Proxy merupakan aplikasi yang di dalam Debian Woody, aplikasi ini digunakan untuk memblokir
situs-situs yang tidak diperkenankan untuk masuk atau melewati server atau router yang kita
konfigurasi. Dengan tak panjang lebar, langsung saja saya jabarkan sederetan command konfigurasi
proxy.
Sebelum kita melakukan konfigurasi, lakukan terlebih dahulu installasi paket yang kita perlukan
dalam konfigurasi proxy server, paket yang kita butuhkan ialah“squid”.
# apt-get install squid
Tunggu sejenak hingga proses installasi squid selesai.
Nah kalo installasi squid sudah berhasil, lakukan konfigurasi file“squid.conf”. File squid.conf ada di
directory /etc/, jadi terlebih dahulu masuk ke direktory /etc/.
# cd /etc/
Nah kalo sudah masuk, buka dan edit file squid.conf. Original file squid.conf sebagai berikut :
# WELCOME TO SQUID 2
# ——————
#
# This is the default Squid configuration file. You may wish
# to look at the Squid home page (http://www.squid-cache.org/)
# for the FAQ and other documentation.
#
# The default Squid config file shows what the defaults for
# various options happen to be. If you don’t need to change the
# default, you shouldn’t uncomment the line. Doing so may cause
# run-time problems. In some cases “none” refers to no default
# setting at all, while in other cases it refers to a valid
# option – the comments for that keyword indicate if this is the
# case.
#
# ——————
#
# This is the default Squid configuration file. You may wish
# to look at the Squid home page (http://www.squid-cache.org/)
# for the FAQ and other documentation.
#
# The default Squid config file shows what the defaults for
# various options happen to be. If you don’t need to change the
# default, you shouldn’t uncomment the line. Doing so may cause
# run-time problems. In some cases “none” refers to no default
# setting at all, while in other cases it refers to a valid
# option – the comments for that keyword indicate if this is the
# case.
#
# NETWORK OPTIONS
# —————————————————————————–
# TAG: http_port
# Usage: port
# hostname:port
# 1.2.3.4:port
#
# The socket addresses where Squid will listen for HTTP client
# requests. You may specify multiple socket addresses.
# There are three forms: port alone, hostname with port, and
# IP address with port. If you specify a hostname or IP
# address, then Squid binds the socket to that specific
# address. This replaces the old ‘tcp_incoming_address’
# option. Most likely, you do not need to bind to a specific
# address, so you can use the port number alone.
#
# The default port number is 3128.
#
# If you are running Squid in accelerator mode, then you
# probably want to listen on port 80 also, or instead.
#
# The -a command line option will override the *first* port
# number listed here. That option will NOT override an IP
…
# —————————————————————————–
# TAG: http_port
# Usage: port
# hostname:port
# 1.2.3.4:port
#
# The socket addresses where Squid will listen for HTTP client
# requests. You may specify multiple socket addresses.
# There are three forms: port alone, hostname with port, and
# IP address with port. If you specify a hostname or IP
# address, then Squid binds the socket to that specific
# address. This replaces the old ‘tcp_incoming_address’
# option. Most likely, you do not need to bind to a specific
# address, so you can use the port number alone.
#
# The default port number is 3128.
#
# If you are running Squid in accelerator mode, then you
# probably want to listen on port 80 also, or instead.
#
# The -a command line option will override the *first* port
# number listed here. That option will NOT override an IP
…
Lakukan pengeditan file squid.conf seperti berikut :
Dalam keadaan file squid.conf masih terbuka, tekan tombol F7, kemudian input kalimat“INSERT
YOUR OWN RULE”dan tekan tombol“ENTER” setelah layar menampilkan baris INSERT YOUR OWN
RULE…, seperti berikut :
YOUR OWN RULE”dan tekan tombol“ENTER” setelah layar menampilkan baris INSERT YOUR OWN
