环境如下:
操作系统:CentOS 6.4
eth0:192.168.100.1 (LAN口)
eth1:200.168.10.1 (WAN口)
一.iptables的配置
1.啟動ip_forward(IP轉發)
修改/etc/sysctl.conf
將net.ipv4.ip_forward = 1
并運行sysctl -p,使之生效
1
|
[root@nagios~] # vim /etc/sysctl.conf
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@nagios ~] # sysctl -p
net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 |
2.清空iptables所有表的規則并查看nat表
1
2
3
4
5
6
7
8
9
10
|
[root@nagios ~] # iptables -F
[root@nagios ~] # iptables -t nat -F
[root@nagios ~] # iptables -t mangle -F
[root@nagios ~] # iptables -t nat -L
Chain PREROUTING (policy ACCEPT) target prot opt source destination
Chain POSTROUTING (policy ACCEPT) target prot opt source destination
Chain OUTPUT (policy ACCEPT) target prot opt source destination
|
3.设置端口重定向
1
|
[root@nagios ~] # iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128
|
#在NAT表的PREROUTING鏈加目標動作REDIRECT,將入站的數據包進行重定向,將80端口重定向到3128端口
4.设置iptables路由DNS数据
1
2
|
[root@nagios~] #iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -p udp --dport 53 -d 202.96.128.86 -j SNAT --to-source 200.168.10.1
[root@nagios~] #iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -p tcp --dport 53 -d 202.96.128.86 -j SNAT --to-source 200.168.10.1
|
說明:可以看出上面DNS是通過服務器的NAT功能來實現,202.96.128.86是外部DNS服務器地址,而200.168.10.1是我們WAN口的IP。如果外部DNS服務器經常變更的話,可以直接將DNS忽略掉:
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -p tcp --dport 53 -j SNAT --to-source 200.168.10.1
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -p udp --dport 53 -j SNAT --to-source 200.168.10.1
5.保存iptables设置及重启iptables服务
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@Nagios ~] # service iptables save
[root@Nagios ~] # service iptables restart
iptables: Saving firewall rules to /etc/sysconfig/iptables :[ OK ]
[root@Nagios ~] # iptables -t nat -L
Chain PREROUTING (policy ACCEPT) target prot opt source destination
REDIRECT tcp -- 192.168.10.0 /24 anywhere tcp dpt:http redir ports 3128
Chain POSTROUTING (policy ACCEPT) target prot opt source destination
SNAT udp -- 192.168.10.0 /24 202.96.128.86 udp dpt:domain to:200.168.10.1
SNAT tcp -- 192.168.10.0 /24 202.96.128.86 tcp dpt:domain to:200.168.10.1
Chain OUTPUT (policy ACCEPT) target prot opt source destination
|
二.Squid的安装与配置
我們使用yum來安裝Squid:
1
|
[root@nagios ~] # yum -y install squid
|
備份squid的配置文件,防止因為配置錯誤
1
|
[root@nagios ~] # cp /etc/squid/squid.conf /etc/squid/squid.conf_bak
|
配置squid.conf
找到
http_port 3128修改成http_port 192.168.100.10:3128 transparent
并添加
1
2
3
4
|
visible_hostname squid acl innet src 192.168.10.0 /24
http_access allow innet http_access deny all |
下面就運行squid -z進行初始化
1
2
|
[root@nagios ~] # squid -z
2013 /05/29 13:41:43| Creating Swap Directories
|
啟動squid代理服務器
1
|
[root@nagios ~] # service squid start
|
重新啟動iptables服務
1
|
[root@nagios ~] # service iptables restart
|
并將squid及iptables設置成開機啟動
1
2
|
[root@nagios ~] # chkconfig --level 35 squid on
[root@nagios ~] # chkconfig --level 35 iptables on
|
其他设置:
隐藏错误页面Squid版本
1
|
httpd_suppress_version_string on |
不记录访问日志
1
2
3
|
cache_store_log none cache_access_log /dev/null
cache_log /dev/null
|
隐藏Header头部信息(3.0以后版本)
1
2
3
4
|
request_header_access Via deny all request_header_access Server deny all request_header_access X-Cache deny all request_header_access X-Cache-Lookup deny all |
如果是2.8之前的版本
1
2
3
4
|
header_access Via deny all header_access Server deny all header_access X-Cache deny all header_access X-Cache-Lookup deny all |