Имею
Код: Выделить всё
dc0 samba4.2, gw0 squid3.2, на debian8.4
Код: Выделить всё
FastInet@DOMAIN.COM
RegularInet@DOMAIN.COM
Код: Выделить всё
eth0 192.168.1.10
gateway 192.168.1.1# Dom.ru
eth1 192.168.0.10
gateway 192.168.0.1 #Rostelekom
eth2 192.168.50.10 #Lan
Код: Выделить всё
auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -s GSS_C_NO_NAME
auth_param negotiate children 100
auth_param negotiate keep_alive on
auth_param basic program /usr/lib/squid3/basic_ldap_auth -b "dc=domain,dc=com" -R -D proxy_auth@domain.com -W /etc/squid3/ntlm_pass.txt -f sAMAccountName=%s -h dc0.domain.com
auth_param basic children 100
auth_param basic realm Squid Basic Auth
auth_param basic credentialsttl 2 hours
##fill squid acl with external data (checks if user %LOGIN is in suggested group
external_acl_type fastgroup_krb children-max=100 children-startup=50 cache=10 grace=15 %LOGIN /usr/lib/squid3/ext_kerberos_ldap_group_acl -a -g FastInet@DOMAIN.COM
external_acl_type slowgroup_krb children-max=100 children-startup=50 cache=10 grace=15 %LOGIN /usr/lib/squid3/ext_kerberos_ldap_group_acl -a -g RegularInet@DOMAIN.COM
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl AD_users proxy_auth REQUIRED
## ACL for users with speed inet access
acl AD_FastInet external fastgroup_krb
##ACL for users with regular inet access
acl AD_RegularInet external slowgroup_krb
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow AD_FastInet
http_access allow AD_RegularInet
http_access deny AD_users
http_access deny all
http_port 192.168.1.254:3128
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .
Код: Выделить всё
FastInet@DOMAIN.COM Ходили через
eth0 192.168.1.10
gateway 192.168.1.1# Dom.ru
Код: Выделить всё
RegularInet@DOMAIN.COM
eth1 192.168.0.10
gateway 192.168.0.1 #Rostelekom
Код: Выделить всё
cat /etc/iproute2/rt_tables
101 Domru
102 Rostelekom