OpenForum RSS: �� Squid + ipfw ��

�� Squid + ipfw �� (Tiarasu)

Thu, 18 Sep 2014 09:30:43 GMT

>[�� ]
> �� .
> �� .
> ��, ��/�� .
> add 50 divert natd all from any to any via bge1
> add 100 allow all from any to any via lo0
> add 200 deny all from any to 127.0.0.0/8
> add 300 deny all from 127.0.0.0/8 to any
> add 400 fwd 127.0.0.1,3128 tcp from any to any 80 in recv
> bge0
> add 500 allow all from any to any

�� . �� ssl � �� . �� ?

�� Squid + ipfw �� (enzorik)

Mon, 19 Aug 2013 11:46:48 GMT

>[�� ]
>> ��
>> cd /usr/src/
>> make buildkernel KERNCONF=mykernel
>> make installkernel KERNCONF=mykernel
>> �� loader.conf �� ipdivert ��
>> ipfw_load="YES"
>> ipdivert_load="YES"
>> P.S. �� natd �� kernel nat
> �� . �� .
> �� . �� .

�� . �� . �� !

�� Squid + ipfw �� (enzorik)

Tue, 13 Aug 2013 13:32:04 GMT

>[�� ]
> ��
> ident mykernel
> ��
> cd /usr/src/
> make buildkernel KERNCONF=mykernel
> make installkernel KERNCONF=mykernel
> �� loader.conf �� ipdivert ��
> ipfw_load="YES"
> ipdivert_load="YES"
> P.S. �� natd �� kernel nat

�� . �� .
�� . �� .

�� Squid + ipfw �� (��)

Tue, 13 Aug 2013 09:55:09 GMT

> � �� .

�� fwd �� ӣ �� .
�� man ipfw �� ޣ�� .

To enable fwd a custom kernel needs to be compiled with the
option options IPFIREWALL_FORWARD.

� �� divert �� .

man divert

To enable support for divert sockets, place the following lines in the
kernel configuration file:

options IPFIREWALL
options IPDIVERT

Alternatively, to load divert as a module at boot time, add the following
lines into the loader.conf(5) file:

ipfw_load="YES"
ipdivert_load="YES"

�� divert
�� .

options IPFIREWALL # firewall
options IPFIREWALL_VERBOSE # enable logging to syslogd(8)
options IPFIREWALL_VERBOSE_LIMIT=10 # limit verbosity
options IPFIREWALL_DEFAULT_TO_ACCEPT # allow everything by default
options IPFIREWA

�� Squid + ipfw �� (enzorik)

Tue, 13 Aug 2013 08:50:42 GMT

>> �� , �� . ��:
>> 00050 702 475601 divert 8668 ip from any to any via bge1
>> 00100 0 0 allow ip from any to any via lo0
>> 00200 0 0 deny ip from any to 127.0.0.0/8
>> 00300 0 0 deny ip from 127.0.0.0/8 to any
>> 00400 0 0 fwd 127.0.0.1,3128 tcp from 192.168.50.128 to any dst-port 80 in recv bge0
> �� IP ?????

�� , �� , �� .

�� Squid + ipfw �� (��)

Tue, 13 Aug 2013 08:39:59 GMT

> �� , �� . ��:
> 00050 702 475601 divert 8668 ip from any to any via bge1
> 00100 0 0 allow ip from any to any via lo0
> 00200 0 0 deny ip from any to 127.0.0.0/8
> 00300 0 0 deny ip from 127.0.0.0/8 to any
> 00400 0 0 fwd 127.0.0.1,3128 tcp from 192.168.50.128 to any dst-port 80 in recv bge0

�� IP ?????

�� Squid + ipfw �� (enzorik)

Tue, 13 Aug 2013 08:32:05 GMT

>[�� ]
>> 2013/08/13 12:14:00 kid1| Accepting HTTP Socket connections at local=0.0.0.0:3129
>> remote=[::] FD 12 flags=9
>> �� WARNING: no_suid: setuid(0): (1) Operation not permitted
>> :
>> tools.cc(755) enter_suid: enter_suid: PID 70354 taking root privileges
>> 2013/08/12 12:32:25.779| tools.cc(758) enter_suid: enter_suid: setresuid failed:
>> (1) Operation not permitted
>> �� .
> ��
> cat /usr/src/sys/`uname -m`/conf/`uname -i` | grep IPFIREWALL

�� - �� .
� �� .
�� kldstat � sysctl

sysctl -a | grep forward
kern.smp.forward_signal_enabled: 1
net.inet.ip.forwarding: 1
net.inet.ip.fastforwarding: 0
net.inet6.ip6.forwarding: 0
net.wlan.hwmp.replyforward: 1

kldstat
Id Refs Address Size Name
1 12 0xffffffff80200000 1323408 kernel
2 3 0xffffffff81612000 cf6e ipfw.ko
3 1 0xffffffff8161f000 a07d

�� Squid + ipfw �� (��)

Tue, 13 Aug 2013 07:41:20 GMT

>[�� ]
> 2013/08/13 12:14:00 kid1| Accepting NAT intercepted HTTP Socket connections at local=127.0.0.1:3128
> remote=[::] FD 11 flags=41
> 2013/08/13 12:14:00 kid1| Accepting HTTP Socket connections at local=0.0.0.0:3129
> remote=[::] FD 12 flags=9
> �� WARNING: no_suid: setuid(0): (1) Operation not permitted
> :
> tools.cc(755) enter_suid: enter_suid: PID 70354 taking root privileges
> 2013/08/12 12:32:25.779| tools.cc(758) enter_suid: enter_suid: setresuid failed:
> (1) Operation not permitted
> �� .

��
cat /usr/src/sys/`uname -m`/conf/`uname -i` | grep IPFIREWALL

�� Squid + ipfw �� (enzorik)

Tue, 13 Aug 2013 06:15:24 GMT

>[�� ]
> http_access allow localnet
> ��
> http_access allow my_network
> ��
> http_port 3128 intercept
> ��
> http_port 127.0.0.1:3128 intercept
> ��
> http_port 3129
> �� ipfw show ��.

�� , �� . ��:

00050 702 475601 divert 8668 ip from any to any via bge1
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 0 0 fwd 127.0.0.1,3128 tcp from 192.168.50.128 to any dst-port 80 in recv bge0
00500 1474 957392 allow ip from any to any
65535 9194 553357 allow ip from any to any

�� , �� http_port 3129 �� :
ERROR: No forward-proxy ports configured.
�� , �� .

�� :
acl localhost src 127.0.0.1/32
acl my_network src 192.168.50

OpenForum RSS: ���������� Squid + ipfw �������� ���������

���������� Squid + ipfw �������� ��������� (Tiarasu)

���������� Squid + ipfw �������� ��������� (enzorik)

���������� Squid + ipfw �������� ��������� (enzorik)

���������� Squid + ipfw �������� ��������� (�������)

���������� Squid + ipfw �������� ��������� (enzorik)

���������� Squid + ipfw �������� ��������� (������)

���������� Squid + ipfw �������� ��������� (enzorik)

���������� Squid + ipfw �������� ��������� (�������)

���������� Squid + ipfw �������� ��������� (enzorik)

OpenForum RSS: �� Squid + ipfw ��

�� Squid + ipfw �� (Tiarasu)

�� Squid + ipfw �� (enzorik)

�� Squid + ipfw �� (enzorik)

�� Squid + ipfw �� (��)

�� Squid + ipfw �� (enzorik)

�� Squid + ipfw �� (��)

�� Squid + ipfw �� (enzorik)

�� Squid + ipfw �� (��)

�� Squid + ipfw �� (enzorik)