IGOS Nusantara dan proxy server squid lanjutan: Perbedaan revisi

Dari IGNwiki
Langsung ke: navigasi, cari
(→‎Koneksi langsung ke server lokal)
Baris 76: Baris 76:
 
  always_direct allow billing
 
  always_direct allow billing
 
  no_cache deny billing
 
  no_cache deny billing
 +
 +
=== Skrip iptables ===
 +
skrip iptables untuk mengatur redirect ke proxy server squid port 3128
 +
 +
Skema Jaringan http://igos-nusantara.or.id/wiki/Skema_Jaringan
 +
 +
#!/bin/sh
 +
 +
# IP proxy server squid
 +
SQUID_SERVER="192.168.0.1"
 +
 +
# Interface terkoneksi ke Internet
 +
INTERNET="eth0"
 +
# Interface terkoneksi ke LAN
 +
LAN_IN="eth1"
 +
 +
# Squid port
 +
SQUID_PORT="3128"
 +
 +
# Bersihkan firewall lama
 +
iptables -F
 +
iptables -X
 +
iptables -t nat -F
 +
iptables -t nat -X
 +
iptables -t mangle -F
 +
iptables -t mangle -X
 +
 +
# Muat modul IPTABLES untuk NAT dan sukungan IP conntrack
 +
modprobe ip_conntrack
 +
modprobe ip_conntrack_ftp
 +
# Untuk klien ftp win xp
 +
#modprobe ip_nat_ftp
 +
echo 1 > /proc/sys/net/ipv4/ip_forward
 +
 +
# Seting filter default
 +
iptables -P INPUT DROP
 +
iptables -P OUTPUT ACCEPT
 +
 +
# Unlimited access to loop back
 +
iptables -A INPUT -i lo -j ACCEPT
 +
iptables -A OUTPUT -o lo -j ACCEPT
 +
 +
# Allow UDP, DNS and Passive FTP
 +
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
 +
 +
# set this system as a router for Rest of LAN
 +
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
 +
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
 +
 +
# unlimited access to LAN
 +
iptables -A INPUT -i $LAN_IN -j ACCEPT
 +
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
 +
 +
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
 +
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
 +
 +
# if it is same system
 +
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
 +
 +
# DROP everything and Log it
 +
iptables -A INPUT -j LOG
 +
iptables -A INPUT -j DROP

Revisi per 2 Januari 2011 08.10

Konfigurasi proxy server squid sederhana ada di IGNwiki http://igos-nusantara.or.id/wiki/IGOS_Nusantara_dan_proxy_server_squid

Proxy Server Squid Transparent

Proxy server squid dapat dibuat agar transparan, artinya PC client akan diarahkan/redirect untuk selalu memakai proxy server. PC client tidak perlu lagi melakukan seting proxy di browser.

Pasang dan Konfigurasi Squid

Pasang squid

# yum install -y squid

Konfigurasi Tahap1

Konfigurasi default ada di /etc/squid/squid.conf.default. Artikel squid tingkat lanjutan ini akan menunjukkan cara membuat konfigurasi lebih ringkas, caranya dengan membuang semua baris komentar. Baris komentar dibuang dengan memakai perintah grep, sed dan pipe (tanda lebih besar) ke /etc/squid/squid.conf

Perintah untuk membuang baris komentar 

# grep -v "^#" /etc/squid/squid.conf.default | sed -e '/^$/d' > /etc/squid/squid.conf

Konfigurasi /etc/squid/squid.conf yang sudah ringkas sebagai berikut: 

# cat /etc/squid/squid.conf

acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localhost src ::1/128
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl to_localhost dst ::1/128
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7   # RFC 4193 local private network range
acl localnet src fe80::/10  # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320
bash-4.1#

Konfigurasi iptables

Agar setiap akses ke port 80 atau web diarahkan ke squid proxy server port 3128, lakukan: 

# iptables -t nat -A PREROUTING -i eth1 -p tcp –dport 80 -j DNAT –to 192.168.0.1:3128
# iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j REDIRECT –to-port 3128


Konfigurasi Lain

Koneksi langsung ke server lokal

Misal ada dua server lokal:

  1. Server Web ada di 192.168.0.10
  2. Server Billing ada di 192.168.0.20

Tambahkan rule 

acl server dst 192.168.0.10/255.255.255.255
acl billing dst 192.168.0.20/255.255.255.255

always_direct allow server
no_cache deny server

always_direct allow billing
no_cache deny billing

Skrip iptables

skrip iptables untuk mengatur redirect ke proxy server squid port 3128

Skema Jaringan http://igos-nusantara.or.id/wiki/Skema_Jaringan 

#!/bin/sh

# IP proxy server squid
SQUID_SERVER="192.168.0.1"

# Interface terkoneksi ke Internet
INTERNET="eth0"
# Interface terkoneksi ke LAN
LAN_IN="eth1"

# Squid port
SQUID_PORT="3128"

# Bersihkan firewall lama
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Muat modul IPTABLES untuk NAT dan sukungan IP conntrack
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Untuk klien ftp win xp 
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward

# Seting filter default 
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT

# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT

# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT

# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT

# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT

# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP
Diperoleh dari "http://igos-nusantara.or.id/wiki/index.php?title=IGOS_Nusantara_dan_proxy_server_squid_lanjutan&oldid=958"