RULE…, seperti berikut :
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
#
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# And finally deny all other access to this proxy
http_access deny all
# TAG: icp_access
# Allowing or Denying access to the ICP port based on defined
# access lists
#
# icp_access allow|deny [!]aclname …
#
# See http_access for details
#
# Default:
# icp_access deny all
#
#Allow ICP queries from eveyone
icp_access allow all
# TAG: miss_access
#Use to force your neighbors to use you as a sibling instead of
#a parent. For example:
#
#acl localclients src 172.16.0.0/16
#miss_access allow localclients
#miss_access deny !localclients
#
#This means that only your local clients are allowed to fetch
# Allowing or Denying access to the ICP port based on defined
# access lists
#
# icp_access allow|deny [!]aclname …
#
# See http_access for details
#
# Default:
# icp_access deny all
#
#Allow ICP queries from eveyone
icp_access allow all
# TAG: miss_access
#Use to force your neighbors to use you as a sibling instead of
#a parent. For example:
#
#acl localclients src 172.16.0.0/16
#miss_access allow localclients
#miss_access deny !localclients
#
#This means that only your local clients are allowed to fetch
Tambahkan command konfigurasi sebagai berikut :
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
acl localnet src 192.168.1.0/24
http_access allow localhost
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
acl localnet src 192.168.1.0/24
http_access allow localhost
acl larang url_regex -i “/etc/larang”
http_access deny larang
http_access allow localnet
# And finally deny all other access to this proxy
http_access deny all
# TAG: icp_access
#Allowing or Denying access to the ICP port based on defined
#access lists
Tekan lagi tombol F7 dan inputkan kalimat“httpd_accel”, layar akan menampilkan command
sebagai berikut :
# HTTPD-ACCELERATOR OPTIONS
#—————————————————————————–
http_access deny larang
http_access allow localnet
# And finally deny all other access to this proxy
http_access deny all
# TAG: icp_access
#Allowing or Denying access to the ICP port based on defined
#access lists
Tekan lagi tombol F7 dan inputkan kalimat“httpd_accel”, layar akan menampilkan command
sebagai berikut :
# HTTPD-ACCELERATOR OPTIONS
#—————————————————————————–
# TAG: httpd_accel_host # TAG: httpd_accel_port #
If you want to run Squid as an httpd accelerator, define the
#host name and port number where the real HTTP server is.
#
#If you want virtual host support then specify the hostname
#as “virtual”.
#
#If you want virtual port support then specify the port as “0″.
#
#NOTE: enabling httpd_accel_host disables proxy-caching and
#ICP. If you want these features enabled also, then set
#the ‘httpd_accel_with_proxy’ option.
If you want to run Squid as an httpd accelerator, define the
#host name and port number where the real HTTP server is.
#
#If you want virtual host support then specify the hostname
#as “virtual”.
#
#If you want virtual port support then specify the port as “0″.
#
#NOTE: enabling httpd_accel_host disables proxy-caching and
#ICP. If you want these features enabled also, then set
#the ‘httpd_accel_with_proxy’ option.
#
#Default:
# httpd_accel_port 80
# TAG: httpd_accel_single_host on|off
#If you are running Squid as a accelerator and have a single backend
#server then set this to on. This causes Squid to forward the request
#to this server irregardles of what any redirectors or Host headers
#says.
#
#Leave this at off if you have multiple backend servers, and use a
#redirector (or host table or private DNS) to map the requests to the
#appropriate backend servers. Note that the mapping needs to be a
#1-1 mapping between requested and backend (from redirector) domain
#names or caching will fail, as cacing is performed using the
#URL returned from the redirector.
#
#See also redirect_rewrites_host_header.
