Linux-如何控制内网用户访问网站和下载资源

红太狼 2023-07-18 14:26 3阅读 0赞

本文的访问控制是基于正向代理缓存服务之上的，如果不知道Squid服务或不是使用正向代理缓存的，请绕道！！！

## 环境配置 ##

**服务器主机**：

*  **外网网卡**：桥接模式 自动获取IP地址
 *  **内网网卡**：仅主机模式 `192.168.10.10`

**客户端主机**：

*  **内网网卡**：`192.168.10.20`

**检测网络连通性：**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 2]

## 安装Squid服务并配置客户端代理服务器参数，使得客户端可以正常上网 ##

服务器安装squid服务程序：  
`yum -y install squid`  
并重启squid服务程序，加入到开机自启项中  
`systemctl restart squid`  
`systemctl enable squid`  
清空服务器的防火墙，并保存当前防火墙策略  
`iptables -F`  
`service iptables save`  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 3]  
![在这里插入图片描述][20200329135414283.png]  
客户端配置代理缓存参数：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 4]  
可以看到，客户端已经可以访问外网了！！！  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 5]

## Squid服务的主配置文件 ##

[root@linuxfwd ~]# cat /etc/squid/squid.conf
    #
    # Recommended minimum configuration:
    #
    
    # Example rule allowing access from your local networks.
    # Adapt to list your (internal) IP networks from where browsing
    # should be allowed
    acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
    acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
    acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
    acl localnet src fc00::/7       # RFC 4193 local private network range
    acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
    
    acl SSL_ports port 443
    acl Safe_ports port 80		# http
    acl Safe_ports port 21		# ftp
    acl Safe_ports port 443		# https
    acl Safe_ports port 70		# gopher
    acl Safe_ports port 210		# wais
    acl Safe_ports port 1025-65535	# unregistered ports
    acl Safe_ports port 280		# http-mgmt
    acl Safe_ports port 488		# gss-http
    acl Safe_ports port 591		# filemaker
    acl Safe_ports port 777		# multiling http
    acl CONNECT method CONNECT
    
    #
    # Recommended minimum Access Permission configuration:
    #
    # Deny requests to certain unsafe ports
    http_access deny !Safe_ports
    
    # Deny CONNECT to other than secure SSL ports
    http_access deny CONNECT !SSL_ports
    
    # Only allow cachemgr access from localhost
    http_access allow localhost manager
    http_access deny manager
    
    # We strongly recommend the following be uncommented to protect innocent
    # web applications running on the proxy server who think the only
    # one who can access services on "localhost" is a local user
    #http_access deny to_localhost
    
    #
    # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
    #
    
    # Example rule allowing access from your local networks.
    # Adapt localnet in the ACL section to list your (internal) IP networks
    # from where browsing should be allowed
    http_access allow localnet
    http_access allow localhost
    
    # And finally deny all other access to this proxy
    http_access deny all
    
    # Squid normally listens to port 312800
    http_port 3128
    
    # Uncomment and adjust the following to add a disk cache directory.
    #cache_dir ufs /var/spool/squid 100 16 256
    
    # Leave coredumps in the first cache dir
    coredump_dir /var/spool/squid
    
    #
    # Add any of your own refresh_pattern entries above these.
    #
    refresh_pattern ^ftp:		1440	20%	10080
    refresh_pattern ^gopher:	1440	0%	1440
    refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
    refresh_pattern .		0	20%	4320

## ACL访问控制列表 ##

**作用**：若代理缓存服务器是部署在企业内网网关位置，则可通过squid服务的ACL访问控制功能，禁止用户访问某些网站。

> Squid服务程序的ACL是由多个策略规则组成的，它可以根据指定的策略规则来允许或限制访问请求，而且策略规则的匹配顺序与防火墙策略规则一样都是`由上至下`；在一旦形成匹配之后，则立即执行相应操作并结束匹配过程。`为了避免ACL将所有流量全部禁止或全部放行，起不到预期的访问控制效果，运维人员通常会在ACL的最下面写上deny all或者allow all语句，以避免安全隐患。`

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 6]

### 四种访问控制 ###

##### 只需编辑`squid服务的配置文件`即可，每次编辑完后都要重启squid服务才会生效！！！ #####

#### 1、只禁止192.168.10.20使用，其他都允许 ####

27 acl client src 192.168.10.20
     28 http_access deny client
     29 http_access allow all

#### 2、禁止所有客户端访问包含某关键字的网站 ####

27 acl deny_keywork url_regex -i baidu
     28 http_access deny deny_keywork
     29 http_access allow all

#### 3、禁止所有客户端访问指定的网站 ####

27 acl deny_url url_regex www.baidu.com
     28 http_access deny deny_url
     29 http_access allow all

#### 4、禁止在企业内网下载带有.mkv或.rar后缀的文件 ####

27 acl badfile url_regex -i \.mkv$ \.rar$
     28 http_access deny badfile
     29 http_access allow all

## 通过以上ACL访问控制，就可以控制企业内网用户的上网内容啦！！！ ##

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70]: /images/20230528/168b959a701d47728da207dc4b9eb7d1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 1]: /images/20230528/168abd211c004e9bb3aa141b22282984.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 2]: /images/20230528/a33f7d8d88e84d109f78893e238bce18.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 3]: /images/20230528/4e88d390432c42ae9f31ce6e15ddaf60.png
[20200329135414283.png]: /images/20230528/6a2b87870576403aa98ed543e8964860.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 4]: /images/20230528/0400131e7559441199815495aa21a196.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 5]: /images/20230528/edba91e2bb4a4c78a963d70f5bf176d3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zNjUyMjA5OQ_size_16_color_FFFFFF_t_70 6]: /images/20230528/c0fbad70d97a4f0d9111e0d9370da9a7.png