Moesli
02.05.06, 10:14
ich möchte gerne ipcop in der dmz betreiben,..
jetzt hab ich 2 nics eingebaut und wie folgt konfiguriert:
NIC1 - Green
10.10.10.166
255.255.255.0
NIC2 - RED
10.10.10.4
255.255.255.0
10.10.10.254
beim versuch auf den zugriff zum www spuckt die access.log wie folgt aus:
TCP_MISS/503 1388 GET http://www.yahoo.de/favicon.ico - NONE/- text/html
shutdown_lifetime 5 seconds
icp_port 0
http_port 10.10.10.166:8080
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_effective_user squid
cache_effective_group squid
pid_filename /var/run/squid.pid
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log none
log_mime_hdrs off
forwarded_for off
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 800 # Squids port (for icons)
acl IPCop_http port 81
acl IPCop_https port 445
acl IPCop_ips dst 10.10.10.166
acl IPCop_networks src 10.10.10.0/255.255.255.0
#acl IPCop_networks src 10.10.10.0/255.255.255.0
acl CONNECT method CONNECT
##Access to squid:
#local machine, no restriction
http_access allow localhost
#GUI admin if local machine connects
http_access allow all
http_access allow IPCop_ips IPCop_networks IPCop_http
http_access allow CONNECT IPCop_ips IPCop_networks IPCop_https
#Deny not web services
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
#Finally allow IPCop_networks clients
http_access allow IPCop_networks
http_access deny all
maximum_object_size 4096 KB
minimum_object_size 0 KB
cache_mem 2000 KB
cache_dir aufs /var/log/cache 50 16 256
request_body_max_size 0 KB
reply_body_max_size 0 allow all
visible_hostname gw.domain
was muss ich ändern damit es funkt ?
mfg - moesli
jetzt hab ich 2 nics eingebaut und wie folgt konfiguriert:
NIC1 - Green
10.10.10.166
255.255.255.0
NIC2 - RED
10.10.10.4
255.255.255.0
10.10.10.254
beim versuch auf den zugriff zum www spuckt die access.log wie folgt aus:
TCP_MISS/503 1388 GET http://www.yahoo.de/favicon.ico - NONE/- text/html
shutdown_lifetime 5 seconds
icp_port 0
http_port 10.10.10.166:8080
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_effective_user squid
cache_effective_group squid
pid_filename /var/run/squid.pid
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log none
log_mime_hdrs off
forwarded_for off
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 800 # Squids port (for icons)
acl IPCop_http port 81
acl IPCop_https port 445
acl IPCop_ips dst 10.10.10.166
acl IPCop_networks src 10.10.10.0/255.255.255.0
#acl IPCop_networks src 10.10.10.0/255.255.255.0
acl CONNECT method CONNECT
##Access to squid:
#local machine, no restriction
http_access allow localhost
#GUI admin if local machine connects
http_access allow all
http_access allow IPCop_ips IPCop_networks IPCop_http
http_access allow CONNECT IPCop_ips IPCop_networks IPCop_https
#Deny not web services
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
#Finally allow IPCop_networks clients
http_access allow IPCop_networks
http_access deny all
maximum_object_size 4096 KB
minimum_object_size 0 KB
cache_mem 2000 KB
cache_dir aufs /var/log/cache 50 16 256
request_body_max_size 0 KB
reply_body_max_size 0 allow all
visible_hostname gw.domain
was muss ich ändern damit es funkt ?
mfg - moesli