Internet lenta nas estações - squid vs iptables

[pauloleoni]

Olá, tenho no meu server os seguintes pacoes instalados:

dhcp
bind
apache
webmin
ssh
squid
iptables

tenho cerca de 70 micros na rede, tenho bloqueio de sites no squid e tenho o iptables setado, liberando pop, smtp e mais o basico, e bloqueando todo o resto.

A internet nas estações estão demasiadamente lentas,e eu gostaria de saber se nas minha regras existe alguma coisa que esteja causando isso, talvez um conflito entre regras do squid com o iptables.

abaixo meu squid.conf

#porta padrão
http_port 10.24.4.203:3128 transparent
visible_hostname SEMED
hierarchy_stoplist cgi-bin ?
cache_mem 512 MB
maximum_object_size_in_memory 1024 KB
maximum_object_size 1024 KB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 10000 16 256
cache_access_log /var/log/squid/access.log
refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern www.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims

#error_directory /usr/share/squid/errors/english
ftp_user Squid@

#ACLS
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80                    # http
#acl Safe_ports port 21                    # ftp
#acl Safe_ports port 443 563               # https, snews
#acl Safe_ports port 10000                #webmin
#acl Safe_ports port 70                    # gopher
#acl Safe_ports port 210                   # wais
#acl Safe_ports port 1025-65535          # unregistered ports
#acl Safe_ports port 280                   # http-mgmt
#acl Safe_ports port 488                   # gss-http
#acl Safe_ports port 591                   # filemaker
#acl Safe_ports port 777                   # multiling http
#acl Safe_ports port 25                    # smtp
#acl Safe_ports port 110                   # pop3

##########################  DECLARANDO AS ACLs  #############################


# PCs com acesso total
acl acesso_total src "/etc/squid/confs/acesso_total"
http_access allow acesso_total

##lista de liberados
##acl liberado url_regex -i "/etc/squid/confs/liberado"

#bloqueio do MSN
acl msn dst 207.46.110.0/24 207.46.104.0/24 64.4.13.0/24
http_access deny msn
acl bloqmessenger url_regex www.e-messenger.net webmessenger.msn.com
http_access deny bloqmessenger

##lista de liberados
#acl liberado url_regex -i "/etc/squid/confs/liberado

# extensões de arquivos bloqueados
acl download url_regex -i "/etc/squid/confs/download"

#lista de bloqueios
acl bloqueado url_regex -i "/etc/squid/confs/bloqueado"

#lista de liberados
##acl liberado url_regex -i "/etc/squid/confs/liberado"


############################# ATIVANDO AS ACLs  ################################
acl redelocal src 10.24.4.0/24
http_access deny bloqueado
http_access allow all


##acl redelocal src 10.24.4.0/24
http_access deny download
#acl acesso_bloqueado src "/etc/squid/confs/acesso_bloqueado"
#http_access deny acesso_bloqueado
#http_access allow liberado
#acl acesso_bloqueado src "/etc/squid/confs/acesso_bloqueado"
##http_access deny bloqueado
http_access allow redelocal !msn

abaixo meu /etc/rc.local

sudo vi /etc/rc.local

#!/bin/bash

## limpa as tabelas das regras, nada a ser mudado aqui
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t filter -F
iptables -t filter -X
iptables -t mangle -F
iptables -t mangle -X

# habilita internet para os usuáos cadastrados
#sh /etc/nat/users.sh

# Marcacao de pacotes para controle de banda. Mude a faixa de IPs de acordo com a sua
#for i in `seq 2 254`
#do
#iptables -t mangle -A POSTROUTING -s 10.24.4.$i -j MARK --set-mark $i
#done

#############  Habilita roteamento ##################
###modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Habilita PROXY TRANSPARENTE
# mude a interface rede se eth1 nãfor a interface conectada ao wireless
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128


# Abre uma porta (inclusive para a Internet). Neste caso apenas deixamos aberto o acesso para SSH, Proxy e DNS.

iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 3128 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 443 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 10000 -j ACCEPT
iptables -A FORWARD -p tcp --sport 10000 -j ACCEPT
# Proteçs diversas contra portscanners, ping of death, ataques DoS, etc.
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j DROP
iptables -A FORWARD -p tcp -m limit --limit 1/s -j  ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A FORWARD -m unclean -j DROP

# Abre para a interface de loopback.
iptables -A INPUT -i lo -j ACCEPT

# BLOQUEA O QUE NAO SE ENCAIXA NAS REGRAS ACIMA
iptables -A INPUT -p tcp --syn -j DROP
iptables -P FORWARD DROP

## FIM DO ARQUIVO ##

exit 0

Alguem tem alguma sugestão??