Forum Debian Users Gang

1511677378.007      0 10.0.0.0 TCP_MEM_HIT/200 1128 GET http://crl.microsoft.com/pki/crl/products/tspca.crl - HIER_NONE/- application/pkix-crl
1511677378.053      0 10.0.0.0 TCP_MEM_HIT/200 1165 GET http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl - HIER_NONE/- application/pkix-crl
1511677378.089      0 10.0.0.0 TCP_MEM_HIT/200 1137 GET http://crl.microsoft.com/pki/crl/products/WinPCA.crl - HIER_NONE/- application/pkix-crl
1511677809.457     22 10.0.0.0 TCP_MISS/200 546 GET http://personal.avira-update.com/update/idx/master.idx - ORIGINAL_DST/212.191.241.16 text/plain
1511677809.485     22 10.0.0.0 TCP_MISS/200 57012 GET http://personal.avira-update.com/update/idx/antivirus-15.0.33.24-win-en-us.info.lz - ORIGINAL_DST/212.191.241.16 text/plain
1511677809.671     10 10.0.0.0 TCP_MISS/200 4312 GET http://personal.avira-update.com/update/idx/ave2_sigver-win32-int-8.3.48.102.info.lz - ORIGINAL_DST/212.191.241.16 text/plain
1511677809.688      9 10.0.0.0 TCP_MISS/200 2051 GET http://personal.avira-update.com/update/idx/localdecider_sigver-win32-int-13.0.1.54.info.lz - ORIGINAL_DST/212.191.241.16 text/plain

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl siec src 10.0.0.0/24    # RFC1918 possible internal network
acl gopher proto gopher         # gopher

acl blokowane dstdomain thepiratebay.org rarbg.com 1377x.to
http_access deny blokowane


acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access deny blokowane
http_access allow siec
http_access deny gopher
#http_access deny blacklist
# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 50111
http_port 50121 intercept

#maksymalny rozmiar obiektu na dysku
maximum_object_size 500 MB

# Uncomment and adjust the following to add a disk cache directory.
cache_dir aufs /var/spool/squid 2048 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

#Pamiec dla squid
cache_mem 1024 MB

#maksymalny obiekt w pamieci ram
maximum_object_size_in_memory 256 KB

#metoda odświeżania cache dla pamięci RAM
memory_replacement_policy heap GDSF

#metoda odswiezania cache dla dysku
cache_replacement_policy heap LFUDA

#minimalny rozmiar object dla dysku
#minimum_object_size 0 KB


#poziomy, na których ma następować agresywniejsza wymiana cache
cache_swap_low 90
cache_swap_high 97

#lokalizacja logów
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log

#maska klienta
client_netmask 255.255.255.0

#maksymalny rozmiar wysyłanego nagłówka
#request_header_max_size 1 MB

#maksymalny rozmiar treści zapytania
request_body_max_size 2 MB

#odrzuca niedokończone połączenia
half_closed_clients off

#czas zamkniecia/restartu squida
shutdown_lifetime 10 second

#użytkownic uprawiony do korzystania z proxy
#cache_effective_user proxy

#grupa uprawniona do uzywania cache
#cache_effective_group proxy

#logi bledow
#error_directory /var/log/squid/errors/Polish

#wsparcie dla dns
dns_defnames on

#adresy ip dns
dns_nameservers 8.8.8.8 8.8.4.4

#coś tam z ip
ipcache_size 10240
ipcache_low 90
ipcache_size 97

#buforowanie nazw domen
fqdncache_size 8192

#squid trzyma pamięć dla potencjalnego usera
memory_pools on

#limit zarezerwowanej pamięci
memory_pools_limit 100 MB

#odswiezanie dla obrazkow
refresh_pattern -i \.(gif|tif|tiff|bmp|jpg|jpeg|png|ico) 1440 50% 10080
#odswiezanie dla muzyki
refresh_pattern -i \.(wav|mp3|mp2|wmp|mid) 10080 50%  20160
#odswiezanie dokumentow
refresh_pattern -i \.(txt|pdf|doc|xls|docx|odf|ppt|pptx|bin) 4320 50%  10080
#odswiezanie statycznych elementow stron
refresh_pattern -i \.(css|html|htm) 2880 50% 43200
#odswiezanie filmow
refresh_pattern -i \.(flv|swf|mp4|wmv|) 10080 70% 43200

iptables -t nat -A PREROUTING -i ens9 -s 10.0.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 50121