Hi Tek,
Here is my squid.conf
============
manu@ns1:~$ cat /etc/squid/squid.conf
# TAG: http_port
# Usage: port [options]
# hostname:port [options]
# 1.2.3.4:port [options]
#
# The socket addresses where Squid will listen for HTTP client
# requests. You may specify multiple socket addresses.
# There are three forms: port alone, hostname with port, and
# IP address with port. If you specify a hostname or IP
# address, Squid binds the socket to that specific
# address. This replaces the old 'tcp_incoming_address'
# option. Most likely, you do not need to bind to a specific
# address, so you can use the port number alone.
#
# The default port number is 3128.
#
# If you are running Squid in accelerator mode, you
# probably want to listen on port 80 also, or instead.
#
# The -a command line option will override the *first* port
# number listed here. That option will NOT override an IP
# address, however.
#
# You may specify multiple socket addresses on multiple lines.
#
# options are:
#
# transparent Support for transparent interception of
# outgoing requests without browser settings
#
# accel Accelerator mode. Also needs at least one
# of vhost/vport/defaultsite.
#
# defaultsite= Main web site name for accelerators. Implies
# accel.
#
# vhost Accelerator using the Host header for
# virtual domain support. Implies accel.
#
# vport Accelerator with IP based virtual host support.
# Implies accel.
#
# vport= As above, but uses specified port number
# rather than the http_port number. Implies accel.
#
# urlgroup= Default urlgroup to mark requests
# with (see also acl urlgroup and
# url_rewrite_program)
#
# protocol= Protocol to reconstruct accelerated
# requests with. Defaults to http.
#
# no-connection-auth
# Prevent forwarding of Microsoft
# connection oriented authentication
# (NTLM, Negotiate and Kerberos)
#
# tproxy Support Linux TPROXY for spoofing
# outgoing connections using the client
# IP address.
#
# If you run Squid on a dual-homed machine with an internal
# and an external interface we recommend you to specify the
# internal address:port in http_port. This way Squid will only be
# visible on the internal address.
#
# Squid normally listens to port 3128
http_port 3128 transparent
# TAG: icp_port
# The port number where Squid sends and receives ICP queries to
# and from neighbor caches. Default is 3130. To disable use
# "0". May be overridden with -u on the command line.
#
#Default:
icp_port 0
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
# TAG: hierarchy_stoplist
# A list of words which, if found in a URL, cause the object to
# be handled directly by this cache. In other words, use this
# to not query neighbor caches for certain objects. You may
# list this option multiple times. Note: never_direct overrides
# this option.
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# TAG: cache
# A list of ACL elements which, if matched, cause the request to
# not be satisfied from the cache and the reply to not be cached.
# In other words, use this to force certain objects to never be cached.
#
# You must use the word 'DENY' to indicate the ACL names which should
# NOT be cached.
#
# Default is to allow all to be cached
#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
# OPTIONS WHICH AFFECT THE CACHE SIZE
# -----------------------------------------------------------------------------
# TAG: cache_mem (bytes)
# NOTE: THIS PARAMETER DOES NOT SPECIFY THE MAXIMUM PROCESS SIZE.
# IT ONLY PLACES A LIMIT ON HOW MUCH ADDITIONAL MEMORY SQUID WILL
# USE AS A MEMORY CACHE OF OBJECTS. SQUID USES MEMORY FOR OTHER
# THINGS AS WELL. SEE THE SQUID FAQ SECTION 8 FOR DETAILS.
#
# 'cache_mem' specifies the ideal amount of memory to be used
# for:
# * In-Transit objects
# * Hot Objects
# * Negative-Cached objects
#
# Data for these objects are stored in 4 KB blocks. This
# parameter specifies the ideal upper limit on the total size of
# 4 KB blocks allocated. In-Transit objects take the highest
# priority.
#
# In-transit objects have priority over the others. When
# additional space is needed for incoming data, negative-cached
# and hot objects will be released. In other words, the
# negative-cached and hot objects will fill up any unused space
# not needed for in-transit objects.
#
# If circumstances require, this limit will be exceeded.
# Specifically, if your incoming request rate requires more than
# 'cache_mem' of memory to hold in-transit objects, Squid will
# exceed this limit to satisfy the new requests. When the load
# decreases, blocks will be freed until the high-water mark is
# reached. Thereafter, blocks will be used to store hot
# objects.
#
#Default:
cache_mem 8 MB
# TAG: cache_swap_low (percent, 0-100)
# TAG: cache_swap_high (percent, 0-100)
#
# The low- and high-water marks for cache object replacement.
# Replacement begins when the swap (disk) usage is above the
# low-water mark and attempts to maintain utilization near the
# low-water mark. As swap utilization gets close to high-water
# mark object eviction becomes more aggressive. If utilization is
# close to the low-water mark less replacement is done each time.
#
# Defaults are 90% and 95%. If you have a large cache, 5% could be
# hundreds of MB. If this is the case you may wish to set these
# numbers closer together.
#
#Default:
cache_swap_low 90
cache_swap_high 95
# TAG: maximum_object_size (bytes)
# Objects larger than this size will NOT be saved on disk. The
# value is specified in kilobytes, and the default is 4MB. If
# you wish to get a high BYTES hit ratio, you should probably
# increase this (one 32 MB object hit counts for 3200 10KB
# hits). If you wish to increase speed more than your want to
# save bandwidth you should leave this low.
#
# NOTE: if using the LFUDA replacement policy you should increase
# this value to maximize the byte hit rate improvement of LFUDA!
# See replacement_policy below for a discussion of this policy.
#
#Default:
maximum_object_size 4096 KB
# TAG: minimum_object_size (bytes)
# Objects smaller than this size will NOT be saved on disk. The
# value is specified in kilobytes, and the default is 0 KB, which
# means there is no minimum.
#
#Default:
minimum_object_size 0 KB
# TAG: maximum_object_size_in_memory (bytes)
# Objects greater than this size will not be attempted to kept in
# the memory cache. This should be set high enough to keep objects
# accessed frequently in memory to improve performance whilst low
# enough to keep larger objects from hoarding cache_mem.
#
#Default:
maximum_object_size_in_memory 8 KB
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
# -----------------------------------------------------------------------------
# TAG: cache_dir
# Usage:
#
# cache_dir Type Directory-Name Fs-specific-data [options]
#
# You can specify multiple cache_dir lines to spread the
# cache among different disk partitions.
#
# Type specifies the kind of storage system to use. Only "ufs"
# is built by default. To enable any of the other storage systems
# see the --enable-storeio configure option.
#
# 'Directory' is a top-level directory where cache swap
# files will be stored. If you want to use an entire disk
# for caching, this can be the mount-point directory.
# The directory must exist and be writable by the Squid
# process. Squid will NOT create this directory for you.
# Only using COSS, a raw disk device or a stripe file can
# be specified, but the configuration of the "cache_wap_log"
# tag is mandatory.
#
# The ufs store type:
#
# "ufs" is the old well-known Squid storage format that has always
# been there.
#
# cache_dir ufs Directory-Name Mbytes L1 L2 [options]
#
# 'Mbytes' is the amount of disk space (MB) to use under this
# directory. The default is 100 MB. Change this to suit your
# configuration. Do NOT put the size of your disk drive here.
# Instead, if you want Squid to use the entire disk drive,
# subtract 20% and use that value.
#
# 'Level-1' is the number of first-level subdirectories which
# will be created under the 'Directory'. The default is 16.
#
# 'Level-2' is the number of second-level subdirectories which
# will be created under each first-level directory. The default
# is 256.
#
# The aufs store type:
#
# "aufs" uses the same storage format as "ufs", utilizing
# POSIX-threads to avoid blocking the main Squid process on
# disk-I/O. This was formerly known in Squid as async-io.
#
# cache_dir aufs Directory-Name Mbytes L1 L2 [options]
#
# see argument descriptions under ufs above
#
# The diskd store type:
#
# "diskd" uses the same storage format as "ufs", utilizing a
# separate process to avoid blocking the main Squid process on
# disk-I/O.
#
# cache_dir diskd Directory-Name Mbytes L1 L2 [options] [Q1=n] [Q2=n]
#
# see argument descriptions under ufs above
#
# Q1 specifies the number of unacknowledged I/O requests when Squid
# stops opening new files. If this many messages are in the queues,
# Squid won't open new files. Default is 64
#
# Q2 specifies the number of unacknowledged messages when Squid
# starts blocking. If this many messages are in the queues,
# Squid blocks until it receives some replies. Default is 72
#
# When Q1 < Q2 (the default), the cache directory is optimized
# for lower response time at the expense of a decrease in hit
# ratio. If Q1 > Q2, the cache directory is optimized for
# higher hit ratio at the expense of an increase in response
# time.
#
# The COSS store type:
#
# block-size=n defines the "block size" for COSS cache_dir's.
# Squid uses file numbers as block numbers. Since file numbers
# are limited to 24 bits, the block size determines the maximum
# size of the COSS partition. The default is 512 bytes, which
# leads to a maximum cache_dir size of 512<<24, or 8 GB. Note
# you should not change the COSS block size after Squid
# has written some objects to the cache_dir.
#
# overwrite-percent=n defines the percentage of disk that COSS
# must write to before a given object will be moved to the
# current stripe. A value of "n" closer to 100 will cause COSS
# to waste less disk space by having multiple copies of an object
# on disk, but will increase the chances of overwriting a popular
# object as COSS overwrites stripes. A value of "n" close to 0
# will cause COSS to keep all current objects in the current COSS
# stripe at the expense of the hit rate. The default value of 50
# will allow any given object to be stored on disk a maximum of
# 2 times.
#
# max-stripe-waste=n defines the maximum amount of space that COSS
# will waste in a given stripe (in bytes). When COSS writes data
# to disk, it will potentially waste up to "max-size" worth of disk
# space for each 1MB of data written. If "max-size" is set to a
# large value (ie >256k), this could potentially result in large
# amounts of wasted disk space. Setting this value to a lower value
# (ie 64k or 32k) will result in a COSS disk refusing to cache
# larger objects until the COSS stripe has been filled to within
# "max-stripe-waste" of the maximum size (1MB).
#
# membufs=n defines the number of "memory-only" stripes that COSS
# will use. When an cache hit is performed on a COSS stripe before
# COSS has reached the overwrite-percent value for that object,
# COSS will use a series of memory buffers to hold the object in
# while the data is sent to the client. This will define the maximum
# number of memory-only buffers that COSS will use. The default value
# is 10, which will use a maximum of 10MB of memory for buffers.
#
# maxfullbufs=n defines the maximum number of stripes a COSS partition
# will have in memory waiting to be freed (either because the disk is
# under load and the stripe is unwritten, or because clients are still
# transferring data from objects using the memory). In order to try
# and maintain a good hit rate under load, COSS will reserve the last
# 2 full stripes for object hits. (ie a COSS cache_dir will reject
# new objects when the number of full stripes is 2 less than maxfullbufs)
#
# Common options:
#
# read-only, this cache_dir is read only.
#
# max-size=n, refers to the max object size this storedir supports.
# It is used to initially choose the storedir to dump the object.
# Note: To make optimal use of the max-size limits you should order
# the cache_dir lines with the smallest max-size value first and the
# ones with no max-size specification last.
#
# Note that for coss, max-size must be less than COSS_MEMBUF_SZ
# (hard coded at 1 MB).
#
#Default:
cache_dir ufs /var/cache/squid 50 16 256
# TAG: access_log
# These files log client request activities. Has a line every HTTP or
# ICP request. The format is:
# access_log <filepath> [<logformat name> [acl acl ...]]
#
# Will log to the specified file using the specified format (which
# must be defined in a logformat directive) those entries which match
# ALL the acl's specified (which must be defined in acl clauses).
# If no acl is specified, all requests will be logged to this file.
#
# To disable logging of a request use the filepath "none", in which case
# a logformat name should not be specified.
#
# To log the request via syslog specify a filepath of "syslog"
access_log /var/log/squid/access.log
# TAG: cache_log
# Cache logging file. This is where general information about
# your cache's behavior goes. You can increase the amount of data
# logged to this file with the "debug_options" tag below.
#
#Default:
cache_log /var/log/squid/cache.log
# TAG: cache_store_log
# Logs the activities of the storage manager. Shows which
# objects are ejected from the cache, and which objects are
# saved and for how long. To disable, enter "none". There are
# not really utilities to analyze this data, so you can safely
# disable it.
#
#Default:
cache_store_log none
# TAG: pid_filename
# A filename to write the process-id to. To disable, enter "none".
#
#Default:
pid_filename /var/run/squid.pid
# TAG: client_netmask
# A netmask for client addresses in logfiles and cachemgr output.
# Change this to protect the privacy of your cache clients.
# A netmask of 255.255.255.0 will log all IP's in that range with
# the last digit set to '0'.
#
#Default:
client_netmask 255.255.255.0
# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------
# TAG: check_hostnames
# For security and stability reasons Squid by default checks
# hostnames for Internet standard RFC compliance. If you do not want
# Squid to perform these checks then turn this directive off.
#
#Default:
check_hostnames off
# ACCESS CONTROLS
# -----------------------------------------------------------------------------
# TAG: acl
# Defining an Access List
#
# acl aclname acltype string1 ...
# acl aclname acltype "file" ...
#
# when using "file", the file should contain one item per line
#
# acltype is one of the types described below
#
# By default, regular expressions are CASE-SENSITIVE. To make
# them case-insensitive, use the -i option.
#
# acl aclname src ip-address/netmask ... (clients IP address)
# acl aclname src addr1-addr2/netmask ... (range of addresses)
# acl aclname dst ip-address/netmask ... (URL host's IP address)
# acl aclname myip ip-address/netmask ... (local socket IP address)
#
# acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation)
# # The arp ACL requires the special configure option --enable-arp-acl.
# # Furthermore, the arp ACL code is not portable to all operating
systems.
# # It works on Linux, Solaris, FreeBSD and some other *BSD variants.
# #
# # NOTE: Squid can only determine the MAC address for clients that are on
# # the same subnet. If the client is on a different subnet, then
Squid cannot
# # find out its MAC address.
#
# acl aclname srcdomain .foo.com ... # reverse lookup, client IP
# acl aclname dstdomain .foo.com ... # Destination server from URL
# acl aclname srcdom_regex [-i] xxx ... # regex matching client name
# acl aclname dstdom_regex [-i] xxx ... # regex matching server
# # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
# # based URL is used and no match is found. The name "none" is used
# # if the reverse lookup fails.
#
# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# day-abbrevs:
# S - Sunday
# M - Monday
# T - Tuesday
# W - Wednesday
# H - Thursday
# F - Friday
# A - Saturday
# h1:m1 must be less than h2:m2
# acl aclname url_regex [-i] ^http:// ... # regex matching on whole URL
# acl aclname urlpath_regex [-i] \.gif$ ... # regex matching on
URL path
# acl aclname urllogin [-i] [^a-zA-Z0-9] ... # regex matching on
URL login field
# acl aclname port 80 70 21 ...
# acl aclname port 0-1024 ... # ranges allowed
# acl aclname myport 3128 ... # (local socket TCP port)
# acl aclname proto HTTP FTP ...
# acl aclname method GET POST ...
# acl aclname browser [-i] regexp ...
# # pattern match on User-Agent header (see also req_header below)
# acl aclname referer_regex [-i] regexp ...
# # pattern match on Referer header
# # Referer is highly unreliable, so use with care
# acl aclname ident username ...
# acl aclname ident_regex [-i] pattern ...
# # string match on ident output.
# # use REQUIRED to accept any non-null ident.
# acl aclname src_as number ...
# acl aclname dst_as number ...
# # Except for access control, AS numbers can be used for
# # routing of requests to specific caches. Here's an
# # example for routing all requests for AS#1241 and only
# # those to mycache.mydomain.net:
# # acl asexample dst_as 1241
# # cache_peer_access mycache.mydomain.net allow asexample
# # cache_peer_access mycache_mydomain.net deny all
#
# acl aclname proxy_auth [-i] username ...
# acl aclname proxy_auth_regex [-i] pattern ...
# # list of valid usernames
# # use REQUIRED to accept any valid username.
# #
# # NOTE: when a Proxy-Authentication header is sent but it is not
# # needed during ACL checking the username is NOT logged
# # in access.log.
# #
# # NOTE: proxy_auth requires a EXTERNAL authentication program
# # to check username/password combinations (see
# # auth_param directive).
# #
# # WARNING: proxy_auth can't be used in a transparent proxy. It
# # collides with any authentication done by origin servers. It may
# # seem like it works at first, but it doesn't.
#
# acl aclname snmp_community string ...
# # A community string to limit access to your SNMP Agent
# # Example:
# #
# # acl snmppublic snmp_community public
#
# acl aclname maxconn number
# # This will be matched when the client's IP address has
# # more than <number> HTTP connections established.
#
# acl aclname max_user_ip [-s] number
# # This will be matched when the user attempts to log in from more
# # than <number> different ip addresses. The authenticate_ip_ttl
# # parameter controls the timeout on the ip entries.
# # If -s is specified the limit is strict, denying browsing
# # from any further IP addresses until the ttl has expired. Without
# # -s Squid will just annoy the user by "randomly" denying requests.
# # (the counter is reset each time the limit is reached and a
# # request is denied)
# # NOTE: in acceleration mode or where there is mesh of child proxies,
# # clients may appear to come from multiple addresses if they are
# # going through proxy farms, so a limit of 1 may cause user problems.
#
# acl aclname req_mime_type mime-type1 ...
# # regex match against the mime type of the request generated
# # by the client. Can be used to detect file upload or some
# # types HTTP tunneling requests.
# # NOTE: This does NOT match the reply. You cannot use this
# # to match the returned file type.
#
# acl aclname req_header header-name [-i] any\.regex\.here
# # regex match against any of the known request headers. May be
# # thought of as a superset of "browser", "referer" and "mime-type"
# # ACLs.
#
# acl aclname rep_mime_type mime-type1 ...
# # regex match against the mime type of the reply received by
# # squid. Can be used to detect file download or some
# # types HTTP tunneling requests.
# # NOTE: This has no effect in http_access rules. It only has
# # effect in rules that affect the reply data stream such as
# # http_reply_access.
#
# acl aclname rep_header header-name [-i] any\.regex\.here
# # regex match against any of the known response headers.
# # Example:
# #
# # acl many_spaces rep_header Content-Disposition -i [[:space:]]{3,}
#
# acl acl_name external class_name [arguments...]
# # external ACL lookup via a helper class defined by the
# # external_acl_type directive.
#
# acl urlgroup group1 ...
# # match against the urlgroup as indicated by redirectors
#
# acl aclname user_cert attribute values...
# # match against attributes in a user SSL certificate
# # attribute is one of DN/C/O/CN/L/ST
#
# acl aclname ca_cert attribute values...
# # match against attributes a users issuing CA SSL certificate
# # attribute is one of DN/C/O/CN/L/ST
#
# acl aclname ext_user username ...
# acl aclname ext_user_regex [-i] pattern ...
# # string match on username returned by external acl
# # use REQUIRED to accept any user name.
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# TAG: http_access
