Forum Debian Users Gang

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface

allow-hotplug eth0
iface eth0 inet static
    address 83.3.xxx.xxx
    netmask 255.255.255.xxx
    broadcast 83.3.xxx.xxx
    gateway 83.3.xxx.xxx

allow-hotplug eth1
iface eth1 inet static
     address 192.168.0.1
     netmask 255.255.255.0

 http_port 192.168.0.1:3128 transparent
cache_access_log /var/log/squid/access.log
cache_mem 32 MB
maximum_object_size_in_memory 64 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
#cache_dir diskd /var/spool/squid 1024 16 256 Q1=90 Q2=110
maximum_object_size 5 MB
cache_swap_low 90
cache_swap_high 95
error_directory /usr/share/squid/errors/Polish
acl siec src 192.168.0.0/24
acl localhost src 127.0.0.1/32
acl all src 0.0.0.0/0.0.0.0
http_access allow siec
http_access allow localhost
http_access deny all
cache_effective_user proxy
cache_effective_group proxy

  # wlaczenie w kernelu forwardowania
echo 1 > /proc/sys/net/ipv4/ip_forward

# czyszczenie starych regul
iptables -F
iptables -X
iptables -t nat -X
iptables -t nat -F

# ustawienie polityki dzialania
iptables -P INPUT DROP #input-strumien wchodzacy; drop-blokada
iptables -P FORWARD DROP #forward-pakiety przechodzace miedzy interfejsami
iptables -P OUTPUT ACCEPT #output-wychodzace przepuszczamy

#zezwolenie na laczenie z naszym zewn ip po shh
iptables -A INPUT -i lo -j ACCEPT #pakiety wchodzace na petle zwrotna puszczamy (loopback 127.0.0.1)
iptables -A FORWARD -o lo -j ACCEPT #pakiety miedzy interfejsami petli zwrotnej puszczamy

iptables -A INPUT -s 0/0 -d 192.168.0.1 -p tcp --dport 10000 -j ACCEPT #puszczamy ruch wchodzacy na port 22 (ssh) po tcp
iptables -A OUTPUT -s 0/0 -d 192.168.0.1 -p tcp --dport 10000 -j ACCEPT

iptables -A INPUT -s 0/0 -d 192.168.0.1 -p tcp --dport 22 -j ACCEPT #puszczamy ruch wchodzacy na port 22 (ssh) po tcp
iptables -A OUTPUT -s 0/0 -d 192.168.0.1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 0/0 -d 192.168.0.1 -p udp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 0/0 -d 192.168.0.1 -p udp --dport 22 -j ACCEPT

#polaczenia nawiazane
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED #utrzymuj stan pakietow wchodzacych
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED #utrzymuj stan pakietow forwardowanych
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED #utrzymuj stan pakietow wychodzacych

#udostepnianie internetu w sieci lokalnej
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE #tworzymy maskarade czyli nat dla sieci
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT #puszczamy miedzy interfejsami ruch z sieci 192.168.0.0

#Transparent proxying squid ---------------------------------------------------------
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 3128
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
#iptables -t nat -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/24 --dport 80 -j DNAT --to-destination 192.168.0.1:8080
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80  -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j REDIRECT --to-port 3128
#iptables -t nat -A OUTPUT -p tcp -m owner --dport 80 --uid-owner squid -j ACCEPT
#iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:3128
#iptables -t nat -A PREROUTING -i eth1 -d 192.168.0.0/255.255.255.0 ACCEPT
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j REDIRECT --to-port 3128
#iptables -A PREROUTING -t nat --in-interface eth0 --protocol tcp --destination-port www \  --jump DNAT --to-destination 192.168.0.1:8080

# tomekc
iptables -t nat -A POSTROUTING -s 192.168.0.10 -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:04:61:55:F8:F5 -j ACCEPT

# aniab
iptables -t nat -A POSTROUTING -s 192.168.0.11 -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:18:F3:0B:1A:C7 -j ACCEPT

# laptop1
iptables -t nat -A POSTROUTING -s 192.168.0.12 -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:1F:16:42:B1:C9 -j ACCEPT

razem 136
drwxrwxrwx  18 root  root   4096 mar  4 07:55 .
drwxr-xr-x   5 root  root   4096 mar  2 14:41 ..
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 00
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 01
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 02
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 03
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 04
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 05
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 06
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 07
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 08
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 09
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0A
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0B
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0C
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0D
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0E
drwxr-x--- 258 proxy proxy  4096 mar  3 14:50 0F
-rw-r-----   1 proxy proxy 57888 mar  4 08:08 swap.state

root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:t
fax:x:21:
voice:x:22:
cdrom:x:24:t
floppy:x:25:t
tape:x:26:
sudo:x:27:
audio:x:29:t
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:t
sasl:x:45:
plugdev:x:46:t
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
libuuid:x:101:
crontab:x:102:
Debian-exim:x:103:
mlocate:x:104:
ssh:x:105:
t:x:1000:
bind:x:106: