Showing posts with label proxy. Show all posts
Showing posts with label proxy. Show all posts
Saturday, September 22, 2012
Wednesday, November 17, 2010
Restrict internet user in a workgroup
Source
If you have a server with 2003 server installed the users should be on a domain on a work group. Using the domain Directory Services specify a group for the IDs that are allowed access to the internet and a group that is not. Then your internet access is restricted per user as opposed to being PC dependent.
-------------
Just install a proxy server in your window 2003 server and allow the only ip, you want to allow browse internet and many more thing you can configure through proxy
Winproxy has facility to block specific IP address computer in LAN network.
-----------
You need to install a Proxy server in any of your machine. I suggest CCProxy. Install this software in any of your machine, then in other systems, open Internet Explorer, go to Tools > Internet Options > Connections > Lan Settings, here you need to give the IP of the pc where CCProxy is installed, use port 808 (this is default port used by CCProxy).
In CCProxy you can use some kind of filters, from which you can restrict website for a particular user also.
Monday, October 11, 2010
Two NICs (one static IP) to serve as DNS proxy
I have installed 2 NIC on Computer-1 running windows 7. First NIC [internet NIC] has a direct cable internet (no router/modem) and has static IP assigned by the Interent Service Provider.
The first NIC in Computer-1 has Static IP Address / Subnet Mask / Default Gateway / Preferred DNS and Alternate DNS.
If the LAN gateway or DNS settings are wrong, the networking drivers will effectively "search" for them, which is slow. Also, be sure that the crossover NIC on computer-1 and computer-2 are different as previously described, and that the LAN ("crossover") subnet is different from the WAN (internet) subnet.
USing a router
In general, though, tell the router to get its WAN address and DNS servers from your ISP, give it a non-routable LAN address of 192.168.0.1 (example subnet consistent with previous post), and set all the other computers to use the router's LAN IP address as their gateway address, connect all computers to the router, disable ICS, and disable the second NIC on computer-1. If the router supports acting as a DNS proxy, you can set the router's LAN address as the DNS servers for both computers. If not, then just hard-code them to the value provided by your ISP.
You could also use the router's DHCP server to set the LAN IP addresses automatically, but for a small network, hard-coding them isn't any more difficult than using DHCP, and you'll always know which IP address you're on. This also makes using 'hosts' files to define domains for local-server testing possible, since you will always know your local server's fixed IP address.
Linux: amahi as router 2 nics
We call each Amahi server a "Home Digital Assistant" or HDA — like a PDA, for the home.
The Amahi Home Server is designed for home and small office environments where the 'technical support' staff do not want the job!
It is easy to use and offers cross-platform compatibility — PCs, Macs, Linux, iPhones, iPads, Android, Playstation, Xbox, you name it.
The Amahi server is open source and GNU/Linux-based, which means it's rock-solid reliable and virus-free.
This can be done, and it has been done, however, it's not the supported configuration out of the box.
a small mistake can render your data open to the internet. keep that in mind!
- make sure eth0 is on the LAN side (your network). this is important for amahi to work
- hence eth1 is handling the WAN wide of things
- make sure you run a firewall in eth1!!!
we have a router/firewall control module now. so whatever firewall you chose, we can probably make a module in a relatively short time to get it controlled from the networking tab in your HDA
some people recommend shorewall, moonwall, or others.
The only real justification I can see for this is running Amahi as a HTTP proxy and/or PBX.
For the HTTP proxy, so you route in and out of Amahi's one interface. Not hard to do.
For the PBX, it makes sense to put the phones on their own network.
Again, my security background colors my opinion. Don't go this way, even if you are an expert.
Windows 7 - Routing two nics on win7
http://www.mac-net.com/150114.page
http://technet.microsoft.com/es-es/library/cc757959(WS.10).aspx
The first NIC in Computer-1 has Static IP Address / Subnet Mask / Default Gateway / Preferred DNS and Alternate DNS.
Solution
Set up the second "crossover" NIC in computer-1 with a static IP address (like 192.168.0.2).
Set the default gateway of the "crossover" NIC in computer-1 to the IP address of the first "internet" NIC in computer-1. Set its subnet mask to 255.255.255.0.
Since you have no router to do DHCP for your "crossover" network or to server as a DNS proxy, you will need to define the IP address, subnet mask, DNS servers, and default gateway for computer-2.
Give the NIC in computer-2 an IP address that is one number (or more) above the IP address of the "crossover" NIC in computer-1 (like 192.168.0.3).
Set the subnet mask on the computer-2 NIC the same as the "cross-over" NIC subnet mask on computer-1 (we set this to 255.255.255.0).
Set the DNS servers on computer-2 the same as the internet NIC on computer-1. You cannot use "automatic" here. You can use ipconfig on computer-1 to get these numbers if necessary (see below).
Set the default gateway on the computer-2 NIC to the IP address of the "crossover" NIC computer-1.
You can use "ipconfig" from the windows Start-Run-CMD command prompt to display the current settings of each NIC on each computer -- even the settings that do not appear in the network configuration dialog boxes.
It would be easier to configure, maintain, and expand this network if you had a router or a cable modem/router.
