liberar portas servidor squid(Resolvido)

mgottfried · 10 de Maio de 2012, 17:27

estou com o seguinte problema:
instalei um servidor squid em uma rede da seguinte forma:
adsl -> squid eth1 + eth0-> server2008 e rede local
ja liberei a porta 3389 do adsl para eth1 192.168.254.10 onde entra o sinal de internet para a rede , como faço para liberar esta porta para o ip do server2008 = 192.168.1.100.
a eth0 do servidor squid é ip 192.168.1.1.

zekkerj · 10 de Maio de 2012, 21:42

iptables -t nat -A PREROUTING -p tcp --dport ~~3128~~ 3389 -j DNAT --to 192.168.1.100:3389
iptables -A FORWARD -p tcp -d 192.168.1.100 --dport 3389 -j ACCEPT

mgottfried · 10 de Maio de 2012, 22:56

rejeitou a conexão

zekkerj · 10 de Maio de 2012, 23:32

Essas regras têm que ser encaixadas no seu firewall --- se é que vc tem um.

mgottfried · 11 de Maio de 2012, 10:56

coloquei as regras no final mas ainda continuo sem acesso.

#! /bin/bash
echo " INICIANDO FIREWALL "
# Ativa modulos

/sbin/modprobe iptable_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
echo "Carga dos Modulos OK!"
# Zera regras

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -F -t nat
/sbin/iptables -X -t nat
/sbin/iptables -F -t mangle
/sbin/iptables -X -t mangle
echo "Flush das regras OK!"
# Proxy Transparente

# Nessa linha iremos mascarar os pacotes de saída para internet.

/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# Nessa regra iremos redirecionar todo tráfego da porta 80 da eth0 para a porta 3128 do squid.
/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Carga do Proxy Transparente OK!"
# Nesta Regra Bloqueio do MSN
/sbin/iptables -A FORWARD -s 192.168.1.0 -p tcp --dport 1863 -j REJECT
/sbin/iptables -A FORWARD -s loginnet.passport.com -j REJECT

iptables -t nat -A PREROUTING -p tcp --dport 3128 -j DNAT --to 192.168.1.100:3389
iptables -A FORWARD -p tcp -d 192.168.1.100 --dport 3389 -j ACCEPT

zekkerj · 11 de Maio de 2012, 12:00

Erro meu: coloquei "--dport 3128", deveria ser "--dport 3389". Já corrigi lá em cima.

mgottfried · 11 de Maio de 2012, 23:19

ainda continua negando acesso , na rede interna o server2008 esta recebendo TS.

zekkerj · 11 de Maio de 2012, 23:30

Vc observou se o primeiro redirecionamento está funcionando?

mgottfried · 12 de Maio de 2012, 09:21

o proxy esta direcionado para a porta 3128.

mgottfried · 12 de Maio de 2012, 09:30

#iptables -A INPUT -p tcp –destination-port 3389 -j ACCEPT

#iptables -t nat -A PREROUTING -i eth1 -p tcp –dport 3389 -j DNAT –to-destination 192.168.0.100:3389

#iptables -A FORWARD -p tcp -i eth1 –dport -d 192.168.0.100 -j ACCEPT

coloquei esta regra mas volta o erro

INICIANDO FIREWALL
Carga dos Modulos OK!
Flush das regras OK!
Bad argument `3389'
Try `iptables -h' or 'iptables --help' for more information.
Bad argument `3389'
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.4.4: multiple -d flags not allowed
Try `iptables -h' or 'iptables --help' for more information.
Carga do Proxy Transparente OK!

mgottfried · 12 de Maio de 2012, 17:16

sudo tail -f /var/log/kern.log
May 12 20:14:45 squid kernel: [21556.127094] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=100 TOS=0x10 PREC=0x00 TTL=60 ID=52014 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK PSH URGP=0
May 12 20:14:46 squid kernel: [21556.232753] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52015 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:49 squid kernel: [21559.896136] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=100 TOS=0x10 PREC=0x00 TTL=60 ID=52016 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK PSH URGP=0
May 12 20:14:49 squid kernel: [21559.988521] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52017 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:50 squid kernel: [21560.540846] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=100 TOS=0x10 PREC=0x00 TTL=60 ID=52018 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK PSH URGP=0
May 12 20:14:50 squid kernel: [21560.565304] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52019 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:50 squid kernel: [21560.646300] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=100 TOS=0x10 PREC=0x00 TTL=60 ID=52020 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK PSH URGP=0
May 12 20:14:50 squid kernel: [21560.769887] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52021 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:50 squid kernel: [21560.771615] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52022 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:51 squid kernel: [21561.663786] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=100 TOS=0x10 PREC=0x00 TTL=60 ID=52023 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK PSH URGP=0
May 12 20:14:51 squid kernel: [21561.734711] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52024 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0
May 12 20:14:51 squid kernel: [21561.741350] IN=eth1 OUT= MAC=00:10:4b:68:05:24:00:15:6d:5f:6a:22:08:00 SRC=177.18.122.129 DST=192.168.254.10 LEN=52 TOS=0x10 PREC=0x00 TTL=60 ID=52025 DF PROTO=TCP SPT=57175 DPT=22 WINDOW=1002 RES=0x00 ACK URGP=0