iptables高手请进！squid与iptables不相容！
小弟的环境是redhat9+adsl+squid+iptables，初步实现了透明网关。想具体加强一下iptables。所以参照网上脚本，写出来firewall如下：#!/bin/sh
# Enabling IP Forwarding......"
echo "Enabling IP Forwarding........"
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
# Enabling iptables rules
# Internet Configuration.
EXT_IF="eth0"
LAN_IF="eth1"
LAN_IP="192.168.0.1"
LAN_IP_RANGE="192.168.0.0/24"
# Localhost Configuration.
LO_IF="lo"
LO_IP="127.0.0.1"
# Module loading.
echo "modprobe modules"
modprobe ip_tables
modprobe ip_nat_ftp
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Set policies
echo "Enabling iptables rules"
iptables -F
iptables -F -t nat
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow loopback access
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT -p ALL -i $LAN_IF -s $LAN_IP_RANGE -j ACCEPT
iptables -A INPUT -p ALL -i $LO_IF -s $LO_IP -j ACCEPT
iptables -A INPUT -p ALL -i $LO_IF -s $LAN_IP -j ACCEPT
iptables -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
iptables -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
iptables -A OUTPUT -p ALL -o $EXT_IF -j ACCEPT
iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $LAN_IF -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -i eth1 -p tcp --dport 3128 -j ACCEPT
# allow UDP
iptables -A FORWARD -p udp -d $LAN_IP_RANGE -i $EXT_IF -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
#以上两行就是实现透明网关的关键。
## iptables END
echo "Enabling Squid"
/usr/local/squid/sbin/squid
echo "Enabling ADSL"
adsl-start
但是现在的问题是udp访问正常，ping也正常。就是无法访问网页。如果去掉iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128这句，网页就能正常浏览。这样的话就无法使用Squid了。有没有高人能给指点一下。需要怎么样才能将3128的数据正常的传送！ iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
改成
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
试试？ DNS就在内网？没见允许访问外部DNS的规则？
既然是网关，建议你过滤就只在FORWARD中进行，OUTPUT为ACCEPT， INPUT为DROP
页:
[1]