"A bit slow" implies problems finding the gateway or problems finding the DNS servers. Double-check both of those settings on computer-2 and double check the gateway setting on the "crossover" NIC of computer-1. With this ICS set-up, the gateway should always be the IP address of the "internet" NIC on computer-1, since that NIC is the "gateway to the internet." Set up the second "crossover" NIC in computer-1 with a static IP address (like 192.168.0.2).
Set the default gateway of the "crossover" NIC in computer-1 to the IP address of the first "internet" NIC in computer-1. Set its subnet mask to 255.255.255.0.
Since you have no router to do DHCP for your "crossover" network or to server as a DNS proxy, you will need to define the IP address, subnet mask, DNS servers, and default gateway for computer-2.
Give the NIC in computer-2 an IP address that is one number (or more) above the IP address of the "crossover" NIC in computer-1 (like 192.168.0.3).
Set the subnet mask on the computer-2 NIC the same as the "cross-over" NIC subnet mask on computer-1 (we set this to 255.255.255.0).
Set the DNS servers on computer-2 the same as the internet NIC on computer-1. You cannot use "automatic" here. You can use ipconfig on computer-1 to get these numbers if necessary (see below).
Set the default gateway on the computer-2 NIC to the IP address of the "crossover" NIC computer-1.
You can use "ipconfig" from the windows Start-Run-CMD command prompt to display the current settings of each NIC on each computer -- even the settings that do not appear in the network configuration dialog boxes.
It would be easier to configure, maintain, and expand this network if you had a router or a cable modem/router.
If the LAN gateway or DNS settings are wrong, the networking drivers will effectively "search" for them, which is slow. Also, be sure that the crossover NIC on computer-1 and computer-2 are different as previously described, and that the LAN ("crossover") subnet is different from the WAN (internet) subnet.
USing a router
In general, though, tell the router to get its WAN address and DNS servers from your ISP, give it a non-routable LAN address of 192.168.0.1 (example subnet consistent with previous post), and set all the other computers to use the router's LAN IP address as their gateway address, connect all computers to the router, disable ICS, and disable the second NIC on computer-1. If the router supports acting as a DNS proxy, you can set the router's LAN address as the DNS servers for both computers. If not, then just hard-code them to the value provided by your ISP.
You could also use the router's DHCP server to set the LAN IP addresses automatically, but for a small network, hard-coding them isn't any more difficult than using DHCP, and you'll always know which IP address you're on. This also makes using 'hosts' files to define domains for local-server testing possible, since you will always know your local server's fixed IP address.
Linux: amahi as router 2 nics
We call each Amahi server a "Home Digital Assistant" or HDA — like a PDA, for the home.
The Amahi Home Server is designed for home and small office environments where the 'technical support' staff do not want the job!
It is easy to use and offers cross-platform compatibility — PCs, Macs, Linux, iPhones, iPads, Android, Playstation, Xbox, you name it.
The Amahi server is open source and GNU/Linux-based, which means it's rock-solid reliable and virus-free.
This can be done, and it has been done, however, it's not the supported configuration out of the box.
a small mistake can render your data open to the internet. keep that in mind!
- make sure eth0 is on the LAN side (your network). this is important for amahi to work
- hence eth1 is handling the WAN wide of things
- make sure you run a firewall in eth1!!!
we have a router/firewall control module now. so whatever firewall you chose, we can probably make a module in a relatively short time to get it controlled from the networking tab in your HDA
some people recommend shorewall, moonwall, or others.
The only real justification I can see for this is running Amahi as a HTTP proxy and/or PBX.
For the HTTP proxy, so you route in and out of Amahi's one interface. Not hard to do.
For the PBX, it makes sense to put the phones on their own network.
Again, my security background colors my opinion. Don't go this way, even if you are an expert.
Windows 7 - Routing two nics on win7
http://www.mac-net.com/150114.page
http://technet.microsoft.com/es-es/library/cc757959(WS.10).aspx
Saturday, July 3, 2010
Bandwidth Limiting HOWTO with tc and iproute2
Sourc
I've seen a lot of requests for a simple howto dealing with bandwidth limiting/"capping" on Linux. I put together a howto yesterday on this which I hope you'll find useful.
I’ve recently optimized the scripts used for bandwidth management in one of our UK facilities and I thought I’d post a quick howto on it.
The full script can be found directly here: http://www.adamsinfo.com/bandwith-li...oute2/#more-15
My setup here is a live feed entering eth0 on this linux router and leaving eth1 into a switch connected to a collection of other servers. This is set up as an unrestricted public router, routing between a /30 on eth0 and a /24 on eth1.
Note: We can’t in any way restrict the amount of traffic that eth0 receives from the outside, so instead we restrict how fast eth0 sends data out, the same applies the other way round. So, if we want to limit the amount of data that the local servers can send, we shape the router’s external interface (eth0). If we want to limit the amount of data that the local servers can receive, we shape the router’s internal interface (eth1)
With Debian Etch on 2.6.x, run:
apt-get install tc iproute2 bc
Then script as follows:
MOre
===========================
By Adam Palmer,
I’ve recently optimized the scripts used for bandwidth management in one of our UK facilities and I thought I’d post a quick howto on it.
Discuss this page here
My setup here is a live feed entering eth0 on this linux router and leaving eth1 into a switch connected to a collection of other servers. This is set up as an unrestricted public router, routing between a /30 on eth0 and a /24 on eth1.