# Allowing or Denying access based on defined access lists
#
# Access to the HTTP port:
# http_access allow|deny [!]aclname ...
#
# NOTE on default values:
#
# If there are no "access" lines present, the default is to deny
# the request.
#
# If none of the "access" lines cause a match, the default is the
# opposite of the last line in the list. If the last line was
# deny, the default is allow. Conversely, if the last line
# is allow, the default will be deny. For these reasons, it is a
# good idea to have an "deny all" or "allow all" entry at the end
# of your access lists to avoid potential confusion.
#
#
#Recommended minimum configuration:
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
#acl FREE_MAC arp 00:D0:09:9E:9A:08 00:C0:9F:EE:FD:87
#http_access allow FREE_MAC
acl FREE_IP src "/etc/squid/regras/freeip.txt"
http_access allow FREE_IP
#acl FREE_TIME_I time 00:00-08:00
#acl FREE_TIME_II time 12:00-13:30
#acl FREE_TIME_III time 18:01-23:59
#http_access allow FREE_TIME_I
#http_access allow FREE_TIME_II
#http_access allow FREE_TIME_III
acl bloqueados dstdomain "/etc/squid/regras/lista.txt"
http_access deny bloqueados
acl DOWN_EXT url_regex -i .com$ .pif$ .avi$ .mp3$ .mpeg$ .mpg$ .rm$ .wma$
.asx$ .cab$ .src$
http_access deny DOWN_EXT
acl MSNME url_regex -i gateway.dll
acl MSN req_mime_type -i ^application/x-msn-messenger$
http_access deny MSNME
http_access deny MSN
acl redelocal src 10.0.0.0/255.0.0.0
http_access allow redelocal
http_access deny !all all
# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
# TAG: cache_effective_user
# If you start Squid as root, it will change its effective/real
# UID/GID to the user specified below. The default is to change
# to UID to nobody. If you define cache_effective_user, but not
# cache_effective_group, Squid sets the GID to the effective
# user's default group ID (taken from the password file) and
# supplementary group list from the from groups membership of
# cache_effective_user.
#
#Default:
cache_effective_user nobody
# TAG: cache_effective_group
# If you want Squid to run with a specific GID regardless of
# the group memberships of the effective user then set this
# to the group (or GID) you want Squid to run as. When set
# all other group privileges of the effective user is ignored
# and only this GID is effective. If Squid is not started as
# root the user starting Squid must be member of the specified
# group.
#
#Default:
# none
# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------
#
# This section contains parameters for the (optional) cache
# announcement service. This service is provided to help
# cache administrators locate one another in order to join or
# create cache hierarchies.
#
# An 'announcement' message is sent (via UDP) to the registration
# service by Squid. By default, the announcement message is NOT
# SENT unless you enable it with 'announce_period' below.
#
# The announcement message includes your hostname, plus the
# following information from this configuration file:
#
# http_port
# icp_port
# cache_mgr
#
# All current information is processed regularly and made
# available on the Web at http://www.ircache.net/Cache/Tracker/.
# MISCELLANEOUS
# -----------------------------------------------------------------------------
# TAG: dns_testnames
# The DNS tests exit as soon as the first site is successfully looked up
#
# This test can be disabled with the -D command line option.
#
#Default:
dns_testnames terra.com.br kernel.org
# TAG: logfile_rotate
# Specifies the number of logfile rotations to make when you
# type 'squid -k rotate'. The default is 10, which will rotate
# with extensions 0 through 9. Setting logfile_rotate to 0 will
# disable the rotation, but the logfiles are still closed and
# re-opened. This will enable you to rename the logfiles
# yourself just before sending the rotate signal.
#
# Note, the 'squid -k rotate' command normally sends a USR1
# signal to the running squid process. In certain situations
# (e.g. on Linux with Async I/O), USR1 is used for other
# purposes, so -k rotate uses another signal. It is best to get
# in the habit of using 'squid -k rotate' instead of 'kill -USR1
# <pid>'.
#
#Default:
