请教:FreeBSD + PF + Squid透明代理(已解决)

用FreeBSD 5.4 + PF + Squid 2.5做透明代理时,访问时出现下面错误:

CODE:

错误
您所请求的网址（URL）无法获取

当尝试进行以下请求时：

GET / HTTP/1.1
Host: [url]www.google.com[/url]
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050626 Epiphany/1.6.3
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive



发生了下列的错误：

    * Invalid Request
      无效的请求

Some aspect of the HTTP Request is invalid. Possible problems:
HTTP 请求的某些方面是无效的。可能是下列问题：

    * Missing or unknown request method
      缺少请求方式或未知的请求方式
    * Missing URL
      缺少网址
    * Missing HTTP Identifier (HTTP/1.0)
      缺少 HTTP 标识（HTTP/1.0）
    * Request is too large
      请求命令过长
    * Content-Length missing for POST or PUT requests
      POST 或 PUT 请求缺少内容长度
    * Illegal character in hostname; underscores are not allowed
      主机名称中包含不合法的字符；下划线是不允许的。

本缓存服务器管理员：webmaster.
Generated Sun, 26 Jun 2005 09:23:24 GMT by router.com (squid/2.5.STABLE10)squid.conf

CODE:

cache_effective_user squid
cache_effective_group squid

http_port 3128
icp_port 0
cache_mem 32 MB
maximum_object_size 4096 KB
cache_dir ufs /usr/local/squid/cache 4096 64 64
cache_access_log /usr/local/squid/logs/access.log
cache_log /usr/local/squid/logs/cache.log
cache_store_log /usr/local/squid/logs/store.log
pid_filename /usr/local/squid/logs/squid.pid
error_directory /usr/local/etc/squid/errors/Simplify_Chinese

cache_swap_low 80
cache_swap_high 95
#reference_age 1 month
ipcache_size 1024
ipcache_low 90
ipcache_high 95
mime_table /usr/local/etc/squid/mime.conf

#
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 21 70 1025-65535
acl Valid_ports port 80 21 3128 8080 70 151 1-1024
acl CONNECT method CONNECT
acl lan-a src 192.168.0.0/24
acl hotmail dstdomain .hotmail.com
acl msn dstdomain .msn.com
#
http_access allow all
http_reply_access allow all
hierarchy_stoplist cgi-bin ?

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header onpf.conf

CODE:

wan_if  = "tun0"
lan_if  = "em1"
loop_if = "lo0"         # loopback 本地环回设备

IntNet  = "192.168.0.0/24"
Router  = "192.168.0.254"       # 路由器的IP地址

# 不被路由的地址
NoRoute = "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"

### 选项 ###
set loginterface $wan_if
set optimization aggressive
scrub in all fragment reassemble

# Squid
rdr on $lan_if proto tcp from any to any port 80 ->; 127.0.0.1 port 3128

# 只是用来调试用
pass in quick all       # 测试一下允许所有进入的包
pass out quick all      # 和发出的包用ports安装Squid时已经选上

CODE:

[X] SQUID_PF              Enable transparent proxying with PF在rdr规则中因语法有错不能去掉"proto tcp".
查看cache.log文件,发现有如下错误

CODE:

2005/06/28 23:25:43| parseHttpRequest: PF open failed: (13) Permission denied
2005/06/28 23:25:43| clientReadRequest: FD 11 Invalid Request上网终于找到答案

CODE:

chgrp squid /dev/pf
chmod g+rw /dev/pf

# ll pf
crw-rw----  1 root  squid  232,   0  6 28 23:03 pfsquid.conf&pf.conf文件不需要任何改动即OK :em02:  :em03:  :em03:

晕掉,还是不行,重启之后,/dev/pf回复到crw-------等属性.
暂时只有把
chgrp squid /dev/pf
chmod g+rw /dev/pf
放到/etc/rc.local中运行 :-(

QUOTE:

原帖由 congli 于 2005-6-29 20:07 发表
晕掉,还是不行,重启之后,/dev/pf回复到crw-------等属性.
暂时只有把
chgrp squid /dev/pf
chmod g+rw /dev/pf
放到/etc/rc.local中运行 :-(

要永久更改，请修改 /etc/devfs.conf;

own     pf    root:squid
perm    pf     0660

From: http://bbs.chinaunix.net/archiver/?tid-567993.html