Всем здравствуйте.
Тема избитая все логично и понятно но не получается прикрутить прозрачный прокси.
Интернет раздает через прокси или натом. Попробовал прикрутить прозрачный прокси,
браузер думает и говорит страница недоступна.
freebsd 9.2 squid 3.3.11
#!/bin/sh
cmd="ipfw -q add"
skip="skipto 500"
pif="em0"
ks="keep-state"
good_tcpo="80"
goodip="10.0.0.0/24{1-250}"
ipfw -q -f flush
ipfw -f pipe flush################################################################################
$cmd 100 allow all from $goodip to any via xl0
$cmd 110 allow all from any to any via lo0
#################################################################################
#
#Transparent Squid
#$cmd 150 fwd 127.0.0.1,3129 tcp from $goodip to any 80 out via $pif
#
#NAT IN
$cmd 200 divert natd ip from any to any in via $pif
$cmd 210 check-state
#################################################################################
#out
#################################################################################
#dns for LAN
$cmd 300 $skip udp from any to any 53 out via $pif $ks
$cmd 310 $skip tcp from any to any 53 out via $pif setup $ks
#DNS for Server
$cmd 300 allow udp from any to any 53 out via $pif $ks
$cmd 310 allow tcp from any to any 53 out via $pif setup $ks
#internet for LAN
$cmd 320 $skip tcp from $goodip to any $good_tcpo out via $pif setup $ks
#Internet for SERVER
$cmd 340 allow all from me to any out via $pif setup $ks
###############################################################################
#in
################################################################################
#ssh in
$cmd 410 allow tcp from any to me 22 in via $pif setup limit src-addr 2
$cmd 499 deny log all from any to any
#NAT OUT
$cmd 500 divert natd ip from any to any out via $pif
$cmd 510 allow ip from any to any
$cmd 999 deny log all from any to any
rc.conf
hostname="gate.domain.local"
ifconfig_em0=" inet xx netmask 255.255.255.0"
ifconfig_xl0=" inet 10.0.0.1 netmask 255.255.255.0"
ifconfig_rl0=" inet xx netmask 255.255.255.0"
defaultrouter="xx"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"
#
gateway_enable="YES"
natd_enable="YES"
natd_interface="em0"
natd_flags="-dynamic -m"
named_enable="YES"
firewall_enable="YES"
firewall_script="/etc/firewall.conf"
firewall_logging="YES"
dummynet_enable="YES"
#
squid_enable="YES"
#VI
clear_tmp_enable="YES"
#
rinetd_enable="YES"
squid.conf
acl localnet src 10.0.0.0/24 # RFC1918 possible internal network
acl localnet src 127.0.0.1/32
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
acl deny_domains dstdomain "/usr/local/etc/squid/deny_domains"
http_access deny deny_domains
#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 10.0.0.1:3128
http_port 127.0.0.1:3129 intercept
#connect_timeout 20 second
#forwarded_for off
#cache deny all
# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/squid/cache/squid 100000 64 512
maximum_object_size 100240 KB
# Leave coredumps in the first cache dir
coredump_dir /var/squid/cache/squid
access_log /var/log/squid/access.log
лог кэш сквида, в аксцесе логи ничего про подключения с браузера нет
2014/04/23 20:57:53 kid1| Initializing IP Cache...
2014/04/23 20:57:53 kid1| DNS Socket created at 0.0.0.0, FD 7
2014/04/23 20:57:53 kid1| Adding nameserver xxxx from /etc/resolv.conf
2014/04/23 20:57:53 kid1| Adding nameserver xxxx from /etc/resolv.conf
2014/04/23 20:57:53 kid1| Logfile: opening log /var/log/squid/access.log
2014/04/23 20:57:53 kid1| WARNING: log parameters now start with a module name. Use 'stdio:/var/log/squid/access.log'
2014/04/23 20:57:53 kid1| WARNING: no_suid: setuid(0): (1) Operation not permitted
2014/04/23 20:57:53 kid1| Unlinkd pipe opened on FD 12
2014/04/23 20:57:53 kid1| Store logging disabled
2014/04/23 20:57:53 kid1| Swap maxSize 102400000 + 262144 KB, estimated 7897088 objects
2014/04/23 20:57:53 kid1| Target number of buckets: 394854
2014/04/23 20:57:53 kid1| Using 524288 Store buckets
2014/04/23 20:57:53 kid1| Max Mem size: 262144 KB
2014/04/23 20:57:53 kid1| Max Swap size: 102400000 KB
2014/04/23 20:57:53 kid1| Rebuilding storage in /var/squid/cache/squid (clean log)
2014/04/23 20:57:53 kid1| Using Least Load store dir selection
2014/04/23 20:57:53 kid1| Set Current Directory to /var/squid/cache/squid
2014/04/23 20:57:53 kid1| Loaded Icons.
2014/04/23 20:57:53 kid1| HTCP Disabled.
2014/04/23 20:57:53 kid1| Squid plugin modules loaded: 0
2014/04/23 20:57:53 kid1| Accepting HTTP Socket connections at local=10.0.0.1:3128 remote=[::] FD 15 flags=9
2014/04/23 20:57:53 kid1| Accepting NAT intercepted HTTP Socket connections at local=127.0.0.1:3129 remote=[::] FD 17 flags=41
2014/04/23 20:57:53 kid1| Done reading /var/squid/cache/squid swaplog (1282 entries)
2014/04/23 20:57:53 kid1| Finished rebuilding storage from disk.
2014/04/23 20:57:53 kid1| 1282 Entries scanned
2014/04/23 20:57:53 kid1| 0 Invalid entries.
2014/04/23 20:57:53 kid1| 0 With invalid flags.
2014/04/23 20:57:53 kid1| 1282 Objects loaded.
2014/04/23 20:57:53 kid1| 0 Objects expired.
2014/04/23 20:57:53 kid1| 0 Objects cancelled.
2014/04/23 20:57:53 kid1| 0 Duplicate URLs purged.
2014/04/23 20:57:53 kid1| 0 Swapfile clashes avoided.
2014/04/23 20:57:53 kid1| Took 0.02 seconds (69776.30 objects/sec).
2014/04/23 20:57:53 kid1| Beginning Validation Procedure
2014/04/23 20:57:53 kid1| Completed Validation Procedure
2014/04/23 20:57:53 kid1| Validated 1282 Entries
2014/04/23 20:57:53 kid1| store_swap_size = 19304.00 KB
2014/04/23 20:57:54 kid1| storeLateRelease: released 0 objects
Вариант для распечатки
(ok) on 23-Апр-14, 19:31 
