install TProxy di Ubuntu Server 10.04

install TProxy di Ubuntu Server 10.04

Sedikit rangkuman mengenai cara install TProxy di Ubuntu Server 10.04
Untuk setingan TProxy dibuat 2 interface dengan mode bridge. Untuk topologinya sbb :

Maksud dibuat mode TProxy (Transparent Proxy) 100% transparent, agar router RB750 akan membaca semua IP yang lewat (IP PC Client) bukan IP Proxy, sehingga akses port 80 bisa dilimit dari mikrotik, jika sudah ada file yang sudah tercache, maka client akan mendapatkan full speed.
Berikut cara installnya:

aptitude install build-essential libcap2-dev libltdl-dev ebtables bridge-utils
cd /usr/src
apt-get build-dep squid3

Edit file /etc/network/interfaces

//
auto lo
iface lo inet loopback

auto br0
iface br0 inet static
address 192.168.0.2
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
bridge_ports eth0 eth1
//
Save..

cd /usr/src/
wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.7.tar.bz2
tar xvfj squid-3.1.7.tar.bz2
cd squid-3.1.7.tar.bz2

Waktunya compile squid


./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=/usr/include --infodir=/usr/share/info --localstatedir=/var --libexecdir=/usr/lib/squid3 --disable-maintainer-mode --disable-dependency-tracking --disable-silent-rules --srcdir=. --datadir=/usr/share/squid3 --sysconfdir=/etc/squid3 --mandir=/usr/share/man --with-cppunit-basedir=/usr --enable-inline --enable-async-io=8 --enable-storeio=ufs,aufs,diskd --enable-removal-policies=lru,heap --enable-delay-pools --enable-cache-digests --enable-underscores --enable-icap-client --enable-follow-x-forwarded-for --enable-auth=basic,digest,ntlm,negotiate --enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SASL,SMB,YP,getpwnam,multi-domain-NTLM --enable-digest-auth-helpers=ldap,password --enable-negotiate-auth-helpers=squid_kerb_auth --enable-external-acl-helpers=ip_user,ldap_group,session,unix_group,wbinfo_group --enable-arp-acl --enable-snmp --with-filedescriptors=65536 --with-large-files --with-default-user=proxy --enable-epoll --enable-linux-netfilter
Install squid

make
make install
Edit file squid.conf

cache_effective_user proxy
cache_effective_group proxy
access_log /var/log/squid3/access.log squid
cache_store_log /var/log/squid3/store.log
cache_log /var/log/squid3/cache.log
error_directory /usr/share/squid3/errors/pt-br
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localhost src ::1/128
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl to_localhost dst ::1/128
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

# Abaixo vou colocar as redes de teste como nos meus desenhos do tuto, mas alterem para o teste de vocês
acl localnet src 186.194.x.0/24
acl localnet src 186.193.x.0/27

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
http_port 3129 tproxy
hierarchy_stoplist cgi-bin ?
cache_dir ufs /var/spool/squid3 30000 64 256
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
#=========================
# Jika ingin ada yg ditambahkan, silahkan dioprek keinginan masing2 :P
#=========================

mkdir -p /var/spool/squid3
chown proxy:proxy /var/spool/squid3
mkdir -p /var/log/squid3
chown proxy:proxy /var/log/squid3

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
echo "net.ipv4.conf.lo.rp_filter = 0" >> /etc/sysctl.conf

touch /root/frw1.sh
masukan script berikut

#!/bin/bash
iptables -F -t mangle
iptables -X -t mangle
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
Selanjutnya buat rules di ebtables, karena proxy dibuat bridge

touch /root/frw2.sh
masukan rules berikut

#!/bin/bash
ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target ACCEPT

ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target ACCEPT

cd /proc/sys/net/bridge/
for i in *
do
echo 0 > $i
done
unset i

chmod 755 /root/frw1.sh /root/frw2.sh
Ubah file /etc/rc.local, menjadi sebagai berikut
/sbin/modprobe xt_TPROXY
/usr/sbin/squid
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
/root/frw1.sh
/root/frw2.sh
/sbin/route add -net 186.194.x.0/24 gw 186.193.x.2
exit 0

Demikian rangkumannya,
hal ini sudah saya lakukan dan ditambahkan dengan script plugin TC3
http://anaktkj-2005.blogspot.com/2010/12/install-thundercache-3-squid-proxy.htm Ok Sip.