Mostrar Mensajes
Esta sección te permite ver todos los mensajes hechos por este usuario, recuerda que solo puedes ver los mensajes en áreas en donde tu tienes acceso.
fijate que ya formatie un disco duro en ext3 y lo eh montado en el ubuntu. hasta ahi todo ok... ahora como hago para que esquid lo reconosca, y tambien empiece a guardar cahe ahi..
cache_dir aufs /var/spool/squid/cache2 80000 16 256
pero non lo reconoce y el squid se para nno funciona
BUENAS QUIEN ME AYUDA A MONTAR EL SQUIED3.X PARA RAPTORCACHE EN DEBIAN 8.
SOLO TENGO ESTO POR DEFAULT NO CACHA LOS HTTPS.
Squid 3.x Conf #
#=====================================================================#
http_port 3128 intercept
http_port 3126
visible_hostname raptor.os
icp_port 0
#----------------------------------------------------------------------
acl google url_regex -i (googlevideo\.com|www\.youtube\.com)
acl mobile browser -i regexp (iPhone|iPad|Windows.*Phone|BlackBerry|PlayBook|Trident|IEMobile)
request_header_access User-Agent deny google !mobile
request_header_replace User-Agent Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
#----------------------------------------------------------------------
#error_directory /usr/share/squid3/errors/Spanish/
#----------------------------------------------------------------------
acl blacklist url_regex -i "/etc/squid3/blacklist.lst"
#----------------------------------------------------------------------
# Servidor DNS y Politica de Cambios
#----------------------------------------------------------------------
dns_nameservers 200.44.32.12 8.8.4.4
dns_retransmit_interval 5 seconds
dns_timeout 2 minutes
#----------------------------------------------------------------------
acl built-in proto cache_object
acl localnet src 10.0.0.0/8 # RFC 1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC 1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC 1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl CONNECT method CONNECT
acl Safe_ports port 80 # http
acl Safe_ports port 443 # https
acl SSL_ports port 443 # https
http_access deny blacklist
http_access allow localhost built-in
http_access deny built-in
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
#----------------------------------------------------------------------
coredump_dir /var/spool/squid3
include /etc/raptor/peers
cache_mgr raptor.os
shutdown_lifetime 2 seconds
half_closed_clients off
server_persistent_connections off
client_persistent_connections off
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 95
max_filedescriptors 819200
qos_flows local-hit=0x48
#----------------------------------------------------------------------
#cache deny all
#----------------------------------------------------------------------
acl sys_lst url_regex -i "/etc/raptor/sys.lst"
acl raptor_lst url_regex -i "/etc/raptor/raptor.lst"
acl wth_lst url_regex -i "/etc/raptor/whitelist.lst"
acl host_lst req_header Host -i "/etc/raptor/host.lst"
acl exts url_regex -i \.(cab|exe|msi|msu|zip|deb|rpm|bz|bz2|gz|tgz|rar|bin|7z|mp3|mp4|flv)$
acl head_html req_header Accept -i text/html.+
cache deny raptor_lst
cache_peer 192.168.10.2 parent 8080 0 proxy-only no-digest
dead_peer_timeout 2 seconds
cache_peer_access 192.168.10.2 allow host_lst
cache_peer_access 192.168.10.2 allow exts
cache_peer_access 192.168.10.2 deny head_html
cache_peer_access 192.168.10.2 deny wth_lst
cache_peer_access 192.168.10.2 allow raptor_lst
cache_peer_access 192.168.10.2 allow sys_lst
cache_peer_access 192.168.10.2 deny all
cache deny all !google !str1
#----------------------------------------------------------------------
Nunca tuve problemas con la navegación de un dia para el otro comenzó a dar el problema..
yo tengo un mikrotik, no tengo creada ningún ip tables en la configuración de host del squid.
En mi mikrotik tengo la siguiente regla.
add action=dst-nat chain=dstnat comment="Proxy Transparente" disabled=yes \
dst-port=80 in-interface=ether11 protocol=tcp src-address=!192.168.11.219 \
to-addresses=192.168.10.219 to-ports=3128
y en mi configuracion de squid.conf
http_port 192.168.10.219:3128 ignore-cc
Es Correcto?
