tengo montado un servidor Debian que hace de gateway y proxy transparente con squid entre una red Wifi y Internet. Aparentemente todo funciona pero veo al menos dos puntos que no funcionan y ya me pregunto si realmente los usuarios estan pasando por el proxy o o no.
1. Los logs:
El fichero /var/log/squid/access.log solamente contiene 3 lineas que son 3 TCP_DENIED de unas pruebas que he hecho pero no contiene nada más.
El cache.log solamente informa de que se estan aceptando conexiones HTTP por el puerto 3128 y que está listo para para servir (Ready to serve requests) pero no informa de los objetos que deberia haber en cache...
El store.log tampoco tiene mas de 10 lineas con lo que más sospechoso aun.
2. He creado algunas listas ACL para que no sean accesibles pero no funciona.
Un motivo más para pensar que las conexiones no son procesadas por squid.
Les rogaria me revisaran mi squid.conf por si pueden ver donde está el problema.
Gracias por adelantado
Fichero squid.conf:
- File: squid.conf
http_port 3128
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
#CACHE
cache_mem 8 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 40960 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 8 KB
ipcache_size 2048
ipcache_low 90
ipcache_high 95
cache_replacement_policy lru
memory_replacement_policy lru
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
cache_dir ufs /var/spool/squid 512 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
log_fqdn off
client_netmask 255.255.255.255
# OPTIONS FOR TUNING THE CACHE
# -----------------------------------------------------------------------------
#Suggested default:
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl xarxa src 192.168.100.0/23
acl sitios_prohib dstdomain "/etc/squid/llistes/sitios_prohib"
acl expresions_prohib url_regex "/etc/squid/llistes/expresions_prohib"
acl sitios_permit dstdomain "/etc/squid/llistes/sitios_permit"
acl sexe dstdomain www.sexo.net www.sex.net
acl SSL_ports port 443 563 # https, snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 8080 # HTTP per actualitzacions clients Trend
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access deny sexe
#
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
#
# We strongly recommend to uncomment the following to protect innocent
# web applications running on the proxy server who think that the only
# one who can access services on "localhost" is a local user
http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
http_access allow localhost
http_access allow sitios_permit
http_access allow xarxa !sitios_prohib !expresions_prohib
# And finally deny all other access to this proxy
http_access deny all
# and finally allow by default
http_reply_access allow all
#Allow ICP queries from everyone
icp_access allow all
# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
visible_hostname wifiserver
buffered_logs on
