Люди добрые, помогите.Собираю кеширующий firewall. Сам firewall заработал. Все нормально. Но вот squid дружить с ним не хочет.
Поставил frebsd 5.4, далее пересобрал ядро, поправил конфиги, запустил bind, установил squid, все работает кроме squid. На машине клиента выпадает страница squid об ошибке.
С сервера браузер lynx страницы открывает.
Если в rc.conf убрать строку форварда по порту 3128 то машина честно исполняет свои функции.
Просмотрел доки и формумы, ничего не помогает, может я не вижу ошибку.
Привожу примеры конфиг файлов.
часть из конфигурации ядра
----------------------------------------------
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=10
options IPDIVERT
options IPFIREWALL_FORWARD
options TCP_DROP_SYNFIN
----------------------------------------------
rc.conf
----------------------------------------------
hostname="host.ru"
defaultrouter="217.217.217.217"
gateway_enable="YES"
ifconfig_rl0="inet 217.217.217.212 netmask 255.255.255.240"
ifconfig_rl1="inet 192.168.5.1 netmask 255.255.255.0"
inetd_enable="YES"
sshd_enable="YES"
named_enable="YES"
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_type="ST"
natd_program="/sbin/natd"
natd_enable="YES"
natd_interface="rl0"
natd_flags="-f /etc/natd.conf"
-----------------------------------------------
rc.firewall
-----------------------------------------------
[Ss][Tt])
ipfw="/sbin/ipfw -q"
${ipfw} add fwd 127.0.0.1,3128 tcp from 192.168.5.0/24 to any 80
${ipfw} add divert natd ip from 192.168.5.0/24 to any out via rl0
${ipfw} add divert natd ip from any to x.X.X.212 in via rl0
${ipfw} add pass all from any to any
;;
--------------------------------------------
natd.conf
--------------------------------------------
log yes
log_denied no
use_sockets yes
same_ports yes
unregistered_only yes
dynamic yes
--------------------------------------------
squid.conf
--------------------------------------------
http_port 3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_dir ufs /usr/local/squid/var/cache 100 16 256
access_log /usr/local/squid/var/logs/access.log squid
cache_log /usr/local/squid/var/logs/cache.log
cache_store_log /usr/local/squid/var/logs/store.log
refresh_pattern ^ftp: &n... 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl our_networks src 192.168.5.0/255.255.255.0
http_access allow our_networks
http_access deny all
http_reply_access allow all
icp_access allow all
cache_effective_user nobody
cache_effective_group nogroup
error_directory /usr/local/squid/share/errors/Russian-1251
coredump_dir /usr/local/squid/var/cache
--------------------------------------------
access.log
--------------------------------------------
1156517350.911 1 192.168.5.20 TCP_DENIED/400 1541 GET error:invalid-request - NONE/- text/html
1156521340.636 1 192.168.5.20 TCP_DENIED/400 1863 GET error:invalid-request - NONE/- text/html
1156522129.855 1 192.168.5.20 TCP_DENIED/400 1536 GET error:invalid-request - NONE/- text/html
--------------------------------------------
store.log
--------------------------------------------
1156518216.161 RELEASE -1 FFFFFFFF C1BBFD153BA30746972ACCBBB99134FC 400 1156518216 0 1156518216 text/html 1421/1421 GET error:invalid-request
1156521340.636 RELEASE -1 FFFFFFFF E4392E8E1EB6C2F8D383AC9772B21436 400 1156521340 0 1156521340 text/html 1863/1863 GET error:invalid-request
1156522129.855 RELEASE -1 FFFFFFFF 6FFCB93DFA4F13AFC1D50963F8CC93B9 400 1156522129 0 1156522129 text/html 1536/1536 GET error:invalid-request
--------------------------------------------
cache.log
--------------------------------------------
2006/08/25 15:54:57| Reconfiguring Squid Cache (version 2.6.STABLE3)...
2006/08/25 15:54:57| FD 9 Closing HTTP connection
2006/08/25 15:54:57| FD 11 Closing ICP connection
2006/08/25 15:54:57| Cache dir '/usr/local/squid/var/cache' size remains unchanged at 102400 KB
2006/08/25 15:54:57| DNS Socket created at 0.0.0.0, port 52935, FD 8
2006/08/25 15:54:57| Adding domain host.ru from /etc/resolv.conf
2006/08/25 15:54:57| Adding nameserver 192.168.5.1 from /etc/resolv.conf
2006/08/25 15:54:57| Adding nameserver 217.217.217.212 from /etc/resolv.conf
2006/08/25 15:54:57| Adding nameserver 217.217.217.5 from /etc/resolv.conf
2006/08/25 15:54:57| Accepting proxy HTTP connections at 0.0.0.0, port 3128, FD 9.
2006/08/25 15:54:57| Accepting ICP messages at 0.0.0.0, port 3130, FD 11.
2006/08/25 15:54:57| WCCP Disabled.
2006/08/25 15:54:57| Loaded Icons.
2006/08/25 15:54:57| Ready to serve requests.
2006/08/25 15:55:40| clientReadRequest: FD 13 Invalid Request
2006/08/25 16:08:49| clientReadRequest: FD 13 Invalid Request
2006/08/25 16:08:49| clientReadRequest: FD 13 Invalid Request
--------------------------------------------
