CentOS4下Squid配置简记

CentOS 4.4下Squid配置手记
今天RedHat 9.0下再一次无法自动拔号之后，我一怒一下，删除用了三年RH9.0 安装上了CentOS 4.4，下面是我的配置情况。
一，安装CentOS 4，不用说了。
二，ntsysv，去掉一些不必要的服务
三，配置PPP
#adsl-setup
此处省略了
四，升级一下
#yum update;yum clear 可以出去玩一会了
五，配置NAT
#cat nat.sh
EXIF='ppp0'            
INIF='eth0'
EXNET='172.16.0.0/16'
export EXIF INIF EXNET
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  /sbin/iptables -F
  /sbin/iptables -X
  /sbin/iptables -Z
  /sbin/iptables -P INPUT   DROP
  /sbin/iptables -P OUTPUT  ACCEPT
  /sbin/iptables -P FORWARD ACCEPT
  /sbin/iptables -A INPUT -i lo -j ACCEPT
  /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  /sbin/iptables -A INPUT -i $INIF -j ACCEPT
  /sbin/iptables -A INPUT -i $EXIF -s 192.168.1.0/24 -j DROP
  /sbin/iptables -A INPUT -i $EXIF -s 10.0.0.0/8 -j DROP
  /sbin/iptables -A INPUT -i $EXIF -s $EXNET -j DROP
  /sbin/iptables -A INPUT -i $EXIF -s 127.0.0.0/8 -j DROP
  /sbin/iptables -A INPUT -p TCP -i $INIF --dport 3128:3130 -j ACCEPT
  /sbin/iptables -A INPUT -p TCP --dport 4009:4011 -j ACCEPT
  /sbin/iptables -A INPUT -p TCP  --dport 7001 -j ACCEPT
  /sbin/iptables -A INPUT -p TCP  --dport 8001 -j ACCEPT
  /sbin/iptables -A FORWARD -p udp -i $INIF --dport 8000 -j DROP
  /sbin/iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
  /sbin/iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
  /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
 /sbin/iptables -A INPUT -p TCP  --dport 22 -s 172.16.86.60 -j ACCEPT
 /sbin/iptables -A INPUT -p TCP  --dport 22 -j DROP
   /sbin/iptables -F -t nat
  /sbin/iptables -X -t nat
  /sbin/iptables -Z -t nat
  /sbin/iptables -t nat -P POSTROUTING ACCEPT
  /sbin/iptables -t nat -P PREROUTING  ACCEPT
  /sbin/iptables -t nat -P OUTPUT      ACCEPT
  echo "1" > /proc/sys/net/ipv4/ip_forward
  /sbin/iptables -t nat -A POSTROUTING -s $EXNET -o $EXIF -j MASQUERADE
  /sbin/iptables -t nat -A PREROUTING -i $INIF -p TCP -s $EXNET --dport 80 -j REDIRECT --to-ports 3128
将nat.sh加入到/etc/rc.d/rc.local的启动队列中去。

六，配置squid，基本上用默认的就好了，有的地方还需要修改一下
#yum install squid
#cat squid.conf
http_port 3128
icp_port 3130
udp_outgoing_address 255.255.255.255
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 32 MB
cache_dir ufs /var/spool/squid 8000 16 256
dns_nameservers 202.96.128.68 202.96.134.133
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320
acl all src 0.0.0.0/0.0.0.0
acl inside src 172.16.0.0/255.255.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl CONNECT method CONNECT
acl work_time time MTWHFA 7:30-20:30
acl mmxfile urlpath_regex -i \.mp3$ \.avi$ \.wma$ \.rm$ \.com$ \.iso$ \.exe$
acl msn_allow dstdomain gateway.messenger.hotmail.com
acl reject_sex url_regex -i "/etc/squid/denysite"
acl allow_lan_ip src "/etc/squid/allow_lan_ip"
http_access allow manager
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny mmxfile work_time
http_access deny reject_sex !allow_lan_ip
http_access allow msn_allow inside
http_access allow inside
http_access deny all
http_reply_access allow all
icp_access allow all
cache_mgr wht@local
coredump_dir /var/spool/squid
#下面几个是要加上去的，因为前面nat.sh启用了透明代理，如果squid不支持，将会出错
visible_hostname 172.16.86.253
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

出错现象为：
RROR
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: /

The following error was encountered:

Invalid URL
Some aspect of the requested URL is incorrect. Possible problems:

Missing or incorrect access protocol (should be `http://'' or similar)
Missing hostname
Illegal double-escape in the URL-Path
Illegal character in hostname; underscores are not allowed
Your cache administrator is root.

--------------------------------------------------------------------------------

Generated Wed, 14 Jan 2009 12:21:09 GMT by X.X.X.X (squid/2.5.STABLE6)

七，
#squid -k parse 检查有无错误
#squid -z
#service squid start
***设置错误信息为简体的***
#ln -s /usr/share/squid/errors/Simplify_Chinese errors

八，重启电脑后一切正常。