squid не пускает [решено]

[AlistaM]

Добрый день, подскажите пожалуйста в чем может быть проблема, настроил sams, squid через iptable, но почему то не пускает, выкидывает страничку вот с таким текстом:

Код: [Выделить]

ERROR
The requested URL could not be retrieved

Invalid Request error was encountered while trying to process the request:

    GET / HTTP/1.1
    Host: www.ya.ru
    User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 YB/5.2.3
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: ru-ru,ru;q=0.8,en-us;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate
    Accept-Charset: windows-1251,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 115
    Connection: keep-alive
    Pragma: no-cache
    Cache-Control: no-cache


Some possible problems are:

    Missing or unknown request method.

    Missing URL.

    Missing HTTP Identifier (HTTP/1.0).

    Request is too large.

    Content-Length missing for POST or PUT requests.

    Illegal character in hostname; underscores are not allowed.

    HTTP/1.1 "Expect:" feature is being asked from an HTTP/1.0 software.

Your cache administrator is webmaster.

Generated Fri, 24 Jun 2011 07:45:28 GMT by srproxy.factor.krasnodar.ru (squid/2.7.STABLE9)

в настройках squid поставил:
acl mynet src 192.168.0.0/24
http access allow mynet
в перспективе хочу прикрутить авторизацию по доменным пользователям, но пока хочется чтобы хотя-бы просто заработало. Если без squid просто через iptable пользователей пускаю то все хорошо ходит.

[fisher74]

Код: [Выделить]

grep -v ^# /etc/squid*/squid.conf | sed '/^$/d'
sudo iptables-save

[AlistaM]

squid

(Нажмите, чтобы показать/скрыть)

sudo grep -v ^# /etc/squid*/squid.conf | sed '/^$/d'
acl _sams_default src "/etc/squid/default.sams"
acl _sams_default_time time MTWHFAS 00:00-24:00
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl mynet src 192.168.0.0/24
http_access allow mynet
acl localnet src 10.0.0.0/8   # RFC1918 possible internal network
acl localnet src 172.16.0.0/12   # RFC1918 possible internal network
acl localnet src 192.168.0.0/16   # RFC1918 possible internal network
acl SSL_ports port 443      # https
acl SSL_ports port 563      # snews
acl SSL_ports port 873      # rsync
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443      # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210      # wais
acl Safe_ports port 1025-65535   # unregistered ports
acl Safe_ports port 280      # http-mgmt
acl Safe_ports port 488      # gss-http
acl Safe_ports port 591      # filemaker
acl Safe_ports port 777      # multiling http
acl Safe_ports port 631      # cups
acl Safe_ports port 873      # rsync
acl Safe_ports port 901      # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow _sams_default  _sams_default_time 
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
icp_access allow localnet
icp_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
 cache_dir ufs /var/spool/squid 100 16 256
access_log /var/log/squid/access.log squid
 pid_filename /var/run/squid.pid
refresh_pattern ^ftp:      1440   20%   10080
refresh_pattern ^gopher:   1440   0%   1440
refresh_pattern -i (/cgi-bin/|\?) 0   0%   0
refresh_pattern (Release|Package(.gz)*)$   0   20%   2880
refresh_pattern .      0   20%   4320
acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
upgrade_http0.9 deny shoutcast
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
extension_methods REPORT MERGE MKACTIVITY CHECKOUT
delay_pools 1
delay_class 1 2
delay_access 1 allow _sams_default
delay_access 1 deny all
delay_parameters 1 64000/64000 64000/64000
hosts_file /etc/hosts
coredump_dir /var/spool/squid

iptables

(Нажмите, чтобы показать/скрыть)

sudo iptables-save
# Generated by iptables-save v1.4.4 on Fri Jun 24 11:54:55 2011
*filter
:INPUT ACCEPT [1644:166377]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [914:79936]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 6000:6063 --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -i eth1 -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 53 --dport 1024:65353 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 25 --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 110 --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 143 --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 22 --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 22 --dport 1020:1023 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --sport 21 --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -s 192.168.0.0/24 -i eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth1 -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 53 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 25 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 110 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 143 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1020:1023 --dport 22 -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --sport 1024:65535 --dport 21 -j ACCEPT
COMMIT
# Completed on Fri Jun 24 11:54:55 2011
# Generated by iptables-save v1.4.4 on Fri Jun 24 11:54:55 2011
*nat
:PREROUTING ACCEPT [664:90895]
:OUTPUT ACCEPT [859:72107]
:POSTROUTING ACCEPT [524:48557]
-A PREROUTING ! -d 192.168.0.0/24 -i eth0 -p tcp -m multiport --dports 80,8080 -j REDIRECT --to-ports 3128
-A POSTROUTING -o eth1 -j SNAT --to-source 83.83.83.83
COMMIT
# Completed on Fri Jun 24 11:54:55 2011

[fisher74]

У Вас на squid не включена прозрачность.

[AlistaM]

спасибо точно!!!! поставил http_port 3128 transperent и все заработало!

[fisher74]

Поставьте тег [Решено] в названии темы