logfile_rotate 5
# TAG: error_directory
# If you wish to create your own versions of the default
# (English) error files, either to customize them to suit your
# language or company copy the template English files to another
# directory and point this tag at them.
#
#Default:
error_directory /usr/share/squid/errors/Portuguese
# TAG: maximum_single_addr_tries
# This sets the maximum number of connection attempts for a
# host that only has one address (for multiple-address hosts,
# each address is tried once).
#
# The default value is one attempt, the (not recommended)
# maximum is 255 tries. A warning message will be generated
# if it is set to a value greater than ten.
#
# Note: This is in addition to the request re-forwarding which
# takes place if Squid fails to get a satisfying response.
#
#Default:
maximum_single_addr_tries 1
============
and my rc.firewall
===========
manu@ns1:~$ cat /etc/rc.d/rc.firewall
#!/bin/bash
#
# Script criado por Igor Garcia e adaptado por Daniel Zilli
# Interface da rede INTERNA
IF_INTERNA="eth0";
# Interface da rede EXTERNA (internet)
IF_EXTERNA="eth1";
# Definição da rede interna
REDE_INTERNA="10.1.1.0/24"
fw_start()
{
#ativa o roteamento dinamico
echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv4/ip_dynaddr
# ================ POLITICAS PADRAO ===================
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
# Cria chain com regras de segurança
iptables -N BLOCK
iptables -A BLOCK -p icmp --icmp-type echo-request -j DROP
iptables -A BLOCK -p icmp --icmp-type echo-request -m limit --limit 1/s -j
ACCEPT
iptables -A BLOCK -p tcp -m limit --limit 1/s -j ACCEPT
iptables -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit
1/s -j ACCEPT
iptables -A BLOCK -m unclean -j DROP
iptables -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A BLOCK -j DROP
# Carrega alguns modulos
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
# Muda a prioridade dos pacotes (Type Of Service) para agilizar as coisas
# iptables -t mangle -A OUTPUT -o $IF_EXTERNA -p tcp -m multiport --dports
21,22,53,80,110,3306,6667 -j TOS --set-tos 0x10
# Libera todo o trafego local
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -i $IF_INTERNA -j ACCEPT
iptables -t filter -A FORWARD -i $IF_INTERNA -j ACCEPT
# Regra para proxy transparente
iptables -t nat -A PREROUTING -s 0/0 -p tcp --dport 80 -j REDIRECT --to-port
3128
# Libera as portas
iptables -t filter -A INPUT -i $IF_EXTERNA -p tcp -m multiport --dports
21,22,25,53,80,3306,110,5060,5061 -j ACCEPT
iptables -t filter -A INPUT -i $IF_EXTERNA -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -i $IF_EXTERNA -p tcp --dport 8000:8100 -j ACCEPT
# Libera a conexao para a rede interna
iptables -t nat -A POSTROUTING -s $REDE_INTERNA -j MASQUERADE
# Regras para evitar packet flood
iptables -A INPUT -j BLOCK
iptables -A FORWARD -j BLOCK
# Regras para OPENVPN
# iptables -A INPUT -p udp --dport 1194 -j ACCEPT
# iptables -A INPUT -i tun+ -j ACCEPT
# iptables -A FORWARD -i tun+ -j ACCEPT
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128
}
fw_stop()
{
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
iptables -t filter -X
iptables -t nat -X
iptables -t mangle -X
iptables -t filter -Z
iptables -t nat -Z
iptables -t mangle -Z
}
fw_usage()
{
echo
echo "$0 (start | stop | restart | clear)"
echo
echo "start - Ativa o firewall"
echo "stop - Desativa o firewall"
echo "restart - Reativa o firewall"
echo "clear - Limpa os contatores"
}
fw_clear()
{
iptables -t filter -Z
iptables -t nat -Z
iptables -t mangle -Z
}
case $1 in
start)
fw_start;
;;
stop)
fw_stop;
;;
restart)
fw_stop;
fw_start;
;;
clear)
fw_clear;
;;
*)
fw_usage;
exit;
;;
esac
==========
Bests,
Daniel