Saludos.
y como hago para bloquear estos mismo archivos desde las paginas https
bueno me contesto y espero le sirva a los que puedan tener este problema la solucion fue agregar estas lineas a mi script firewall y aplicarlo
$IPTABLES -t nat -A POSTROUTING -s 192.168.0.0/22 -o eth0 -j MASQUERADE
lo que puedo entender de esta regla es natear a todo ese bloque que venga de la eth0 puede poner el bloque o direcciones especificas para que puedan descargar torrents y ftp
Gracias, voy a tratar de implementarlo.
En cuanto al tema de demora en devolver el resultado de las paginas, lo se te ocurre algo?
Saludos.
http_port 192.168.10.219:3128 intercept ignore-cc[justify][size=2]http_port 192.168.10.219:3128 ignore-cc[/size][/justify]
[justify][size=2]dns_nameservers 8.8.8.8 8.8.4.4[/size][/justify]
[justify][size=2]dns_v4_first on[/size][/justify]
[justify][size=2]cache_mem 320 MB[/size][/justify]
[justify][size=2]#################################[/size][/justify]
[justify][size=2]acl manager proto cache_object[/size][/justify]
[justify][size=2]acl localhost src 127.0.0.1/32 ::1[/size][/justify]
[justify][size=2]acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1[/size][/justify]
[justify][size=2]#acl redamrsalud dst 192.168.31.254/30[/size][/justify]
[justify][size=2]#################################[/size][/justify]
[justify][size=2]acl permfacebook src "/etc/squid3/listas/sifacebook.txt"[/size][/justify]
[justify][size=2]acl usr_internet src "/etc/squid3/listas/permitidos.txt"[/size][/justify]
[justify][size=2]acl super_usuarios src "/etc/squid3/listas/superusuarios.txt"[/size][/justify]
[justify][size=2]acl dominios_permitidos dstdomain "/etc/squid3/listas/dompermitidos.txt"[/size][/justify]
[justify][size=2]acl dominios_negados dstdomain "/etc/squid3/listas/domnegados.txt[/size][/justify]
[justify][size=2]acl nofacebook dstdomain .facebook.com[/size][/justify]
[justify][size=2]acl paginas_negadas url_regex -i "/etc/squid3/listas/paginasnegadas.txt"[/size][/justify]
[justify][size=2]#############PUERTOS########################[/size][/justify]
[justify][size=2]acl SSL_ports port 443[/size][/justify]
[justify][size=2]acl Safe_ports port 80 # http[/size][/justify]
[justify][size=2]acl Safe_ports port 81[/size][/justify]
[justify][size=2]acl Safe_ports port 21 # ftp[/size][/justify]
[justify][size=2]acl Safe_ports port 443 # https[/size][/justify]
[justify][size=2]acl Safe_ports port 70 # gopher[/size][/justify]
[justify][size=2]acl Safe_ports port 210 # wais[/size][/justify]
[justify][size=2]acl Safe_ports port 1025-65535 # unregistered ports[/size][/justify]
[justify][size=2]acl Safe_ports port 280 # http-mgmt[/size][/justify]
[justify][size=2]acl Safe_ports port 488 # gss-http[/size][/justify]
[justify][size=2]acl Safe_ports port 591 # filemaker[/size][/justify]
[justify][size=2]acl Safe_ports port 777 # multiling http[/size][/justify]
[justify][size=2]acl CONNECT method CONNECT[/size][/justify]
[justify][size=2]###################################[/size][/justify]
[justify][size=2]http_access allow manager localhost[/size][/justify]
[justify][size=2]http_access deny manager[/size][/justify]
[justify][size=2]http_access deny !Safe_ports[/size][/justify]
[justify][size=2]http_access deny CONNECT !SSL_ports[/size][/justify]
[justify][size=2]###################################[/size][/justify]
[justify][size=2]http_access allow localhost[/size][/justify]
[justify][size=2]#http_access allow redamrsalud[/size][/justify]
[justify][size=2]http_access deny nofacebook !permfacebook[/size][/justify]
[justify][size=2]http_access allow super_usuarios[/size][/justify]
[justify][size=2]http_access allow usr_internet !dominios_negados[/size][/justify]
[justify][size=2]http_access allow dominios_permitidos[/size][/justify]
[justify][size=2]http_access deny dominios_negados[/size][/justify]
[justify][size=2]http_access deny paginas_negadas[/size][/justify]
[justify][size=2]http_access deny all[/size][/justify]
[justify][size=2]###################################[/size][/justify]
