Como fazer bloqueios em rede.. sites, msn, etc..

[sleite]

Estou precisando bloquear alguns sites que o pessoal da minha rede vem frequentando. A rede e contituida de IP FIXO e gostaria de montar algo assim:

- ip 222.222.222.001 fosse bloqueado de msn, orkut, hotmail;
- ip 222.222.222.002 fosse bloqueado tudo;
- ip 222.222.222.003 fosse tudo liberado;

Como faço isso no Ubuntu 7.10 desktop?


Obrigado.

[arqueiro]

Use o squid no servidor.  Acesse o site abaixo para ver mais detalhes.

http://www.squid-cache.org.br/

[Fernando Henrique]

kara to mando meu script q eu estow usando ele recentemente e para instala e so seguir isto

aptitude -y install squid aphace2 php5 bind sarg iptables

ele c localiza dentro do /etc/squid
dentro delas vc vai ter q criar as seguintes pasta
/etc/squid/bloqueios/
/etc/squid/acessos/


segue o script espero q tenha ajudado



################################################
#####          Porta, Nome e Cahce         #####
################################################
#
http_port 3128
visible_hostname (nome da sua empresa )
#
cache_mem 810 MB
maximum_object_size_in_memory 64 KB
maximum_object_size 800 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
#
################################################
####  SITES QUE NAO VAO PASSAR PELO CACHA   ####
################################################
#
#acl NOCACHE url_regex -i "/etc/squid/nocache/nocache"
#no_cache deny NOCACHE
#
################################################
#####                  Log                 #####
################################################
#
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_dir ufs /var/spool/squid 20000 16 256
cache_dir ufs /var/spool/squid 20000 16 256
#cache_mgr infortec@brturbo.com.br
#
################################################
#####                 ACL´s                #####
################################################
#
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 843 # snews
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # portas altas
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # multiling http
acl Safe_ports port 873 # multiling http
acl Safe_ports port 901 # swat
acl purge method PURGE
acl CONNECT method CONNECT
#
################################################
#####           Direitos de Acessos        #####
################################################
#
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !Safe_ports
#
#####################################################
##              USANDO NCSA_AUTH                   ##
#####################################################
#
auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
auth_param basic realm Servidor de internet da Infortec :} . Entre com seu usuario e Senha.
#auth_param basic children 5
#
#####################################################
##                 AUTENTICACAO                   ##
#####################################################
#
acl password proxy_auth REQUIRED
#
#####################################################
##               BLOQUEAR PALAVRAS                 ##
#####################################################
#
acl acesso_full proxy_auth "/etc/squid/acessos/acesso_full"
acl bloquear_palavras url_regex -i "/etc/squid/bloqueios/bloquear_palavras"
#deny_info bloquear_palavras
#
#####################################################
##              BLOQUEIA O MESSENGER               ##
#####################################################
#
acl bloquear_msn dstdomain "/etc/squid/bloqueios/bloquear_msn"
acl acesso_msn proxy_auth "/etc/squid/acessos/acesso_msn"
http_access allow acesso_msn bloquear_msn
http_access deny bloquear_msn
#deny_info bloquear_msn
#
#####################################################
##                BLOQUEIA ORKUT                   ##
#####################################################
#
acl bloquear_orkut url_regex -i "/etc/squid/bloqueios/bloquear_orkut"
acl acesso_orkut proxy_auth "/etc/squid/acessos/acesso_orkut"
http_access allow acesso_orkut bloquear_orkut
http_access deny bloquear_orkut
#deny_info bloquear_orkut
#
#####################################################
##             BLOQUEIA GOOGLE TALK                ##
#####################################################
#
acl bloquear_googletalk url_regex -i "/etc/squid/bloqueios/bloquear_googletalk"
acl acesso_googletalk proxy_auth "/etc/squid/acessos/acesso_googletalk"
http_access allow acesso_googletalk bloquear_googletalk
http_access deny bloquear_googletalk
#deny_info bloquear_googletalk
# 
#####################################################
##               BLOQUEIA DOWNLOADS                ##
#####################################################
#
acl bloquear_downloads url_regex -i "/etc/squid/bloqueios/bloquear_downloads"
acl acesso_downloads proxy_auth "/etc/squid/acessos/acesso_downloads"
http_access allow acesso_downloads bloquear_downloads
http_access deny bloquear_downloads
#deny_info bloquear_downloads
#
#####################################################
##                BLOQUEIA VIDEOS                  ##
#####################################################
#
acl bloquear_videos url_regex -i "/etc/squid/bloqueios/bloquear_videos"
acl acesso_videos proxy_auth "/etc/squid/acessos/acesso_videos"
http_access allow acesso_videos bloquear_videos
http_access deny bloquear_videos
#deny_info bloquear_videos
#
#####################################################
##       BLOQUEAR TUDO E LIBERAR ALGUNS            ##
#####################################################
#
acl sitesliberados dstdomain "/etc/squid/acessos/sitesliberados"
acl ips_bloqueados src "/etc/squid/bloqueios/ips_bloqueados"
http_access deny ips_bloqueados !sitesliberados
#
#deny_info sitesliberados
#
#####################################################
##                 BLOQUEIA BLOG                   ##
#####################################################
#
acl bloquear_blog url_regex -i "/etc/squid/bloqueios/bloquear_blog"
acl acesso_blog proxy_auth "/etc/squid/acessos/acesso_blog"
http_access allow acesso_blog bloquear_blog
http_access deny bloquear_blog
#deny_info bloquear_blog
#
#####################################################
##              CONTROLE DE BANDA                  ##
#####################################################
#
#acl livre proxy_auth "/etc/squid/acessos/acesso_banda"
#acl block src 10.1.1.0/255.0.0.0
#delay_pools 2
#
# Classe 1 - Acesso a Internet a 500k
#
#delay_class 1 2
#delay_parameters 1 -1/-1 -1/-1
#delay_parameters 1 -1/-1 -1/-1
#delay_parameters 1 -1/-1 45500/45500
#delay_parameters 1 -1/-1 72500/72500
#
# Classe 2 - Acesso a Internet a 300k
#
#delay_class 2 2
#delay_parameters 2 -1/-1 6250/6250
#delay_parameters 2 -1/-1 37500/37500
#delay_access 1 allow livre
#delay_access 2 allow block
#
http_access allow password acesso_full
http_access allow acesso_full bloquear_palavras
http_access deny bloquear_palavras
#
acl redelocal src 192.168.0.0/255.255.255.0
http_access allow localhost
http_access allow redelocal
#
http_access deny all
#
################################################
#####     Configurando a Pagina de Erro    #####
################################################
#
error_directory /usr/share/squid/errors/Portuguese/
coredump_dir /var/cache/squid
#
################################################
#####                The End               #####
################################################

[giant_trunade]

Fernando henrique muito obrigado pelo conf... muito massa mesmo...

de acordo com sua tag http_port 3128 ele nao está como proxy transparente né? vc esta conseguindo usar https nele? caso sim, como fez? e se eu puder abusar, estou com um transparente, como faco para funcionar https nele??

to me fu aqui por isso, a empresa nao consegue acessar webmail e outros por isso..

desde já agradeço muito a ajuda.

caso queira, seguem alguns posts das dificuldades que passei..

eu ainda estou alterando os confs, caso queira ver as versões mais recentes é so pedir.

http://ubuntuforum-pt.org/index.php/topic,52261.0.html

http://ubuntuforum-pt.org/index.php/topic,53901.0.html

http://ubuntuforum-pt.org/index.php/topic,39623.0.html

(OBS.: os topicos nao sao todos meus suasiuiuasusah )