Имеется сервер на win2003 (PDC) и шлюз на Freebsd 7.1. Хочу сделать прозрачный прокси с авторизацией в AD.
С авторизацией в домене справился.
Впринципе все почти работает но не могу разобраться с конфигом rc.firewall
Сейчас у меня так:
rc.conf
Код:
defaultrouter="192.168.56.1"
gateway_enable="YES"
hostname="freebsd.orp.local"
ifconfig_rl0="inet 192.168.56.10 netmask 255.255.255.0"
ifconfig_rl1="inet 192.168.2.10 netmask 255.255.255.0"
keymap="ru.koi8-r"
linux_enable="YES"
sshd_enable="YES"
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_loggig="YES"
natd_enable="YES"
natd_interface="rl0"
samba_enable="YES"
squid_enable="YES"
mousechar_start="3"
font8x8="cp866-8x8"
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
scrnmap="koi8-r2cp866"
keymap="ru.koi8-r"smb.conf
Код:
[global]
workgroup=ORP
server string=freebsd
security=ads
encrypt passwords=yes
winbind separator=+
winbind use default domain=yes
winbind uid=10000-20000
winbind gid=10000-20000
winbind enum users=yes
winbind enum groups=yes
hosts allow=192.168.2.
load printers=no
log file=/var/log/samba/log.%m
password server=192.168.2.1
realm=ORP.LOCAL
passdb backend=tdbsam
socket options=TCP_NODELAY
local master=no
preferred master=no
domain master=no
domain logons=no
dns proxy=no
display charset=koi8-r
unix charset=koi8-r
dos charset=cp866
nt acl support=yes
[data]
comment = docs
path = /home/acab
read list = "@ORP.LOCAL\Domain Users"
write list = "@ORP.LOCAL\Domain Users"
admin users = "@ORP.LOCAL\Admin Users"squid.conf
Код:
http_port 192.168.2.10:3128
http_port 192.168.2.10:3128 transparent
#httpd_accel_host virtual
#httpd_accel_port 80
#httpd_accel_with_proxy on
#httpd_accel_users_host_header on
cache_mem 64 MB
cache_dir ufs /usr/local/etc/squid/cache 300 16 256
cache_access_log /usr/local/etc/squid/logs/access.log
cache_log /usr/local/etc/squid/cache.log
cache_store_log /usr/local/etc/squid/logs/store.log
dns_nameservers 192.168.2.1
auth_param ntlm program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership-of=OPR+inet
auth_param ntlm children 5
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes
#auth_param ntlm use_ntlm_negotiate on
auth_param basic program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-basic --require-membership-of=OPR+inet
auth_param basic children 5
auth_param basic realm Squid proxy-caching
auth_param basic basic credentialsttl 2 hours
auth_param basic basic casesensitive off
acl DOMAIN proxy_auth REQUIRED
http_access allow DOMAIN
http_access deny all
cache_effective_user squid
cache_effective_group squidrc.firewall
Код:
fwcmd="/sbin/ipfw -q"
LanOut="rl0"
IPOut="192.168.56.10"
NetOut="24"
MaskOut="255.255.255.0"
LanIn="rl1"
IPIn="192.168.2.10"
NetInIP="192.168.2.0"
NetInMask="24"
MaskIn="255.255.255.0"
MyIP1="192.168.10.4"
MyIP2="192.168.10.5"
MyIP3="192.168.10.6"
dns1="192.168.2.1"
dns2="222.224.292.8"
${fwcmd} -f flush
${fwcmd} add pass all from any to any via lo0
${fwcmd} add deny ip from 192.168.0.0/16 to any in via ${LanOut}
${fwcmd} add deny ip from 172.16.0.0/12 to any in via ${LanOut}
${fwcmd} add deny ip from 10.0.0.0/8 to any in via ${LanOut}
${fwcmd} add fwd 127.0.0.1,3128 tcp from ${NetInIP}/${NetInMask} to any http,https,ftp via ${LanIn}
${fwcmd} add divert natd ip from ${NetInIP}/${NetInMask} to any out via ${LanOut}
${fwcmd} add divert natd ip from any to ${IPOut} in via ${LanOut}
${fwcmd} add pass tcp from any to any established
${fwcmd} add pass ip from ${IPOut} to any out xmit ${LanOut}
${fwcmd} add pass tcp from ${MyIP1} to any 20,21,22,23,80,443,4000
${fwcmd} add pass tcp from any 20,21,22,23,80,443,4000 to ${MyIP1}
${fwcmd} add pass tcp from ${MyIP2} to any 20,21,22,23,80,443,4000
${fwcmd} add pass tcp from any 20,21,22,23,80,443,4000 to ${MyIP2}
${fwcmd} add pass tcp from ${MyIP3} to any 20,21,22,23,80,443,4000
${fwcmd} add pass tcp from any 20,21,22,23,80,443,4000 to ${MyIP3}
${fwcmd} add deny tcp from any to any 20,21,22,23,3128 in via ${LanOut}
${fwcmd} add deny tcp from any to any 20,21,22,23,80,443 in via ${LanIn}
${fwcmd} add deny tcp from any to any 8000-8104 in via ${LanIn}
${fwcmd} add pass tcp from any to any 25,110 via ${LanOut}
${fwcmd} add pass tcp from any 25,110 to any via ${LanOut}
${fwcmd} add pass udp from any to any 53 via ${LanOut}
${fwcmd} add pass udp from any 53 to any via ${LanOut}
${fwcmd} add pass all from any to any via ${LanIn}
${fwcmd} add pass tcp from ${IPOut} 80 to any via ${LanOut}
${fwcmd} add pass tcp from any to ${IPOut} 80 via ${LanOut}
${fwcmd} add allow icmp from any to ${IPOut} in via ${LanOut} icmptype 0,3,4,11,12
${fwcmd} add allow icmp from any to ${NetInIP}/${NetInMask} in via ${LanOut} icmptype 0,3,4,11,12
${fwcmd} add allow icmp from ${IPOut} to any out via ${LanOut} icmptype 3,8,12
${fwcmd} add allow icmp from ${IPOut} to any out via ${LanOut} frag
${fwcmd} add deny log all from any to any via ${LanOut}
${fwcmd} add deny log ip from any to anyВобщем так: если в rc.conf стоит firewall_type="OPEN" то после установки прокси в браузере все работает как надо (тоесть если не авторизован запрашивает логин и пароль) но если проксю в браузере убрать то авторизацией и не пахнет инет работает свободно для всех (((
если в rc.conf ставлю firewall_script="/etc/rc.firewall" то сайты на тачках пингуются (и по ип и по имени) а вот страницы не открываются совсем.
Подскажите где я допустил ошибку? В идеале мне хочется прозрачный прокси с авторизацией AD.
Если нужна еще какая нибудь информация, скажите я выложу.
