Setting Proxy Server with ACL and tranparent proxy


Cari bagian visible_hostname dan ubah opsi menjadi seperti berikut pada file konfigurasi /etc/squid/squid.conf agar service dapat berjalan.

visible_hostname smiert

Access Control List
Tambahkan baris berikut pada bagian bawah pada bagian ACL pada squid.conf

acl home_network src 192.168.0.0/24
acl business_hours time M T W H F 9:00-17:00
acl mornings time 08:00-12:00

Tambahkan baris berikut pada bagian atas pada bagian http_access pada squid.conf

http_access allow home_network business_hours mornings

Transparent Proxy
Tambahkan baris berikut pada bagian bawah file komfigurasi /etc/squid/squid.conf

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

Jika Squid server dan firewall pada server yang sama, semua trafik HTTP dari network local di redirect ke firewall pada Squid port 3128 dan hanya firewall yang diizinkan mengakses Internet pada port 80.

# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
-j REDIRECT --to-port 3128
# iptables -A INPUT -j ACCEPT -m state \
--state NEW,ESTABLISHED,RELATED -i eth1 -p tcp \
--dport 3128
# iptables -A OUTPUT -j ACCEPT -m state \
--state NEW,ESTABLISHED,RELATED -o eth0 -p tcp \
--dport 80
# iptables -A INPUT -j ACCEPT -m state \
--state ESTABLISHED,RELATED -i eth0 -p tcp \
--sport 80
# iptables -A OUTPUT -j ACCEPT -m state \
--state ESTABLISHED,RELATED -o eth1 -p tcp \
--sport 80

Jika Squid server dan firewall pada server yang berbeda, ada tiga koneksi :
• Dari Web browser client ke firewall
• Dari firewall ke Squid server
• Squid server ke Web

Squid server mendapatkan data dan me-reply ke firewall yang kemudian me-relay ke Web browser client.

# iptables -t nat -A PREROUTING -i eth1 -s ! 172.16.1.1 \
-p tcp --dport 80 -j DNAT --to 172.16.1.1:8080
# iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 \
-d 192.168.1.100 -j SNAT --to 192.168.1.1
# iptables -A FORWARD -s 192.168.1.0/24 -d 172.16.1.1 \
-i eth1 -o eth1 -m state
--state NEW,ESTABLISHED,RELATED \
-p tcp --dport 8080 -j ACCEPT
# iptables -A FORWARD -d 192.168.1.0/24 -s 172.16.1.1 \
-i eth1 -o eth1 -m state --state ESTABLISHED,RELATED \
-p tcp --sport 8080 -j ACCEPT

Agar service squid berjalan otomatis pada saat booting
# chkconfig squid on

Cara mengontrol service squid dengan
# /etc/init.d/squid { start | stop | status | restart | condrestart | configtest }

Popular posts from this blog

Howto configure boot device order on ILOM

To ensure the system can be installed using the DVD drive, the boot device order in the BIOS has to be configured correctly so that the DVD drive takes precedence over the internal hard drives. 1 Log into the ILOM. 2 Start the system if it is not already running: > start /SYS else reset the system: > reset /SYS 3 Log onto the system’s console: > start /SP/console 4 When prompted, press Esc 2 to enter setup. 5 Once the setup menu has loaded, navigate across to the Boot screen by using the right arrow key. 6 Using the down arrow key, select the Boot Device Priority item and press Enter. 7 Confirm that the item [CD/DVD] is higher in the list than the item [Hard Drive]. The order can be changed by selecting the relevant item and using the +/- keys to move the item up or down in the list. 8 Once the order is correct, save any changes made by pressing Esc and then navigate right to the Exit screen. Select the item Save Changes and Exit and press Enter, then confirm...
Read more

Installing Depot files on HP-UX 11.23 ia64

Download your depot files from http://hpux.connect.org.uk/ based on your machine type. Download it, for example : bash-3.2-ia64-11.23.depot.gz, put it on /tmp. Install it with 2 option : 1. It will display SAM # swinstall -s /tmp/bash-3.2-ia64-11.23.depot.gz 2. It don't display SAM, so you get quick way # swinstall -s /tmp/bash-3.2-ia64-11.23.depot.gz bash Don't forget to install dependencies for this depot file, it's different from Redhat, who will reject rpm that missed dependencies. HP-UX accept all depots without any warning, but you must install dependencies yourself. You can know dependencies on http://hpux.connect.org.uk/, when you download, look at any dependencies for this depot file. Check depot files that already installed on your system # swlist Somehow any error happened when installing from directory another than /tmp, for example : /data. You should register that directory to depot. # cd /data # swreg -l depot `pwd` If it still fails, look at my post before a...
Read more

SAN Switch Config Command

Login via console Fabric OS (swd77) swd77 console login: admin Password: Note: password default is "password" - set hostname swd77:admin> switchName swcdr1 Committing configuration... Done. swcdr1:admin> - set IP Address swcdr1:admin> ipaddrset Ethernet IP Address [192.168.0.25]: 192.168.0.11 Ethernet Subnetmask [255.255.255.0]: Fibre Channel IP Address [0.0.0.0]: Fibre Channel Subnetmask [0.0.0.0]: Gateway IP Address [192.168.0.25]: 0.0.0.0 Issuing gratuitous ARP...Done. 2008/07/14-18:46:43, [WEBD-1007], 494,, INFO, swcdr1, HTTP server will be restarted due to change of IP Address IP address is being changed...Done. Committing configuration...Done. - Configure basic parameter swcdr1:admin> switchDisable swcdr1:admin> configure Configure... Fabric parameters (yes, y, no, n): [no] y Domain: (1..239) [1] 22008/07/14-18:50:40, [FW-1424], 24,, WARNING, swcdr1, Switch status changed from HEALTHY to MARGINAL. 2008/07/14-18:50:40, [FW-1439], 25,, WARNING, swcdr...
Read more