[justify][size=2]cache_dir aufs /var/spool/squid3 40000 16 256[/size][/justify]
[justify][size=2]coredump_dir /var/spool/squid3[/size][/justify]
[justify][size=2]cache_replacement_policy heap LFUDA[/size][/justify]
[justify][size=2]minimum_object_size 10 KB[/size][/justify]
[justify][size=2]maximum_object_size 48000 KB[/size][/justify]
[justify][size=2]cache_swap_low 90[/size][/justify]
[justify][size=2]cache_swap_high 95[/size][/justify]
[justify][size=2]half_closed_clients off[/size][/justify]
[justify][size=2]cache_effective_user proxy[/size][/justify]
[justify][size=2]###################################[/size][/justify]
[justify][size=2]refresh_pattern ^ftp: 1440 20% 10080[/size][/justify]
[justify][size=2]refresh_pattern ^gopher: 1440 0% 1440[/size][/justify]
[justify][size=2]refresh_pattern Packages\.bz2$ 0 20% 4320 refresh-ims[/size][/justify]
[justify][size=2]refresh_pattern Sources\.bz2$ 0 20% 4320 refresh-ims[/size][/justify]
[justify][size=2]refresh_pattern Release\.gpg$ 0 20% 4320 refresh-ims[/size][/justify]
[justify][size=2]refresh_pattern Release$ 0 20% 4320 refresh-ims[/size][/justify]
[justify][size=2]refresh_pattern . 0 20% 4320[/size][/justify]
[justify][size=2]# Para sonido tiempo de 10 días y un máximo de 30.[/size][/justify]
[justify][size=2]refresh_pattern -i \.aiff?$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.au$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.ram?$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.snd$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.mid$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.mp2$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.mp3$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.ogg$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.wav$ 14400 80% 43200[/size][/justify]
[justify][size=2]# Para video tiempo de 10 días y un máximo de 30.[/size][/justify]
[justify][size=2]refresh_pattern -i \.mov$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.mpe?g?$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.avi$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.qtm?$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.viv$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.swf$ 14400 80% 43200[/size][/justify]
[justify][size=2]refresh_pattern -i \.flv$ 14400 80% 43200[/size][/justify]
[justify][size=2]# Para imagenes tiempo de 1 día y un máximo 3 para descargar nuevamente.[/size][/justify]
[justify][size=2]refresh_pattern -i \.gif$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.tiff?$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.bmp$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.jpe?g$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.xbm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.png$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.wrl$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.ico$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.pnm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.pbm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.pgm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.ppm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.rgb$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.ppm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.rgb$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.xpm$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.xwd$ 1440 80% 4320[/size][/justify]
[justify][size=2]refresh_pattern -i \.pict?$ 1440 80% 4320[/size][/justify]
[justify][size=2]# Para ejecutables tiempo de 10 días y un máximo 30.[/size][/justify]
[justify][size=2]refresh_pattern -i \.exe$ 14400 80% 43200[/size][/justify]
[justify][size=2]# Para las actualizaciones de Windows tiempo de 10 días y un máximo 15.[/size][/justify]
[justify][size=2]refresh_pattern -i \.cab$ 14400 80% 21600[/size][/justify]
[justify][size=2]# Para los paqutes Debian y CentOS / RedHat / Fedora 1 día mínimo y máximo.[/size][/justify]
[justify][size=2]refresh_pattern -i \.deb$ 1440 100% 1440[/size][/justify]