Note: We can’t in any way restrict the amount of traffic that eth0 receives from the outside, so instead we restrict how fast eth0 sends data out, the same applies the other way round. So, if we want to limit the amount of data that the local servers can send, we shape the router’s external interface (eth0). If we want to limit the amount of data that the local servers can receive, we shape the router’s internal interface (eth1)
With Debian Etch on 2.6.x, run:
apt-get install tc iproute2 bc
Then script as follows:
(copy the script from the source)
Complete Story
I've seen a lot of requests for a simple howto dealing with bandwidth limiting/"capping" on Linux. I put together a howto yesterday on this which I hope you'll find useful.
I’ve recently optimized the scripts used for bandwidth management in one of our UK facilities and I thought I’d post a quick howto on it.
The full script can be found directly here: http://www.adamsinfo.com/bandwith-li...oute2/#more-15
My setup here is a live feed entering eth0 on this linux router and leaving eth1 into a switch connected to a collection of other servers. This is set up as an unrestricted public router, routing between a /30 on eth0 and a /24 on eth1.
Note: We can’t in any way restrict the amount of traffic that eth0 receives from the outside, so instead we restrict how fast eth0 sends data out, the same applies the other way round. So, if we want to limit the amount of data that the local servers can send, we shape the router’s external interface (eth0). If we want to limit the amount of data that the local servers can receive, we shape the router’s internal interface (eth1)
With Debian Etch on 2.6.x, run:
apt-get install tc iproute2 bc
Then script as follows:
MOre
===========================
By Adam Palmer,
I’ve recently optimized the scripts used for bandwidth management in one of our UK facilities and I thought I’d post a quick howto on it.
Discuss this page here
My setup here is a live feed entering eth0 on this linux router and leaving eth1 into a switch connected to a collection of other servers. This is set up as an unrestricted public router, routing between a /30 on eth0 and a /24 on eth1.
Note: We can’t in any way restrict the amount of traffic that eth0 receives from the outside, so instead we restrict how fast eth0 sends data out, the same applies the other way round. So, if we want to limit the amount of data that the local servers can send, we shape the router’s external interface (eth0). If we want to limit the amount of data that the local servers can receive, we shape the router’s internal interface (eth1)
With Debian Etch on 2.6.x, run:
apt-get install tc iproute2 bc
Then script as follows:
(copy the script from the source)
# Set some variables
#!/bin/bash
EXT_IFACE=”eth0″
INT_IFACE=”eth1″
TC=”tc”
UNITS=”kbit”
LINE=”10000″ #maximum ext link speed
LIMIT=”5000″ #maximum that we’ll allow
# Set some variables for individual “classes” that we’ll use to shape internal upload speed, i.e. shaping eth0
CLS1_RATE=”200″ # High Priority traffic class has 200kbit
CLS2_RATE=”300″ # Medium Priority class has 300kbit
CLS3_RATE=”4500″ # Bulk class has 4500kbit
# (We’ll set which ones can borrow from which later)
# Set some variables for individual “classes” that we’ll use to shape internal download speed, i.e. shaping eth1
INT_CLS1_RATE=”1000″ #Priority
INT_CLS2_RATE=”4000″ #Bulk
# Delete current qdiscs. i.e. clean up
${TC} qdisc del dev ${INT_IFACE} root
${TC} qdisc del dev ${EXT_IFACE} root
# Attach root qdiscs. We are using HTB here, and attaching this qdisc to both interfaces. We’ll label it “1:0″
${TC} qdisc add dev ${INT_IFACE} root handle 1:0 htb
${TC} qdisc add dev ${EXT_IFACE} root handle 1:0 htb
# Create root classes, with the maximum limits defined
# One for eth1
${TC} class add dev ${INT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}
# One for eth0
${TC} class add dev ${EXT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}
# Create child classes
# These are for our internal interface eth1
# Create a class labelled “1:2″ and give it the limit defined above
${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:2 htb rate ${INT_CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
# Create a class labelled “1:3″ and give it the limit defined above
${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:3 htb rate ${INT_CLS2_RATE}${UNITS} ceil ${INT_CLS2_RATE}${UNITS}
# EXT_IF (upload) now. We also set which classes can borrow and lend.
# This class is guaranteed 200kbit and can burst up to 5000kbit if available
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:2 htb rate ${CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
# This class is guaranteed 300kbit and can burst up to 5000kbit-200kbit=4800kbit if available
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:3 htb rate ${CLS2_RATE}${UNITS} ceil `echo ${LIMIT}-${CLS1_RATE}|bc`${UNITS}
# This class can is guaranteed 4500kbit and can’t burst past it (5000kbit-200kbit-300kbit=4500kbit).
# I.e. even if our bulk traffic goes crazy, the two classes above are still guaranteed availability.
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:4 htb rate ${CLS3_RATE}${UNITS} ceil `echo ${LIMIT}-${CLS1_RATE}-${CLS2_RATE}|bc`${UNITS}
# Add pfifo. Read more about pfifo elsewhere, it’s outside the scope of this howto.
${TC} qdisc add dev ${INT_IFACE} parent 1:2 handle 12: pfifo limit 10
${TC} qdisc add dev ${INT_IFACE} parent 1:3 handle 13: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:2 handle 12: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:3 handle 13: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:4 handle 14: pfifo limit 10
### Done adding all the classes, now set up some rules! ###
# INT_IFACE
# Note the ‘dst’ direction. Traffic that goes OUT of our internal interface and to our servers is out server’s download speed, so SOME_IMPORTANT_IP is allocated to 1:2 class for download.