#
#Default:
# httpd_accel_single_host off
# TAG: httpd_accel_with_proxy on|off
Lakukan penambahan command atau konfigurasi sebagai berikut :
# HTTPD-ACCELERATOR OPTIONS
#—————————————————————————–
#Default:
# httpd_accel_port 80
# TAG: httpd_accel_single_host on|off
#If you are running Squid as a accelerator and have a single backend
#server then set this to on. This causes Squid to forward the request
#to this server irregardles of what any redirectors or Host headers
#says.
#
#Leave this at off if you have multiple backend servers, and use a
#redirector (or host table or private DNS) to map the requests to the
#appropriate backend servers. Note that the mapping needs to be a
#1-1 mapping between requested and backend (from redirector) domain
#names or caching will fail, as cacing is performed using the
#URL returned from the redirector.
#
#See also redirect_rewrites_host_header.
#
#Default:
# httpd_accel_single_host off
# TAG: httpd_accel_with_proxy on|off
Lakukan penambahan command atau konfigurasi sebagai berikut :
# HTTPD-ACCELERATOR OPTIONS
#—————————————————————————–
# TAG: httpd_accel_host # TAG: httpd_accel_port #
If you want to run Squid as an httpd accelerator, define the
#host name and port number where the real HTTP server is.
#
#If you want virtual host support then specify the hostname
#as “virtual”.
#
#If you want virtual port support then specify the port as “0″.
#
#NOTE: enabling httpd_accel_host disables proxy-caching and
#ICP. If you want these features enabled also, then set
#the ‘httpd_accel_with_proxy’ option.
#
#Default:
# httpd_accel_port 80
If you want to run Squid as an httpd accelerator, define the
#host name and port number where the real HTTP server is.
#
#If you want virtual host support then specify the hostname
#as “virtual”.
#
#If you want virtual port support then specify the port as “0″.
#
#NOTE: enabling httpd_accel_host disables proxy-caching and
#ICP. If you want these features enabled also, then set
#the ‘httpd_accel_with_proxy’ option.
#
#Default:
# httpd_accel_port 80
httpd_accel_port 80
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
# TAG: httpd_accel_single_host on|off
#If you are running Squid as a accelerator and have a single backend
#server then set this to on. This causes Squid to forward the request
#to this server irregardles of what any redirectors or Host headers
#says.
Terakhir simpan file tersebut dengan menekan tombol F2 dan keluar dengan menekan tombol F10
Berikut lakukan kembali konfigurasi-konfigurasi beserta penambahan file. Tahap selanjutnya kita
akan membuat sebuah file yang berisikan alamat-alamat yang akan kita blok (tidak boleh masuk).
Masih di direktori /etc/ ciptakan file“larang” hal ini sesuai dengan konfigurasi kita pada baris“acl
larang url_regex–i“/etc/larang”
acl larang url_regex -i “/etc/larang”
#mcedit larang
Kemudian inputkan alamat-alamat yang akan kita blok. Contoh alamat yang kita blok :
google.com
yahoo.com
Maka langsung saja ketikkan :
yahoo
google
Kemudian simpan file tersebut. Tekan tombol F2 kemudian keluar tekan tombol F10
Sekarang kita tinggal mengesetkan atau mengkonfigurasi command“iptables”. Langsung saja
lakukan perintah seperti berikut :
…/etc#iptables -t nat -A PREROUTING -s 192.168.1.1/255.255.255.0 -p tcp –port 80 -j REDIRECT –to-
port 3128
Selanjutnya kita permanenkan iptables kita, jangan sampai lupa untuk menyimpannya, karena bila
kita tidak menyimpannya, maka apabila komputer reboot, konfigurasi iptables hilang.
Untuk menyimpannya buat terlebih dulu filedimana nantinya untuk menyimpan atau meletakkan
konfigurasi iptables.