[justify][size=2]refresh_pattern -i \.rpm$ 1440 100% 1440[/size][/justify]
[justify][size=2]################################[/size][/justify]
[justify][size=2]logformat squid%ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt[/size][/justify]
[justify][size=2]access_log /var/log/squid3/access.log squid[/size][/justify]
[justify][size=2]cache_store_log /var/log/squid3/store.log[/size][/justify]
[justify][size=2]logfile_rotate 0[/size][/justify]
[justify][size=2]cache_log /var/log/squid3/cache.log[/size][/justify]
refresh_pattern -i .(gif|png|jp?g|ico|bmp|pict|tiff?)$ 14400 80% 43200 reload-into-ims ignore-no-store ignore-private ignore-auth refresh-ims
refresh_pattern -i .(swf|htm|html|shtm|shtml|nub)$ 14400 80% 43200 reload-into-ims ignore-no-store ignore-private ignore-auth refresh-ims refresh-ims
refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 14400 80% 43200 reload-into-ims ignore-no-store ignore-private ignore-auth refresh-ims
refresh_pattern -i .(avi|iso|wav|mid|ogg|mp?|mpe?g?|mpeg|aiff?|mov|3gp|wm?|flv|x-flv|axd)$ 14400 80% 43200 reload-into-ims ignore-no-store ignore-private ignore-auth refresh-ims
refresh_pattern -i .(qtm?|viv|au|ram?|snd|sit|hqx|arj|lzh|lha|txt|rtf|tex|latex|class|js|ico|do|dll|asf|dat|psf)$ 14400 80% 43200
refresh_pattern -i \.a[0-9][0-9]$ 14400 80% 43200
refresh_pattern -i \.r[0-9][0-9]$ 14400 80% 43200
refresh_pattern -i \.css$ 10 20% 4320
# Default
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
Esto lo comentaba estimado, y que tengo mi siguiente conf..Código: [Seleccionar]....
..
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 192.168.10.1:3128 intercept
cache_mem 500 MB
memory_pools off
memory_pools_limit 512 MB
dns_nameservers 8.8.8.8 8.8.4.4
dns_retransmit_interval 5 seconds
dns_timeout 2 minutes
ipcache_low 98
ipcache_high 99
reload_into_ims on
store_dir_select_algorithm round-robin
half_closed_clients off
server_persistent_connections off
client_persistent_connections off
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 95
cache_replacement_policy heap LFUDA
memory_replacement_policy heap LFUDA
range_offset_limit 100 MB
maximum_object_size 200 MB
minimum_object_size 0 KB
cache_dir ufs /var/spool/squid 10240 16 256
cache_swap_low 90
cache_swap_high 95
httpd_suppress_version_string on
max_filedesc 4096
forward_max_tries 25
dns_v4_first on
coredump_dir /var/spool/squid
refresh_pattern -i .(gif|png|jp?g|ico|bmp|tiff?)$ 14400 80% 43200 reload-into-ims
refresh_pattern -i .(swf|htm|html|shtm|shtml|nub)$ 14400 80% 43200 reload-into-ims
refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 14400 80% 43200
refresh_pattern -i .(avi|iso|wav|mid|mp?|mpe?g?|mpeg|mov|3gp|wm?|flv|x-flv|axd)$ 14400 80% 43200
refresh_pattern -i .(qtm?|viv|au|ram?|snd|sit|hqx|arj|lzh|lha|txt|rtf|tex|latex|class|js|ico)$ 14400 80% 43200
refresh_pattern -i \.a[0-9][0-9]$ 14400 80% 43200
refresh_pattern -i \.r[0-9][0-9]$ 14400 80% 43200
refresh_pattern -i \.css$ 10 20% 4320
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all
Y verificando el access.log, veo que NO me esta haciendo cache de la imágenes por lo menos, la mayoría (por no decir todas) de las conexiones me parecen con TCP_MISS. Tendré algo mal?
saludos !!
Lo e checado, pero veo que en l parte de configuración de Squid, ese artículo es del 2013, creo que en la versíon 3.5 debe ya haber cambiad algo, tendrás algo mas actualizado o esas configuraciones siguen funcionando?
saludos !
aja otra duda jejej como me recomendarian configurar el mikrotik con el raptor cache como parent proxy o le doy una tarjeta de red exclusiva
access_log stdio:/var/log/squid3/access.logEstimado .. en la versión squid 3.5 estas reglas aun funcionan?
Saludos ..
Excelente explicación y muy correcta, tengo una duda con respecto a este tema, si tengo un servidor dns con un webserver y mi red "local" se propaga a otras ciudades por medio de una vpn, cómo hago para que la subred de mis otras ciudades también resuelva mediante mi dns?
Espero haber sido claro..