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_IMPORTANT_IP/32 flowid 1:2
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_OTHER_IMPORTANT_IP/32 flowid 1:2
#All other servers download speed goes to 1:3 – not as important as the above two
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst 0.0.0.0/0 flowid 1:3
# EXT_IFACE
# Prioritize DNS requests
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 53 0xffff flowid 1:2
# SSH is important
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 22 0xffff flowid 1:2
# Our exim SMTP server is important too
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_MAILSERVER/32 match ip sport 25 0xffff flowid 1:3
# The bulk
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src 0.0.0.0/0 flowid 1:4
I have tried not to get bogged down with too many irrelevant details here and would be happy to answer any questions or take any corrections. It’s pretty simple and it works well. Install bmon and you can confirm this yourself. The purpose of this is that I can take a 10mbit connection and limit the traffic to 5mbit ensuring that I don’t break the 95th percentile that I want to maintain at the datacenter. I can increase and decrease this at any time as traffic requires or permits respectively.#!/bin/bash
EXT_IFACE=”eth0″
INT_IFACE=”eth1″
TC=”tc”
UNITS=”kbit”
LINE=”10000″ #maximum ext link speed
LIMIT=”5000″ #maximum that we’ll allow
# Set some variables for individual “classes” that we’ll use to shape internal upload speed, i.e. shaping eth0
CLS1_RATE=”200″ # High Priority traffic class has 200kbit
CLS2_RATE=”300″ # Medium Priority class has 300kbit
CLS3_RATE=”4500″ # Bulk class has 4500kbit
# (We’ll set which ones can borrow from which later)
# Set some variables for individual “classes” that we’ll use to shape internal download speed, i.e. shaping eth1
INT_CLS1_RATE=”1000″ #Priority
INT_CLS2_RATE=”4000″ #Bulk
# Delete current qdiscs. i.e. clean up
${TC} qdisc del dev ${INT_IFACE} root
${TC} qdisc del dev ${EXT_IFACE} root
# Attach root qdiscs. We are using HTB here, and attaching this qdisc to both interfaces. We’ll label it “1:0″
${TC} qdisc add dev ${INT_IFACE} root handle 1:0 htb
${TC} qdisc add dev ${EXT_IFACE} root handle 1:0 htb
# Create root classes, with the maximum limits defined
# One for eth1
${TC} class add dev ${INT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}
# One for eth0
${TC} class add dev ${EXT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}
# Create child classes
# These are for our internal interface eth1
# Create a class labelled “1:2″ and give it the limit defined above
${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:2 htb rate ${INT_CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
# Create a class labelled “1:3″ and give it the limit defined above
${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:3 htb rate ${INT_CLS2_RATE}${UNITS} ceil ${INT_CLS2_RATE}${UNITS}
# EXT_IF (upload) now. We also set which classes can borrow and lend.
# This class is guaranteed 200kbit and can burst up to 5000kbit if available
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:2 htb rate ${CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
# This class is guaranteed 300kbit and can burst up to 5000kbit-200kbit=4800kbit if available
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:3 htb rate ${CLS2_RATE}${UNITS} ceil `echo ${LIMIT}-${CLS1_RATE}|bc`${UNITS}
# This class can is guaranteed 4500kbit and can’t burst past it (5000kbit-200kbit-300kbit=4500kbit).
# I.e. even if our bulk traffic goes crazy, the two classes above are still guaranteed availability.
${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:4 htb rate ${CLS3_RATE}${UNITS} ceil `echo ${LIMIT}-${CLS1_RATE}-${CLS2_RATE}|bc`${UNITS}
# Add pfifo. Read more about pfifo elsewhere, it’s outside the scope of this howto.
${TC} qdisc add dev ${INT_IFACE} parent 1:2 handle 12: pfifo limit 10
${TC} qdisc add dev ${INT_IFACE} parent 1:3 handle 13: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:2 handle 12: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:3 handle 13: pfifo limit 10
${TC} qdisc add dev ${EXT_IFACE} parent 1:4 handle 14: pfifo limit 10
### Done adding all the classes, now set up some rules! ###
# INT_IFACE
# Note the ‘dst’ direction. Traffic that goes OUT of our internal interface and to our servers is out server’s download speed, so SOME_IMPORTANT_IP is allocated to 1:2 class for download.
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_IMPORTANT_IP/32 flowid 1:2
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_OTHER_IMPORTANT_IP/32 flowid 1:2
#All other servers download speed goes to 1:3 – not as important as the above two
${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst 0.0.0.0/0 flowid 1:3
# EXT_IFACE
# Prioritize DNS requests
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 53 0xffff flowid 1:2
# SSH is important
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 22 0xffff flowid 1:2
# Our exim SMTP server is important too
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_MAILSERVER/32 match ip sport 25 0xffff flowid 1:3
# The bulk
${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src 0.0.0.0/0 flowid 1:4
Complete Story
Squid with the delay pools feature
Bandwith limiting HOWTO
- We have 115,2 kbits/s ppp (modem) internet link (115,2/10 = 11,5 kbytes/s).
Note: with eth connections (network card) we would divide 115,2 by 8; with ppp we divide by 10, because of start/stop bits (8 + 1 + 1 = 10). - We have some LAN stations and their users are doing bulk downloads all the time.
- We want web pages to open fast, no matter how many dowloads are happening.
- Our internet interface is ppp0.
- Our LAN interface is eth0.
- Our network is 192.168.1.0/24
Believe it or not, shaping the incoming traffic is an easy task and you don't have to read tons of books about routing or queuing algorithms.
To make it work, we need at least Squid proxy; if we want to fine tune it, we will have to get familiar with ipchains or iptables and CBQ.
To test our efforts, we can install IPTraf.
Of course, the Internet is not only used for downloading files via web pages (http or ftp). Later on, we will deal with limiting bandwidth for Napster, Realaudio, and other possibilities.
So if you have Squid already installed, I must disappoint you -- you need to uninstall it and do it once again with delay pools enabled in the way I explain below.
...
...
I assume that you use IP-masquerade on your LAN so that your users could use IRC, ICQ, e-mail, etc. That's OK, but we must make sure that our LAN users will use our delay pooled Squid to access web pages and use ftp.
We can solve most of these problems by using ipchains (Linux 2.2.x kernels) or iptables (Linux 2.4.x kernels).
/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 3128 -p TCP -j REJECT
/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 8080 -p TCP -j REJECT
We must also make sure that nobody will try to cheat and connect to the internet directly (IP-masquerade) to download web pages:
/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 80 -p TCP -j REDIRECT 8080
If everything is working, we add these lines to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local.
We might think to block ftp traffic (ports 20 and 21) to force our LAN users to use Squid, but it's not a good idea for at least two reasons:
/sbin/iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 3128 -p TCP -j DROP
/sbin/iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 8080 -p TCP -j DROP
We must also make sure that nobody will try to cheat and connect to the internet directly (IP-masquerade) to download web pages:
We might think to block ftp traffic (ports 20 and 21) to force our LAN users to use Squid, but it's not a good idea for at least two reasons:
To make it work, we need at least Squid proxy; if we want to fine tune it, we will have to get familiar with ipchains or iptables and CBQ.
To test our efforts, we can install IPTraf.
2.2. How does it work?
Squid is probably the most advanced HTTP proxy server available for Linux. It can help us save bandwidth in two ways:- The first is a main characteristic of proxy servers -- they keep downloaded web pages, pictures, and other objects in memory or on a disk. So, if two people are requesting the same web page, it isn't downloaded from the internet, but from the local proxy.
- Apart from normal caching, Squid has a special feature called delay pools. Thanks to delay pools, it is possible to limit internet traffic in a reasonable way, depending on so-called 'magic words', existing in any given URL. For example, a magic word could be '.mp3', '.exe' or '.avi', etc. Any distinct part of a URL (such as .avi) can be defined as a magic word.
Of course, the Internet is not only used for downloading files via web pages (http or ftp). Later on, we will deal with limiting bandwidth for Napster, Realaudio, and other possibilities.
3. Installing and Configuring Necessary Software
3.1. Installing Squid with the delay pools feature
As I mentioned before, Squid has a feature called delay pools, which allows us to control download bandwidth. Unfortunately, in most distributions, Squid is shipped without that feature.So if you have Squid already installed, I must disappoint you -- you need to uninstall it and do it once again with delay pools enabled in the way I explain below.
...
...
3.3. Solving remaining problems
OK, we have installed Squid and configured it to use delay pools. I bet nobody wants to be restricted, especially our clever LAN users. They will likely try to avoid our limitations, just to download their favourite mp3s a little faster (and thus causing your headache).I assume that you use IP-masquerade on your LAN so that your users could use IRC, ICQ, e-mail, etc. That's OK, but we must make sure that our LAN users will use our delay pooled Squid to access web pages and use ftp.
We can solve most of these problems by using ipchains (Linux 2.2.x kernels) or iptables (Linux 2.4.x kernels).
3.3.1. Linux 2.2.x kernels (ipchains)
We must make sure that nobody will try to cheat and use a proxy server other than ours. Public proxies usually run on 3128 and 8080 ports:/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 3128 -p TCP -j REJECT
/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 8080 -p TCP -j REJECT
We must also make sure that nobody will try to cheat and connect to the internet directly (IP-masquerade) to download web pages:
/sbin/ipchains -A input -s 192.168.1.1/24 -d ! 192.168.1.1 80 -p TCP -j REDIRECT 8080
If everything is working, we add these lines to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local.
We might think to block ftp traffic (ports 20 and 21) to force our LAN users to use Squid, but it's not a good idea for at least two reasons:
- Squid is a http proxy with ftp support, not a real ftp proxy. It can download from ftp, it can also upload to some ftp, but it can't delete/change name of files on remote ftp servers.
When we block ports 20 and 21, we won't be able to delete/change name of files on remote ftp servers.
- IE5.5 has a bug -- it doesn't use a proxy to retrieve the ftp directory. Instead it connects directly via IP-masquerade.
When we block ports 20 and 21, we won't be able to browse through ftp directories, using IE5.5.
