主页 / server / 问题 / 678005
Accepted
Flint
Asked: 2015-03-25 14:16:41 +0800 CST

在与浏览器相同的机器上以拦截模式运行的 Squid 不断拒绝访问

  • 772

自从我上次接触 squid 以来已经有一段时间了，自从过去几个小时以来，我一直坐在这里解决这个问题，为什么我在这台独立服务器机器（在路由器 nat 后面）上的 squid 设置无法处理来自机器本身的任何传出 http 请求并在所有请求上抛出拒绝访问消息。我想我可能在这里忽略了一些明显的东西，但我无法发现它。知道这里有什么问题吗？

% egrep -v "^\s*(#|$)" /etc/squid3/squid.conf
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 intercept
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .       0   20% 4320


% sudo iptables -t nat -nvL  
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 113 packets, 7598 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   25  1500 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT 138 packets, 9098 bytes)
 pkts bytes target     prot opt in     out     source               destination         


% sudo sysctl net.ipv4.ip_forward  
net.ipv4.ip_forward = 1

% sudo tail -f /var/log/squid3/access.log
1427233173.711      1 192.168.0.3 TCP_MISS/403 4050 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233173.713      4 192.168.0.3 TCP_MISS/403 4130 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233173.998      1 192.168.0.3 TCP_MISS/403 4082 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233174.000      5 192.168.0.3 TCP_MISS/403 4162 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233189.293      1 192.168.0.3 TCP_MISS/403 4132 GET http://serverfault.com/ - HIER_NONE/- text/html
1427233189.295      5 192.168.0.3 TCP_MISS/403 4212 GET http://serverfault.com/ - HIER_DIRECT/190.93.246.183 text/html
linux

1 个回答

  1. Best Answer

    您需要将本地主机添加到 localnet 定义中。

    acl localnet src 127.0.0.1 # localhost 
acl localnet src ::1  # IPv6 localhost

    使用防火墙强制在 localhost 上进行透明代理访问将需要一些额外的参数来忽略来自 squid 的流量。

    • 1

相关问题