☰

Squid 在同一台机器上以拦截模式运行，但浏览器一直拒绝访问

tag-icon • tag-icon linux iptables proxy squid transparent-proxy
Squid 在同一台机器上以拦截模式运行，但浏览器一直拒绝访问

距离我上次接触 squid 已经有一段时间了，过去几个小时以来，我一直坐在这里想解决这个问题，为什么我在这台独立服务器机器上（在路由器 nat 后面）设置的 squid 无法处理来自机器本身的任何传出的 http 请求，并向所有请求抛出拒绝访问消息。我想我可能忽略了一些显而易见的东西，但我无法发现它。你知道这里出了什么问题吗？

% egrep -v "^\s*(#|$)" /etc/squid3/squid.conf
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 intercept
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .       0   20% 4320


% sudo iptables -t nat -nvL  
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 113 packets, 7598 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   25  1500 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT 138 packets, 9098 bytes)
 pkts bytes target     prot opt in     out     source               destination         


% sudo sysctl net.ipv4.ip_forward  
net.ipv4.ip_forward = 1

% sudo tail -f /var/log/squid3/access.log
1427233173.711      1 192.168.0.3 TCP_MISS/403 4050 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233173.713      4 192.168.0.3 TCP_MISS/403 4130 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233173.998      1 192.168.0.3 TCP_MISS/403 4082 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233174.000      5 192.168.0.3 TCP_MISS/403 4162 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233189.293      1 192.168.0.3 TCP_MISS/403 4132 GET http://serverfault.com/ - HIER_NONE/- text/html
1427233189.295      5 192.168.0.3 TCP_MISS/403 4212 GET http://serverfault.com/ - HIER_DIRECT/190.93.246.183 text/html

答案1

您需要将本地主机添加到 localnet 定义中。

acl localnet src 127.0.0.1 # localhost 
acl localnet src ::1  # IPv6 localhost

使用防火墙强制在本地主机上进行透明代理访问将需要一些额外的参数来忽略来自 squid 的流量。

相关内容