3.3.2. Linux 2.4.x kernels (iptables)
We must make sure that nobody will try to cheat and use a proxy server other than ours. Public proxies usually run on 3128 and 8080 ports:/sbin/iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 3128 -p TCP -j DROP
/sbin/iptables -A FORWARD -s 192.168.1.1/24 -d ! 192.168.1.1 --dport 8080 -p TCP -j DROP
We must also make sure that nobody will try to cheat and connect to the internet directly (IP-masquerade) to download web pages:
/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
If everything is working, we add these lines to the end of our initializing scripts. Usually, it can be /etc/rc.d/rc.local. We might think to block ftp traffic (ports 20 and 21) to force our LAN users to use Squid, but it's not a good idea for at least two reasons:
- Squid is a http proxy with ftp support, not a real ftp proxy. It can download from ftp, it can also upload to some ftp, but it can't delete/change name of files on remote ftp servers.
When we block ports 20 and 21, we won't be able to delete/change name of files on remote ftp servers.
- IE5.5 has a bug -- it doesn't use a proxy to retrieve the ftp directory. Instead it connects directly via IP-masquerade.
When we block ports 20 and 21, our LAN users won't be able to browse through ftp directories, using IE5.5.
Setup a transparent proxy with Squid
Source Thanks,
Squid proxy as a transparent server with Red Hat EL
Main benefit of setting transparent proxy is:
you do not have to setup up individual browsers to work with proxies.
How To: Configure Squid Proxy Server on Fedora
Mission
Squid proxy as a transparent server with Red Hat EL
Main benefit of setting transparent proxy is:
you do not have to setup up individual browsers to work with proxies.
My Setup:
i) System: HP dual Xeon CPU system with 8 GB RAM (good for squid).
ii) Eth0: IP:192.168.1.1
iii) Eth1: IP: 192.168.2.1 (192.168.2.0/24 network (around 150 windows XP systems))
iv) OS: Red Hat Enterprise Linux 4.0 (Following instruction should work with Debian and all other Linux distros)
ii) Eth0: IP:192.168.1.1
iii) Eth1: IP: 192.168.2.1 (192.168.2.0/24 network (around 150 windows XP systems))
iv) OS: Red Hat Enterprise Linux 4.0 (Following instruction should work with Debian and all other Linux distros)
Eth0 connected to internet and eth1 connected to local LAN i.e. system act as router.
Server Configuration
- Step #1 : Squid configuration so that it will act as a transparent proxy
- Step #2 : Iptables configuration
- a) Configure system as router
- b) Forward all http requests to 3128 (DNAT)
- Step #3: Run scripts and start squid service
First, Squid server installed (use up2date squid) and configured by adding following directives to file:
# vi /etc/squid/squid.confModify or add following squid directives:
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lanWhere,
- httpd_accel_host virtual: Squid as an httpd accelerator
- httpd_accel_port 80: 80 is port you want to act as a proxy
- httpd_accel_with_proxy on: Squid act as both a local httpd accelerator and as a proxy.
- httpd_accel_uses_host_header on: Header is turned on which is the hostname from the URL.
- acl lan src 192.168.1.1 192.168.2.0/24: Access control list, only allow LAN computers to use squid
- http_access allow localhost: Squid access to LAN and localhost ACL only
- http_access allow lan: -- same as above --
Here is the complete listing of squid.conf for your reference (grep will remove all comments and sed will remove all empty lines, thanks to David Klein for quick hint ):
# grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d'OR, try out sed (thanks to kotnik for small sed trick)
# cat /etc/squid/squid.conf | sed '/ *#/d; /^ *$/d'Output:
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
hosts_file /etc/hosts
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl purge method PURGE
acl CONNECT method CONNECT
cache_mem 1024 MB
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan
http_access deny all
http_reply_access allow all
icp_access allow all
visible_hostname myclient.hostname.com
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
coredump_dir /var/spool/squidIptables configuration
Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128Here is complete shell script. Script first configure Linux system as router and forwards all http request to port 3128 (Download the fw.proxy shell script):
#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROPSave shell script. Execute script so that system will act as a router and forward the ports:
# chmod +x /etc/fw.proxy
# /etc/fw.proxy
# service iptables save
# chkconfig iptables onStart or Restart the squid:
# /etc/init.d/squid restart
# chkconfig squid onDesktop / Client computer configuration
Point all desktop clients to your eth1 IP address (192.168.2.1) as Router/Gateway (use DHCP to distribute this information). You do not have to setup up individual browsers to work with proxies.
How do I test my squid proxy is working correctly?
See access log file /var/log/squid/access.log:
# tail -f /var/log/squid/access.logAbove command will monitor all incoming request and log them to /var/log/squid/access_log file. Now if somebody accessing a website through browser, squid will log information.
Problems and solutions
a) Windows XP FTP Client
All Desktop client FTP session request ended with an error:
Illegal PORT command.
Illegal PORT command.
I had loaded the ip_nat_ftp kernel module. Just type the following command press Enter and voila!
# modprobe ip_nat_ftpPlease note that modprobe command is already added to a shell script (above).
b) Port 443 redirection
I had block out all connection request from our router settings except for our proxy (192.168.1.1) server. So all ports including 443 (https/ssl) request denied. You cannot redirect port 443, from debian mailing list, "Long answer: SSL is specifically designed to prevent "man in the middle" attacks, and setting up squid in such a way would be the same as such a "man in the middle" attack. You might be able to successfully achive this, but not without breaking the encryption and certification that is the point behind SSL".
