主页 / user-71197

Flint's questions

Martin Hope
Flint
Asked: 2015-03-25 14:16:41 +0800 CST
  • 0

自从我上次接触 squid 以来已经有一段时间了，自从过去几个小时以来，我一直坐在这里解决这个问题，为什么我在这台独立服务器机器（在路由器 nat 后面）上的 squid 设置无法处理来自机器本身的任何传出 http 请求并在所有请求上抛出拒绝访问消息。我想我可能在这里忽略了一些明显的东西，但我无法发现它。知道这里有什么问题吗？

% egrep -v "^\s*(#|$)" /etc/squid3/squid.conf
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 intercept
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .       0   20% 4320


% sudo iptables -t nat -nvL  
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 113 packets, 7598 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   25  1500 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT 138 packets, 9098 bytes)
 pkts bytes target     prot opt in     out     source               destination         


% sudo sysctl net.ipv4.ip_forward  
net.ipv4.ip_forward = 1

% sudo tail -f /var/log/squid3/access.log
1427233173.711      1 192.168.0.3 TCP_MISS/403 4050 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233173.713      4 192.168.0.3 TCP_MISS/403 4130 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233173.998      1 192.168.0.3 TCP_MISS/403 4082 GET http://serverfault.com/favicon.ico - HIER_NONE/- text/html
1427233174.000      5 192.168.0.3 TCP_MISS/403 4162 GET http://serverfault.com/favicon.ico - HIER_DIRECT/190.93.247.183 text/html
1427233189.293      1 192.168.0.3 TCP_MISS/403 4132 GET http://serverfault.com/ - HIER_NONE/- text/html
1427233189.295      5 192.168.0.3 TCP_MISS/403 4212 GET http://serverfault.com/ - HIER_DIRECT/190.93.246.183 text/html
linux
Martin Hope
Flint
Asked: 2013-09-06 20:58:02 +0800 CST
  • 1

使用以下命令的输出，

% curl -v stackoverflow.com/questions       
* About to connect() to stackoverflow.com port 80 (#0)
*   Trying 198.252.206.16...
* Connected to stackoverflow.com (198.252.206.16) port 80 (#0)
> GET /questions HTTP/1.1
> User-Agent: curl/7.29.0
> Host: stackoverflow.com
> Accept: */*

我可以curl -X GET -H "User-Agent: curl/7.29.0" -H "Host: stackoverflow.com" -H "Accept: */*" 198.252.206.16复制请求，但如何GET /questions在命令中指定？

http
Martin Hope
Flint
Asked: 2012-07-03 06:47:23 +0800 CST
  • 6

我用 tcpdump 捕获了这个数据包，但我不确定如何使用 --hex-string 参数来匹配数据包。有人可以告诉我该怎么做吗？

11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset 0, flags [DF], proto UDP (17), length 37)
    x.x.187.207.1234 > x.x.152.202.6543: [no cksum] UDP, length 9
        0x0000:  f46d 0425 b202 000a b853 22cc 0800 4500  .m.%.....S"...E.
        0x0010:  0025 4b2d 4000 1111 0442 5ebe bbcf 6701  .%[email protected]^...g.
        0x0020:  98ca 697d 6989 0011 0000 ffff ffff 5630  ..i}i.........V0
        0x0030:  3230 3300 0000 0000 0000 0000            203.........
tcpdump iptables packet