注意：
在传统代理的基础上配置
透明代理需指定网关
1、配置透明代理：
1)修改配置文件:支持透明代理
[[email protected] ~]# vi /etc/squid.conf
http_port 192.168.100.150:3128 transparent ##将http_port 3128修改为支持透明代理
[[email protected] ~]# /etc/init.d/squid reload
[[email protected] ~]# netstat -utpln |grep squid ##端口监听已经修改为内网网卡IP
2)编写防火墙规则：
[[email protected] ~]# iptables -t nat -I PREROUTING -i eth0 -s 192.168.100.0/24 -m multiport -p tcp --dport 80,443,20,21 -j REDIRECT --to 3128 ##端口重定向
[[email protected] ~]# iptables -t nat -A POSTROUTING -o eth1 -s 192.168.100.0/24 -j MASQUERADE
[[email protected] ~]# iptables -t nat -L -n
[[email protected] ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[[email protected] ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT
[[email protected] ~]# iptables -I INPUT -i lo -j ACCEPT
[[email protected] ~]# for i in INPUT FORWARD;do iptables -P $i DROP; done ##设置默认规则
[[email protected] ~]# for i in s d; do iptables -A FORWARD -$i 192.168.100.0/24 -j ACCEPT; done ##控制能被转发的网段
[[email protected] ~]# sed -i ‘/forward/s/0/1/g‘ /etc/sysctl.conf ##开启路由功能
[[email protected] ~]# sysctl -p
3)测试：
取消传统代理
[[email protected] ~]# route del default
[[email protected] ~]# route add default gw 192.168.100.150 ##设置网关
[[email protected] ~]# unset HTTP_PROXY ##取消代理
[[email protected] ~]# unset HTTPS_PROXY
[[email protected] ~]# unset NO_PROXY
2、设置squid的访问控制列表：
[[email protected] ~]# vi /etc/squid/ipb.list
61.135.167.36
:wq
[[email protected] ~]# vi /etc/squid/dblk.list
cn.bing.com
:wq
[[email protected] ~]# vi /etc/squid.conf
acl IPBLK dst "/etc/squid/ipb.list"
acl DMBLK dstdomain "/etc/squid/dblk.list"
acl MYLAN src 192.168.100.0/24
acl MC20 maxconn 20
acl BURL url_regex -i ^rtsp:// ^emule://
acl MFILE urlpath_regex -i \.mp3$ \.mp4$ \.rmvb$
acl WTIME time MTWHF 08:30-17:30
http_access deny MYLAN MFILE
http_access deny MYLAN BURL
http_access deny MYLAN IPBLK
http_access deny MYLAN DMBLK
http_access allow MYLAN WTIME
http_access allow MYLAN MC20
http_access deny all
:wq
[[email protected] ~]# /etc/init.d/squid reload
3.测试。