Ubuntu Server 16.04 Squid 代理身份验证，带 2 个 NIC 设置

2024-6-6 • tag-icon

Ubuntu Server 16.04 Squid 代理身份验证，带 2 个 NIC 设置

我有一个运行服务器 16.04、squid 3.5.12 和 NCSA 的 Ubuntu 代理。服务器有两个 NIC，一个连接到互联网路由器，eno1，IP 为 192.168.1.2/24，另一个连接到客户端 LAN，eno2，IP 为 192.168.2.1/24。当我在客户端计算机上配置代理设置时，浏览器会请求登录凭据，但当我选择自动检测代理设置时，用户浏览互联网时，access.log 中甚至没有捕获任何内容。首先，我希望绕过代理设置的用户无法浏览互联网，这是我的首要目标。这是我的优先级列表：

所有客户端用户在浏览互联网时都必须经过身份验证 - 用户名和密码（必须）
绕过浏览器代理设置的用户不得浏览互联网（必须）

注意：帮助我完成目标 2

至于 iptables，我真的一无所知，如果有人愿意解释的话我会很高兴，请记住我运行的是 Ubuntu 16.04。我现在知道如何保存 iptables，但拥有可以实现我目标的 iptables 才是主要问题。我已经注释掉了我在 rc.local 中所做的一切，因为它没有实现任何目标。

auto lo
iface lo inet loopback

# Gre tunnel interface
#auto wccp0
#iface wccp0 inet manual
#       pre-up ip tunnel add wccp0 gre remote 10.10.101.2 local 192.168.0.4 dev eno1 ttl 255

# The primary network interface
auto eno1
iface eno1 inet static
        address 192.168.1.2
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.0.5
        dns-search hit.ac.zw

#Secondary interface
auto eno2
iface eno2 inet static
        address 192.168.2.1
        netmask 255.255.255.0
        network 192.168.2.0
        gateway 192.168.2.1
#save ip tables
pre-up iptables-restore < /etc/iptables.up.rules

Squid配置：

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Systems Admin
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
acl ncsa_users proxy_auth REQUIRED

#acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
acl localnet src 192.168.1.0/24
acl localnet src 192.168.2.0/24
#acl lan src 192.168.1.0/24

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_port 3128

http_access deny !ncsa_users
http_access deny ncsa_users blocked_sites

#http_access deny blocked_sites
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
#http_access deny localnet
#http_access deny lan
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

IP 表：

#MY IPTABLE - it has been changed several times i no longer have original
    *filter
:INPUT ACCEPT [231:24245]
:FORWARD ACCEPT [205:45205]
:OUTPUT ACCEPT [155:73325]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.2.1/24 -p tcp -m tcp --dport 3128 -j ACCEPT
-A FORWARD -s 192.168.2.0/24 -j REJECT --reject-with icmp-port-unreachable
COMMIT
*nat
:PREROUTING ACCEPT [1001:61764]
:INPUT ACCEPT [211:12736]
:OUTPUT ACCEPT [10:814]
:POSTROUTING ACCEPT [719:45963]
-A PREROUTING -i eno2 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i eno1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.2:3128
COMMIT

路由表：

root@proxy:~# route -n
    Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eno1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eno1
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 eno2

从客户端机器路由打印

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1      192.168.2.2    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.2.0    255.255.255.0         On-link       192.168.2.2    276
      192.168.2.2  255.255.255.255         On-link       192.168.2.2    276
    192.168.2.255  255.255.255.255         On-link       192.168.2.2    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.2.2    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.2.2    276
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.2.1  Default
===========================================================================

相关内容