ipfilter+squid架好了，QQ和foxmail 却用不了

yanyp

ipfilter+squid架好了，QQ和foxmail 却用不了
在QQ中选http代理测试成功，但QQ要上的话得是tecent的会员
单ipfilter，不启动squid,QQ是可用的
但我一定要squid的，有没有谁搞过呀
freebsd上有三网卡
外rl1 ip:218.85.158.244
内rl0 ip:192.168.1.7 ----接上网服务
内ed0 ip:131.107.3.3 ---向外提供web,mail服务

ipnat.rules:
rdr rl0 0.0.0.0/0 port 80 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 21 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 20 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 443 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 25 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 110 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 1080 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 8000 -> 192.168.1.7 port 3128 tcp/udp

map rl1 131.107.3.0/24 -> 0/32 portmap tcp/udp 30001:60000
map rl1 131.107.3.0/24 -> 0/32 portmap
rdr rl1 218.85.158.244/32 port 80 -> 131.107.3.5 port 80
rdr rl1 218.85.158.244/32 port 25 -> 131.107.3.5 port 25
rdr rl1 218.85.158.244/32 port 110 -> 131.107.3.5 port 110
rdr rl1 218.85.158.244/32 port 21 -> 131.107.3.8 port 69
rdr rl1 218.85.158.244/32 port 20 -> 131.107.3.8 port 20

ipf.rules:
block in log quick all with short
block in log quick all with ipopts
block in log quick all with frag


pass out on rl0 all
pass in on rl0 all
pass out on ed0 all
pass in on ed0 all
pass out quick on lo0 all
pass in quick on lo0 all

block out on rl1 all

block out log on rl1 from any to 192.168.0.0/16
block out log quick on rl1 from any to 0.0.0.0/8
block out log quick on rl1 from any to 169.254.0.0/8
block out log quick on rl1 from any to 10.0.0.0/8
block out log quick on rl1 from any to 127.16.0.0/12
block out log quick on rl1 from any to 192.0.2.0/24
block out log quick on rl1 from any to 204.152.64.0/23
block out log quick on rl1 from any to 224.0.0.0/3

pass out log on rl1 proto tcp/udp from any to any keep state
pass out log on rl1 proto icmp all keep state

block in log on rl1 from 192.168.0.0/16 to any
block in log quick on rl1 from 10.0.0.0/8 to any
block in log quick on rl1 from 172.16.0.0/12 to any
block in log quick on rl1 from 127.0.0.0/8 to any
block in log quick on rl1 from 192.0.2.0/24 to any
block in log quick on rl1 from 169.254.0.0/16 to any
block in log quick on rl1 from 224.0.0.0/3 to any
block in log quick on rl1 from 204.152.64.0/23 to any
block in log quick on rl1 from any to 218.85.158.0/32
block in log quick on rl1 from any to 218.85.158.255/32

pass in quick on rl1 proto tcp from any to 131.107.3.5/32 port=80 flags S/SA keep state
pass in quick on rl1 proto tcp from any to 131.107.3.5/32 port=25 flags S/SA keep state
pass in quick on rl1 proto tcp from any to 131.107.3.5/32 port=110 flags S/SA keep state
pass in quick on rl1 proto tcp from any to 131.107.3.8/32 port=21 flags S/SA keep state
pass in quick on rl1 proto tcp from any to 131.107.3.8/32 port=20 flags S/SA keep state

pass in quick on rl1 proto tcp from any to any flags S/SA keep state
pass in quick on rl1 proto udp from any to any flags S/SA keep state

Freebird

QQ用的什么端口？

yanyp

tecent server用udp 8000端口

yanyp

#ipnat -l
List of active MAP/Redirect filters:
rdr rl0 0.0.0.0/0 port 80 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 21 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 20 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 443 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 25 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 110 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 1080 -> 192.168.1.7 port 3128 tcp/udp
rdr rl0 0.0.0.0/0 port 8000 -> 192.168.1.7 port 3128 tcp/udp
map rl1 131.107.3.0/24 -> 0.0.0.0/32 portmap tcp/udp 30001:60000
rdr rl1 218.85.158.244/32 port 80 -> 131.107.3.5 port 80 tcp
rdr rl1 218.85.158.244/32 port 25 -> 131.107.3.5 port 25 tcp
rdr rl1 218.85.158.244/32 port 110 -> 131.107.3.5 port 110 tcp
rdr rl1 218.85.158.244/32 port 21 -> 131.107.3.8 port 69 tcp
rdr rl1 218.85.158.244/32 port 20 -> 131.107.3.8 port 20 tcp

List of active sessions:
RDR 192.168.1.7     3128  <- -> 202.104.129.251 8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 61.144.238.146  8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 202.104.129.252 8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 61.144.238.145  8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 61.141.194.203  8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 202.104.129.253 8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 202.104.129.254 8000  [192.168.1.13 4000]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1095]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1094]
RDR 192.168.1.7     3128  <- -> 202.101.171.226 80    [192.168.1.13 1092]
RDR 192.168.1.7     3128  <- -> 213.244.183.211 80    [192.168.1.13 1091]
RDR 192.168.1.7     3128  <- -> 218.244.47.34   80    [192.168.1.13 1089]
RDR 192.168.1.7     3128  <- -> 61.152.250.38   80    [192.168.1.13 1088]
RDR 192.168.1.7     3128  <- -> 213.244.183.212 80    [192.168.1.13 1086]
RDR 192.168.1.7     3128  <- -> 61.152.250.38   80    [192.168.1.13 1084]
RDR 192.168.1.7     3128  <- -> 219.238.233.202 80    [192.168.1.13 1083]
RDR 192.168.1.7     3128  <- -> 218.90.147.70   80    [192.168.1.13 1080]
RDR 192.168.1.7     3128  <- -> 61.242.178.228  80    [192.168.1.13 1079]
RDR 192.168.1.7     3128  <- -> 61.151.248.120  80    [192.168.1.13 1076]
RDR 192.168.1.7     3128  <- -> 218.242.245.158 80    [192.168.1.13 1073]
RDR 192.168.1.7     3128  <- -> 218.22.10.242   80    [192.168.1.13 1071]
RDR 192.168.1.7     3128  <- -> 202.96.103.252  80    [192.168.1.13 1069]
RDR 192.168.1.7     3128  <- -> 211.157.2.95    80    [192.168.1.13 1067]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1066]
RDR 192.168.1.7     3128  <- -> 218.9.2.67      80    [192.168.1.13 1063]
RDR 192.168.1.7     3128  <- -> 61.135.135.9    80    [192.168.1.13 1062]
RDR 192.168.1.7     3128  <- -> 211.157.2.96    80    [192.168.1.13 1058]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1057]
RDR 192.168.1.7     3128  <- -> 61.135.135.5    80    [192.168.1.13 1054]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1052]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1051]
RDR 192.168.1.7     3128  <- -> 202.106.127.117 80    [192.168.1.13 1050]

yanyp

客户端用udp 4000 连server udp 8000端口
ipnat -l 可看到client4000已与tecent server端8000建立了连结
但为啥不行呢?

yanyp

搞定了
rdr rl0 0.0.0.0/8 port -> 192.168.1.7 port 3128 tcp/udp
对http请求转发到3128端口，经squid
map rl1 192.168.1.0/24 -> 0/32 portmap tcp/udp 10000:30000
map rl1 192.168.1.0/24 -> 0/32
对其他请求直接出去