#本節內容爲配置iptables 與 squid ,並以文件來獲取規則,以方便管理規則。 #接上一個腳本內容,此部分內容需根據需求更改部分內容。 #停止squid服務 systemctl enable squid &> /dev/null systemctl stop squid #編輯squid配置文件 squid_conf_file=/etc/squid/squid.conf mv $squid_conf_file $squid_conf_file.bk cat > $squid_conf_file << EOF acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT #visible_hostname http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager acl allow_all src "/etc/squid/rules/allow_all.squid" http_access allow allow_all acl files urlpath_regex -i \.mp3$ \.avi$ \.exe$ \.rar$ \.zip$ \.mp4$ \.7z$ \.rm$ \.rmvb$ \.qsv$ \.mov$ \.msi$ \.wav$ \.torrent$ \.cab$ \.com$ \.bat$ \.gz$ \.bz2$ \.sys$ \.swf$ http_access deny files acl only_web src "/etc/squid/rules/allow_only_web.squid" http_access allow only_web http_access allow localhost http_access deny all #http_port 3128 transparent http_port 3129 cache_dir aufs /var/spool/squid 10240 16 256 cache_mem 1024 MB maximum_object_size 8 MB minimum_object_size 0 kB maximum_object_size_in_memory 4096 kB acl nocache urlpath_regex -i \.asp$ \.jsp$ no_cache deny nocache acl nogov urlpath_regex -i \.gov\.cn no_cache deny nogov ipcache_size 65535 fqdncache_size 65535 coredump_dir /var/spool/squid cache_log /var/log/squid/cache.log access_log /var/log/squid/access.log cache_store_log /var/log/squid/store.log cache_store_log none logfile_rotate 7 cache_swap_low 85 cache_swap_high 95 error_directory /usr/share/squid/errors/zh-cn cache_mgr [email protected] refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i \.(jpg|jpeg|gif|png|xml|html|htm|css|js|ico) 1440 90% 2880 refresh_pattern -i \.(mp3|mp4|swf|rar|zip) 1440 20% 10080 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 EOF sed -i 's/#visible_hostname/visible_hostname '${host_name}'/g' ${squid_conf_file} sed -i 's/#http_port 3128 transparent/http_port '${lan_ip}':3128 transparent/g' ${squid_conf_file} #configrue iptables #將以下內容複製出來,重新編寫變量,用來日常網絡權限控制! #日常管理腳本策略根據自身要求自行定義。 #-------copy begin--------- modprobe ip_conntrack_ftp modprobe ip_nat_ftp modprobe ip_conntrack echo "1" > /proc/sys/net/ipv4/tcp_syncookies echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/ip_forward read -p "input manager host ip address : " manager_ip #初始腳本時所定義變量,日常管理腳本不需要。 #------管理腳本,自定義變量------- #lan= #lan_ip= #lan_dns1= #lan_dns2= #lan_net= #manager_ip= #wan= #wan_ip= iptables -F iptables -X iptables -Z iptables -F -t nat iptables -X -t nat iptables -Z -t nat iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -d ${lan_ip} -p tcp --dport 3128 -j ACCEPT iptables -A INPUT -s ${manager_ip} -i ${lan} -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i lo -j ACCEPT AICMP="0 3 3/4 4 11 12 18" for TYICMP in ${AICMP} ; do iptables -A INPUT -i ${lan} -p icmp --icmp-type ${TYICMP} -j ACCEPT done iptables -N syn-flood iptables -A INPUT -p tcp --syn -j syn-flood iptables -I syn-flood -p tcp -m limit --limit 1/s --limit-burst 3 -j RETURN iptables -A syn-flood -j DROP iptables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -s ${wan_ip} -p tcp -m multiport --dports 80,443 -j ACCEPT iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s ${lan_dns1} -p udp --dport 53 -j ACCEPT iptables -A FORWARD -s ${lan_dns2} -p udp --dport 53 -j ACCEPT # redirect and SNAT iptables -t nat -A PREROUTING -i ${lan} -p tcp --dport 80 -j REDIRECT --to-ports 3128 read -p "input super subnet! exap 192.168.0.0/22 " lan_sup_subnet iptables -t nat -A POSTROUTING -s ${lan_sup_subnet} -o ${wan} -j SNAT --to-source ${wan_ip} #自定義規則,默認規則爲拒絕,80端口的權限由 squid 管理,不需要添加。 #本通過讀取文件來配置防火牆規則,如,規則文件放在/usr/local/iptabes中。 #規則文件以IP開頭,中間以空格分開,後接備註名稱,格式如:IP地址 使用人 #exap: 允許所有端口通過。 if [ ! -d /usr/local/iptables ] ; then mkdir /usr/local/iptables fi if [ ! -d /etc/squid/rules ] ; then mkdir /etc/squid/rules fi echo "#允許所有端口通過" > /usr/local/iptables/allow_all.rule #管理腳本需自定義文件,不需要此行 echo "$manager_ip it" >> /usr/local/iptables/allow_all.rule #添加IT ALLOW_ALL_RULE=`grep -v "#" /usr/local/iptables/allow_all.rule | awk '{print $1}'` for ALLOW_ALL in ${ALLOW_ALL_RULE} ; do iptables -A FORWARD -s ${ALLOW_ALL} -o ${wan} -j ACCEPT done #同步 squid 配置文件 echo "用戶沒有限制" > /etc/squid/rules/allow_all.squid echo $ALLOW_ALL_RULE | awk -v RS=" " '{print $0}' >> /etc/squid/rules/allow_all.squid #exap: 只允許443,80 通過,但限制 mail關鍵字,如限制 QQ郵箱。但允許服務器8000端口中的mail關鍵字。 echo "#只允許443,80端口通過。並限制“Mmail”,但允許服務器8000端口中的mail關鍵字。 " >> /usr/local/iptables/allow_only_web.rule #管理腳本不需要此行 echo "$manager_ip it" >> /usr/local/iptables/allow_only_web.rule ALLOW_ONLY_WEB_RULE=`grep -v "#" /usr/local/iptables/allow_only_web.rule | awk '{print $1}'` for ALLOW_ONLY_WEB in ${ALLOW_ONLY_WEB_RULE} ; do iptables -A FORWARD -s ${ALLOW_ONLY_WEB} -o ${wan} -j ACCEPT iptables -I FORWARD -d ${ALLOW_ONLY_WEB} -i ${wan} -m string --algo bm --from 40 --to 450 --hex-string "mail" -p tcp ! --sport 8000 -j DROP done #同步 squid 配置文件 echo "允許443,80 通過,但限制 mail關鍵字" > /etc/squid/rules/allow_only_web.squid echo $ALLOW_ONLY_WEB_RULE | awk -v RS=" " '{print $0}' >> /etc/squid/rules/allow_only_web.squid #初始化squid。 sleep 1 squid -z #管理腳本不需要此行 sleep 1 systemctl restart squid.service sleep 5 /sbin/squid -k reconfigure #--------copy end ------------- #日常管理中只需更改/usr/local/iptabes中的規則文件,再運行管理腳本退可! #修改規則時,需在管理腳本與squid配置文件中加入相應規則退可。 #編寫自啓動腳本。 #cat > /usr/lib/systemd/system/ipt.rule.service << EOF #[Unit] #Description=iptables and squid manage script #After=syslog.target network.target nss-lookup.target #[Service] #Type=oneshot #ExecStart=/usr/local/iptables/ipt.rule.sh #[Install] #WantedBy=multi-user.target #EOF #systemctl enable ipt.rule.service
自動安裝squid+iptables上網代理及上網行爲管理腳本(二)。
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.