On Wed, 2005-02-16 at 00:03, Navneet Choudhary wrote: > hi list, > > i require help yours side. > > Squid Server is serving as Proxy server, Gateway & Firewall > > Problem: > Squid daemon dies at startup. > > Feb 12 09:15:33 squid (squid): Cannot open HTTP Port > > Why my iptables rule blocking squid to open HTTP port. > Is it possible for you to remove the iptables rules on this system to try out? If not, perhaps you can try a ethereal dump to determine what Squid is trying to open and gets denied. what about yout firewall logs? > Note: existing rule being attached at the end of mail > > Since, process will not die if I disable/flush my rules? > > Squid being started from /etc/rc.local > > Where i am doing mistakes? > > Please suggest since its causing startup hiccup > > Thanks & regards, > > Navneet Choudhary > > Updates & quick recap > > 1.> Basically I want clients to be able to : > > a). Send and receives mails from mail.ISP.net [X.X.X.X] and > sometimes from X.X.X.X > Status: Working > b). Browse the net through squid [3128] > Status: Working > > c). Use Jabber [??], MSN [1863] and Yahoo [5050] > Status: Working > > d) Down and upload data using ftp from X.X.X.K & X.X.X.Z > > Status: Working > e) Down and upload data using SONICMQ [IP & Port?] > > Status: Require HELP > e) Allow SSH connection to this system [eth0]. > Status: Working > f) We can ping/trace route by domain name i.e. ping yahoo.com > Status: Working > > 2.What i am using? > > My network configuration is as follows: - > > WAN > | > eth1 > (172.21.0.133/28) > | > | > Red Hat 9 > [Squid Proxy, Gateway ,firewall & FTP] > | > | > | > (192.168.0.0/16) > eth0 > | > ---- SWITCH---------- > | > | > | > LAN > > where:- > eth0-Intel Corp. 82557/8/9 [Ethernet Pro 100] > eth1-Broadcom Corporation NetXtreme BCM5702 Gigabit Ethernet > > Kernel 2.4.20-8 > > iptables v1.2.7a > > 3.What I have done:- > > a)Enabled IP forwarding by adding > vi /etc/sysctl.conf > > # Controls IP packet forwarding > net.ipv4.ip_forward = 1 > > b)Automatic loading of modules by adding > vi /etc/rc.local > > /sbin/insmod ip_nat_ftp > /sbin/insmod ip_conntrack_ftp > > b)Firewall rules as follows:- > # Generated by iptables-save v1.2.7a on Thu Feb 10 20:02:43 2005 > *mangle > :PREROUTING ACCEPT [1308:428675] > :INPUT ACCEPT [1308:428675] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [1273:553710] > :POSTROUTING ACCEPT [1273:553710] > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG > FIN,PSH,URG -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG > FIN,PSH,URG -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG > FIN,PSH,URG -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG > FIN,PSH,URG -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP > -A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP > COMMIT > # Completed on Thu Feb 10 20:02:43 2005 > # Generated by iptables-save v1.2.7a on Thu Feb 10 20:02:43 2005 > *nat > :PREROUTING ACCEPT [10233:846887] > :POSTROUTING ACCEPT [71:4821] > :OUTPUT ACCEPT [67:4688] > -A POSTROUTING -s 192.168.0.0/255.255.0.0 -o eth1 -j SNAT --to-source > 172.21.0.132 > COMMIT > # Completed on Thu Feb 10 20:02:43 2005 > # Generated by iptables-save v1.2.7a on Thu Feb 10 20:02:43 2005 > *filter > :INPUT DROP [0:0] > :FORWARD DROP [0:0] > :OUTPUT DROP [0:0] > -A INPUT -s 127.0.0.1 -j ACCEPT > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 3128 > --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 22 > --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 21 > --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 20 > --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A INPUT -p udp -j DROP > -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j DROP > -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT > -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 25 > --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport > 110 --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 21 -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 20 -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport > 1863 --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --sport 1024:65535 --dport > 5050 --tcp-flags SYN,RST,ACK SYN -j ACCEPT > -A FORWARD -p icmp -m icmp --icmp-type 8 -j ACCEPT > -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT > -A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 80 > --tcp-flags SYN,RST,ACK SYN -m owner --uid-owner squid -j ACCEPT > -A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 443 > --tcp-flags SYN,RST,ACK SYN -m owner --uid-owner squid -j ACCEPT > -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT > COMMIT > # Completed on Thu Feb 10 20:02:43 2005 -- Ow Mun Heng Gentoo/Linux on DELL D600 1.4Ghz 98% Microsoft(tm) Free!! Neuromancer 15:35:37 up 6:26, 5 users, load average: 0.30, 0.24, 0.29