Therefore, I had quickly reopen port 443 (router firewall) for all my LAN computers and problem was solved.
c) Squid Proxy authentication in a transparent mode
You cannot use Squid authentication with a transparently intercepting proxy.
Further reading:
- How do I use Iptables connection tracking feature?
- How do I build a Simple Linux Firewall for DSL/Dial-up connection?
- Update: Forum topic discussion: Setting up a transparent proxy with Squid peering to ISP squid server
- Squid, a user's guide
- Squid FAQ
- Transparent Proxy with Linux and Squid mini-HOWTO
How To: Configure Squid Proxy Server on Fedora
Mission
To configure squid for simple proxying without caching anything.
Use Cases - When you want to have control on what people browse on your lan.
- When number of machine is more than the number of IP addresses you can afford to buy.
- When you want to help this holy world in saving some IPV4 addresses
- You have a machine connected directly to internet that you are going to use as a proxy server for other machines on your network.
- The machines on your network are using 192.168.0.0/16 as private address space. You can use anyone/multiple address spaces of the available but for this howto we assume 192.168.0.0/16 as the local network.
- The local IP address of the machine which will run squid proxy server is 192.168.36.204. You can have any IP, but for this howto we assume this.
Controlling Web Access with Squid
This summary is not available. Please
click here to view the post.
Tuesday, June 15, 2010
Advanced Proxy and IPcop
Source
http://tinyurl.com/2dnl7v
http://www.zerina.de/zerina/files/flash/ZERINA-Install.htm
BlockOutTraffic (BOT) tutorial de configuración inicial
(para mIRC, Ares, Emule)
QoS averigua que puertos utiliza el equipo de voz sobre ip y le das en Servicios | Control de Tráfico
Y le asignas una prioridad alta a esos puertos.
Conexión remota....Si el servidor al que se quieren conectar esta fuera de la red que controla ipCop, por lo tanto tendrias que permitir la salida al puerto 3389 (Hasta donde se no es aleatorio) que es el que utiliza.
Mas o menos tienes que definir las direcciones,
Luego el Grupo de direcciones
Y al final el permiso al grupo de direcciones para que puedan accesar libremente al puerto 3389.
Si quieres cambiar el puerto en el cliente lo puedes hacer de la siguiente manera:
Lo mismo aplicaría si usas rdesktop
Configurado un equipo junto con otros dos que prestan servicios (mensajeria jabber y cosas asi) para que tuvieran acceso a todos los puertos 1-65535y me funcionaron todos a excepcion del terminal server, otra cosa cuando paso un scan de puertos me detecta el 3389 pero tan pronto activo el BOT ya no lo hace
Pero tendrias que cambiar el Servidor para que escuche en ese puerto.
Si configurado un Reenvio de puertos en la opción de Firewall que redirecciona las peticiones de tu ip Publica (red) hacia la computadora que estan en tu zona Green.
instalar CLAMAV, o algun antivirus sobre IPCop, crear ruteo persistente para otras subredes accesadas por la LAN que usa como gateway al IPCop
----------------
Addions: Advanced Proxy, URL Filter, el caché de descargas, calamaris reporter, BOT, supongo que es similar al smoothwall solo que el smooth lo trae ya en la distro y uno inicia OPEN, HALFT OPEN o CLOSED, yo iniciaba en CLOSED que asumo es como queda el ipcop justo al montar el BOT, bien, lo instalaré porque es la única forma de que el proveedor no me llame a dar lata por la cantidad de spyware y bichos que salen de algunas de las 55 máquinas. Por tu pregunta deduzco que si hago una enrutada de los puertos 25, 110, 993 (no recuerdo el otro), debería funcionar sin problemas?
No he probado el dns-static, para que cuando digiten “web.local” lleguen a mi webserver local que es la 192.168.0.1, en smooth eso sólo funciona si habilito los puertos del 1024 al último (65535)..
http:\192.168.0.1:445
ipcop.localdomain
====================
http://www.endian.com/en/community/download/iso/
www.brazilfw.com.br
www.pfsense.com basado en FreeBSD y despunta en temas en los que ipcop (o cualquier otro linux) renquea:
bonding y QoS
Advanced Proxy is an add-on module for the popular Linux based firewall distributions IPCop and SmoothWall, extending their web proxy functionality with a lot of versatile and useful additional features.
The package contains a squid binary recompiled with advanced configuration options for maximum flexibility. The Advanced Proxy graphical user interface gives you access to much more settings than the built-in proxy GUI does.
Key features of Advanced Proxy
- Seamless GUI integration for advanced web proxy configuration
- Local user authentication including group based user management
- identd (RFC 1413) authentication
- LDAP authentication including Active Directory, eDirectory and OpenLDAP
- Windows authentication including native Windows domains and Samba
- RADIUS authentication
- Extended cache management
- Web access control by IP and MAC addresses
- Download throttling
- Time based access restrictions
- Classroom extensions for supervising web access by classrooms
- MIME type filter
- Blocking of unauthorized browsers or client software
- Automatic client configuration support (PAC and WPAD)
News
2010-03-18: Advanced Proxy 3.0.5 for IPCop 1.4 and SmoothWall 3.0 available for download.Please try to read the docs first.
