.289753 IP 192.168.0.29.51764 > 200.140.198.224.80: Flags [.], ack
2153, win 16279, options [nop,nop,sack 1 {1570:2153}], length 0
12:25:02.369489 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq
1:385, ack 714, win 57, length 384
12:25:02.369509 IP 187.45.202.30.80 > 192.168.0.29.51765: Flags [P.], seq
385:1511, ack 714, win 57, length 1126
Galera nao coloquei o log do tcpdump todo porque era muito extenso e
repetitivo.
Rodrigo Lira
Coordenador de Suporte Técnico
Rede GigaNet
(83) 3021-5430 / 8754-5490 / 9906-2552
Msn: [email protected]
Skype: rbl1984
------------------------------------------
--
GUS-BR - Grupo de Usuários de Slackware Brasil
http://www.slackwarebrasil.org/
http://groups.google.com/group/slack-users-br
Antes de perguntar:
http://www.istf.com.br/perguntas/
Para sair da lista envie um e-mail para:
[email protected]
