Amigos bom dia para todos.
Estou montando um hotspot, e ele ja funciona redondo, mas queria colocar o squid para melhorar a performace.
portanto estou ha alguns dias tentando dar uma velocidade do meu squid3. uso ele como transparente. Quando faço o redirect do iptables
iptables -t nat -I ALTECNOLOGIC -s 10.172.13.11 ! -d 10.172.13.1 -p tcp --dport 80 -j REDIRECT --to-port 8888 ele navega lento, na verdade nao uma lentidão excessiva, mas percebo isso principalmente no youtube, a barra de progresso fica parada e o video vai passando com muitas pausas, quando retiro o redireciomanto, a barra logo se preenche e o video roda que é uma beleza.
ja li muitas coisa sobre isso, uns falam que é do dns outro que o tipo de cache (ufs, aufs, etc) outro ja falam que preciso instalar o squid pelo codigo fonte. me indicaram uma configuração para eu colocar o resolv.conf, mas o resolv.conf sempre muda. Ja peguei mais de um dúzia de exemplos do squid.conf e todos apresentam o mesmo problema. Nao tenho muita experiencia com linux e fico pensando se isso pode ser normal. Peço a ajuda dos colegas para me dar uma mão.
irei deixar minhas confs aqui, como disse antes ja testei varias configurações, entao, se tiver algo muito absurdo me perdoem
so preciso que o squid faço o cache, nao quero algo muito elaborado
Uso o
kubuntu 12.04.1
bind9
isc-dhcp-server
shaper
apache2
root@quiosque:/home/altecnologic# squid3 -v
Squid Cache: Version 3.1.19
configure options: '--build=i686-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid3' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--datadir=/usr/share/squid3' '--sysconfdir=/etc/squid3' '--mandir=/usr/share/man' '--with-cppunit-basedir=/usr' '--enable-inline' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SASL,SMB,YP,DB,POP3,getpwnam,squid_radius_auth,multi-domain-NTLM' '--enable-ntlm-auth-helpers=smb_lm,' '--enable-digest-auth-helpers=ldap,password' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-external-acl-helpers=ip_user,ldap_group,session,unix_group,wbinfo_group' '--enable-arp-acl' '--enable-esi' '--enable-zph-qos' '--enable-wccpv2' '--disable-translation' '--with-logdir=/var/log/squid3' '--with-pidfile=/var/run/squid3.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-linux-netfilter' 'build_alias=i686-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security' --with-squid=/build/buildd/squid3-3.1.19
SQUID.CONF
http_port 8888 transparent
# ACCESS CONTROLS OPTIONS
# ====================
#
acl QUERY urlpath_regex -i cgi-bin \? \.php$ \.asp$ \.shtml$ \.cfm$ \.cfml$ \.phtml$ \.php3$ localhost
acl all src
acl localnet src 10.172.13.0/24 # Your network here
acl localhost src 127.0.0.1/32
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535
acl sslports port 443 563 81 2087 10000
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
acl ym dstdomain .messenger.yahoo.com .psq.yahoo.com
acl ym dstdomain .us.il.yimg.com .msg.yahoo.com .pager.yahoo.com
acl ym dstdomain .rareedge.com .ytunnelpro.com .chat.yahoo.com
acl ym dstdomain .voice.yahoo.com
acl ymregex url_regex yupdater.yim ymsgr myspaceim
http_access deny ym
http_access deny ymregex
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports
http_access allow localhost
http_access allow localnet
http_access deny all
#
# NETWORK OPTIONS
# —————
#
#
# OPTIONS WHICH AFFECT THE CACHE SIZE
# ==============================
#
cache_mem 350 MB
maximum_object_size_in_memory 1282 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir aufs /home/precise/cache 10000 14 256
maximum_object_size 128000 KB
cache_swap_low 95
cache_swap_high 99
#
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
# ==================================
#
access_log /var/log/squid3/access.log
cache_log /cache/cache.log
#cache_log /dev/null
cache_store_log none
logfile_rotate 5
log_icp_queries off
#
# OPTIONS FOR TUNING THE CACHE
# ========================
#
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
# reload-into-ims
refresh_pattern ^gopher: 1440 0% 1440
#refresh_pattern -i \.(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 reload-into-ims ignore-no-cache ignore-private
#refresh_pattern -i \.(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 reload-into-ims ignore-no-cache ignore-private
#refresh_pattern -i \.(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i \.(html|htm|css|js)$ 1440 75% 40320
refresh_pattern -i \.index.(html|htm)$ 0 75% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 1440 90% 10080
#
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
store_avg_object_size 13 KB
#
# HTTP OPTIONS
# ===========
vary_ignore_expire on
#
# ANONIMITY OPTIONS
# ===============
#
request_header_access From deny all
request_header_access Server deny all
request_header_access Link deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
#
# TIMEOUTS
# =======
#
forward_timeout 240 second
connect_timeout 30 second
peer_connect_timeout 5 second
read_timeout 600 second
request_timeout 60 second
shutdown_lifetime 10 second
#
# ADMINISTRATIVE PARAMETERS
# =====================
#
cache_mgr altecnologic
cache_effective_user proxy
cache_effective_group proxy
httpd_suppress_version_string on
visible_hostname Altecnologic
#
ftp_list_width 32
ftp_passive on
ftp_sanitycheck on
#
# DNS OPTIONS
# ==========
#
#dns_timeout 10 seconds
dns_nameservers 127.0.0.1
#10.172.13.1 8.8.8.8 8.8.4.4 # DNS Server
#
# MISCELLANEOUS
# ===========
#
memory_pools off
client_db off
reload_into_ims on
coredump_dir /cache
pipeline_prefetch on
offline_mode off
#
#Marking ZPH
#==========
#zph_mode tos
#zph_local 0x04
#zph_parent 0
#zph_option 136
### END CONFIGURATION ###
strip_query_terms off
pico /etc/dhcp/dhcpd.conf
ddns-update-style none;
default-lease-time 600;
max-lease-time 7200;
log-facility local7;
subnet 10.172.13.0 netmask 255.255.255.0 {
range 10.172.13.10 10.172.13.250;
option domain-name-servers 10.172.13.1,8.8.8.8,8.8.4.4;
option domain-name "altecnologic";
option routers 10.172.13.1;
option broadcast-address 10.172.13.255;
}
pico /etc/bind/named.conf
acl clientes {
127.0.0.0/8;
10.172.13/24;
};
options {
directory "/etc/bind";
allow-query { clientes; };
allow-recursion { clientes; };
};
zone "." IN {
type hint;
file "db.root";
};
zone "localhost" {
type master;
file "db.local";
};
zone "127.in-addr.arpa" {
type master;
file "db.127";
};
zone "0.in-addr.arpa" {
type master;
file "db.0";
};
zone "255.in-addr.arpa" {
type master;
file "db.255";
};
zone "altecnologic" IN {
type master;
file "db.altecnologic";
allow-query { any; };
};
pico /etc/bind/db.altecnologic
$TTL 86400
@ IN SOA altecnologic. postmaster.altecnologic. (
2007111901 ; serial
3600 ; refresh (1 hour)
600 ; retry (10 minutes)
604800 ; expire (2 weeks)
86400 ; minimum (12 hours)
)
NS altecnologic.
@ IN A 10.172.13.1
gw IN A 10.172.13.1
o meu firewall bloquear todo o trafego e manda para a porta do apache
o apache abre uma pagina remota onde o funcionario tem que colocar sua matricula e sua senha
depois de colocar suas credenciais o apache executa um script (aqui acho que é CGI-BIN) no meu servidor, esse script libera a maquina do funcionario para usar a internet.
.