Di sini kita buat file“myiptables” untuk tempat menyimpan konfigurasi iptables
../etc#touch myiptables
Lanjut ketikkan perintah berikut untuk menyimpan konfigurasi iptables :
#iptables-save >myiptables
Kemudian buat sebuah file sebagai aplikasi untuk loading file myiptables :
#mcedit iptablesload
Kemudian ketikkan script berikut :
iptables-restore /dev/null 2>&1
Simpan file tersebut dengan tombol F2 dan keluar dengan F10. Berikan permission atau izin untuk
file tersebut dengan perintah :
#chmod 75 iptablesload#cd rc.boot#mcedit startup
#!/bin/sh
/etc/iptablesload755 startup#chmod 755 startup#/etc/init.d/squid restart 55 iptablesload
Masih di direktori /etc#, masuk ke direktory“rc.boot”
#cd rc.boot
Nah di sini buatlah file“startup” dan isikan file tersebut :
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
# TAG: httpd_accel_single_host on|off
#If you are running Squid as a accelerator and have a single backend
#server then set this to on. This causes Squid to forward the request
#to this server irregardles of what any redirectors or Host headers
#says.
Terakhir simpan file tersebut dengan menekan tombol F2 dan keluar dengan menekan tombol F10
Berikut lakukan kembali konfigurasi-konfigurasi beserta penambahan file. Tahap selanjutnya kita
akan membuat sebuah file yang berisikan alamat-alamat yang akan kita blok (tidak boleh masuk).
Masih di direktori /etc/ ciptakan file“larang” hal ini sesuai dengan konfigurasi kita pada baris“acl
larang url_regex–i“/etc/larang”
acl larang url_regex -i “/etc/larang”
#mcedit larang
Kemudian inputkan alamat-alamat yang akan kita blok. Contoh alamat yang kita blok :
google.com
yahoo.com
Maka langsung saja ketikkan :
yahoo
Kemudian simpan file tersebut. Tekan tombol F2 kemudian keluar tekan tombol F10
Sekarang kita tinggal mengesetkan atau mengkonfigurasi command“iptables”. Langsung saja
lakukan perintah seperti berikut :
…/etc#iptables -t nat -A PREROUTING -s 192.168.1.1/255.255.255.0 -p tcp –port 80 -j REDIRECT –to-
port 3128
Selanjutnya kita permanenkan iptables kita, jangan sampai lupa untuk menyimpannya, karena bila
kita tidak menyimpannya, maka apabila komputer reboot, konfigurasi iptables hilang.
Untuk menyimpannya buat terlebih dulu filedimana nantinya untuk menyimpan atau meletakkan
konfigurasi iptables.
Di sini kita buat file“myiptables” untuk tempat menyimpan konfigurasi iptables
../etc#touch myiptables
Lanjut ketikkan perintah berikut untuk menyimpan konfigurasi iptables :
#iptables-save >myiptables
Kemudian buat sebuah file sebagai aplikasi untuk loading file myiptables :
#mcedit iptablesload
Kemudian ketikkan script berikut :
iptables-restore /dev/null 2>&1
Simpan file tersebut dengan tombol F2 dan keluar dengan F10. Berikan permission atau izin untuk
file tersebut dengan perintah :
#chmod 75 iptablesload#cd rc.boot#mcedit startup
#!/bin/sh
/etc/iptablesload755 startup#chmod 755 startup#/etc/init.d/squid restart 55 iptablesload
Masih di direktori /etc#, masuk ke direktory“rc.boot”
#cd rc.boot
Nah di sini buatlah file“startup” dan isikan file tersebut :
#mcedit startup
#!/bin/sh
/etc/iptesloadabl
Save file tersebut dengan F2 dan keluar F10.
Berikut berikan permission untuk file startup :
#chmod 755 startup
Terakhir restart squid dengan perintah :
#/etc/init.d/squid restart
#!/bin/sh
/etc/iptesloadabl
Save file tersebut dengan F2 dan keluar F10.
Berikut berikan permission untuk file startup :
#chmod 755 startup
Terakhir restart squid dengan perintah :
#/etc/init.d/squid restart
0 comments:
Post a Comment