Fuente
http://linuxman.blogsome.com/2006/11/17/trabajando-con-ipcop/
IPCop tiene muchos addons que aumentan las características del sistema base. URLFILTER
Uno de ellos es CopFilter, y el motivo principal para instalarlo fue buscar una alternativa antispam (ves Levitha, así es como se combate el spam). Usa una mezcla de SpamAssasin y ClamAV para filtrar el correo electrónico que llega a mi red y lo mejor es que lo hace de manera transparente, no tengo que cambiar nada en los programas de correo electrónico.
Instalar un addon desde Windows en IPCop con WinSCP o Putty:Fuente
http://linuxman.blogsome.com/2006/11/17/trabajando-con-ipcop/
IPCop tiene muchos addons que aumentan las características del sistema base. URLFILTER
Uno de ellos es CopFilter, y el motivo principal para instalarlo fue buscar una alternativa antispam (ves Levitha, así es como se combate el spam). Usa una mezcla de SpamAssasin y ClamAV para filtrar el correo electrónico que llega a mi red y lo mejor es que lo hace de manera transparente, no tengo que cambiar nada en los programas de correo electrónico.
http://tinyurl.com/2dnl7v
http://www.zerina.de/zerina/files/flash/ZERINA-Install.htm
BlockOutTraffic (BOT) tutorial de configuración inicial
(para mIRC, Ares, Emule)
QoS averigua que puertos utiliza el equipo de voz sobre ip y le das en Servicios | Control de Tráfico
Y le asignas una prioridad alta a esos puertos.
Conexión remota....Si el servidor al que se quieren conectar esta fuera de la red que controla ipCop, por lo tanto tendrias que permitir la salida al puerto 3389 (Hasta donde se no es aleatorio) que es el que utiliza.
Mas o menos tienes que definir las direcciones,
Luego el Grupo de direcciones
Y al final el permiso al grupo de direcciones para que puedan accesar libremente al puerto 3389.
Si quieres cambiar el puerto en el cliente lo puedes hacer de la siguiente manera:
Lo mismo aplicaría si usas rdesktop
Configurado un equipo junto con otros dos que prestan servicios (mensajeria jabber y cosas asi) para que tuvieran acceso a todos los puertos 1-65535y me funcionaron todos a excepcion del terminal server, otra cosa cuando paso un scan de puertos me detecta el 3389 pero tan pronto activo el BOT ya no lo hace
Pero tendrias que cambiar el Servidor para que escuche en ese puerto.
Si configurado un Reenvio de puertos en la opción de Firewall que redirecciona las peticiones de tu ip Publica (red) hacia la computadora que estan en tu zona Green.
instalar CLAMAV, o algun antivirus sobre IPCop, crear ruteo persistente para otras subredes accesadas por la LAN que usa como gateway al IPCop
----------------
Addions: Advanced Proxy, URL Filter, el caché de descargas, calamaris reporter, BOT, supongo que es similar al smoothwall solo que el smooth lo trae ya en la distro y uno inicia OPEN, HALFT OPEN o CLOSED, yo iniciaba en CLOSED que asumo es como queda el ipcop justo al montar el BOT, bien, lo instalaré porque es la única forma de que el proveedor no me llame a dar lata por la cantidad de spyware y bichos que salen de algunas de las 55 máquinas. Por tu pregunta deduzco que si hago una enrutada de los puertos 25, 110, 993 (no recuerdo el otro), debería funcionar sin problemas?
No he probado el dns-static, para que cuando digiten “web.local” lleguen a mi webserver local que es la 192.168.0.1, en smooth eso sólo funciona si habilito los puertos del 1024 al último (65535)..
http:\192.168.0.1:445
ipcop.localdomain
====================
http://www.endian.com/en/community/download/iso/
www.brazilfw.com.br
www.pfsense.com basado en FreeBSD y despunta en temas en los que ipcop (o cualquier otro linux) renquea:
bonding y QoS
Monday, April 27, 2009
Configure proxy to the laptops via script
Source
script to configure proxy to the laptops via startup and shutdown.
i have to install proxy with a startup script when laptop is working in domain and another script to uninstall the proxy settings when laptop goes logoff so the laptop can access internet from another location without proxy enabled
or some script to enable or disable the proxy settings whether the laptop is in the domain or not
proxy via startup script
You can set the proxy in a log on script and remove it in a log off script (set by group policy).
The process can be as simple as a batch file that changes the following registry settings:
i have to install proxy with a startup script when laptop is working in domain and another script to uninstall the proxy settings when laptop goes logoff so the laptop can access internet from another location without proxy enabled
or some script to enable or disable the proxy settings whether the laptop is in the domain or not
proxy via startup script
You can set the proxy in a log on script and remove it in a log off script (set by group policy).
The process can be as simple as a batch file that changes the following registry settings:
Code:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]Then the user will not have the proxy set when not on the domain as the logon script would not run.
"ProxyServer"=":8080"
"ProxyEnable"=dword:00000001
"ProxyOverride"=""
Subscribe to:
Posts (Atom)
LibreOffice
Firefox
OpenSUSE
