squid.conf:
acl localnet src 192.168.10.0/24 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
dns_nameservers 8.8.8.8
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 127.0.0.1:3128 intercept options=NO_SSLv3:NO_SSLv2
https_port 127.0.0.1:3129 intercept ssl-bump options=ALL:NO_SSLv3:NO_SSLv2 connection-auth=off cert=/usr/local/etc/squid/squidCA.pem
always_direct allow all
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
acl blocked ssl::server_name "/etc/squid/blocked_https.txt"
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump terminate blocked
ssl_bump splice all
sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB
cache deny all
ipfw.rules:
#!/bin/sh
cmd="/sbin/ipfw -q"
oif="em0"
oip="10.0.2.15"
iif="em1"
iip="192.168.10.5"
mylan="192.168.10.0/24"
${cmd} -f flush
${cmd} add 1038 allow ip from any to any via lo0
${cmd} add 1039 allow tcp from me to any out via ${oif} keep-state uid squid
${cmd} add 1040 fwd 127.0.0.1,3128 tcp from ${mylan} to any 80 out via ${oif}
${cmd} add 1041 fwd 127.0.0.1,3129 tcp from ${mylan} to any 443 out via ${oif}
${cmd} add 1042 allow ip from any to any via ${iif}
${cmd} nat 1 config if ${oif} reset same_ports deny_in
${cmd} add 1043 nat 1 ip from any to any via ${oif}
Средний
