OPNsense Squid ClamAV: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 40: | Zeile 40: | ||
= Firewall = | = Firewall = | ||
| + | ;Destination NAT | ||
*Firewall | *Firewall | ||
**NAT | **NAT | ||
| Zeile 50: | Zeile 51: | ||
| INSIDE || IPv4 || TCP || * || * || * || http || 127.0.0.1 || 3128 || transparenter HTTP | | INSIDE || IPv4 || TCP || * || * || * || http || 127.0.0.1 || 3128 || transparenter HTTP | ||
|} | |} | ||
| − | + | ;Rules | |
| − | + | *Firewall | |
| + | **Rules | ||
| + | ***LAN | ||
| + | {| class="wikitable" | ||
| + | ! Action !! Protocol !! Source !! Source Port !! Destination !! Destination Port !! Gateway !! Schedule !! Description | ||
| + | |- | ||
| + | | IPv4 TCP || * || * || * || 127.0.0.1 || 3128 || * || * || transparenter HTTP | ||
| + | |- | ||
| + | | IPv4 TCP || * || * || * || 127.0.0.1 || 3129 || * || * || transparenter HTTPS | ||
| + | |} | ||
= Squid = | = Squid = | ||
Version vom 20. Februar 2026, 06:49 Uhr
Vorraussetzungen
Selbstsigniertes CA Zertifikat
- System
- Trust
- Authorities
- +
- Authorities
- Trust
| Bereich | Einstellung | Wert |
|---|---|---|
| Method | Create an internal Certificate Authority | – |
| Description | SQUID-CA | – |
| Key | Key type | RSA-2048 |
| Key | Digest Algorithm | SHA256 |
| Key | Issuer | self-signed |
| Key | Lifetime (days) | 825 |
| General | Country Code | Germany |
| General | Common Name | squid-ca |
Update
- System
- Firmware
- Status
- Check for updates
- Firmware
Plugins
- System
- Firmware
- Plugins
- Firmware
- Installieren
- os-squid
- os-c-icap
- os-clamav
Firewall
- Destination NAT
- Firewall
- NAT
- Destination NAT
- NAT
| Interface | Version | Protocol | Source | Source Port | Destination | Destination Port | Redirect Target IP | Redirect Target Port | Description |
|---|---|---|---|---|---|---|---|---|---|
| INSIDE | IPv4 | TCP | * | * | * | https | 127.0.0.1 | 3129 | transparenter HTTPS |
| INSIDE | IPv4 | TCP | * | * | * | http | 127.0.0.1 | 3128 | transparenter HTTP |
- Rules
- Firewall
- Rules
- LAN
- Rules
| Action | Protocol | Source | Source Port | Destination | Destination Port | Gateway | Schedule | Description |
|---|---|---|---|---|---|---|---|---|
| IPv4 TCP | * | * | * | 127.0.0.1 | 3128 | * | * | transparenter HTTP |
| IPv4 TCP | * | * | * | 127.0.0.1 | 3129 | * | * | transparenter HTTPS |
Squid
C-ICAP
ClamAV
- Im Moment funktioniert das Updaten der Datenbank nicht über die Weboberfläche
- auf der Kommandozeile muss der folgende Befehl manuell ausgeführt werden
- freshclam
- Danach sollten unter Services => ClamAV => Configuration => Versions die aktuellen Signaturen angezeigt werden
Test ob die Ports laufen
- sockstat -P tcp | egrep "squid|clamav|icap"
c_icap c-icap 79193 3 tcp6 *:1344 *:* c_icap c-icap 78528 3 tcp6 *:1344 *:* c_icap c-icap 78447 3 tcp6 *:1344 *:* c_icap c-icap 78447 9 tcp6 ::1:1344 ::1:6597 c_icap c-icap 78447 10 tcp6 ::1:1344 ::1:41124 c_icap c-icap 78152 3 tcp6 *:1344 *:* squid squid 31274 15 tcp6 ::1:6597 ::1:1344 squid squid 31274 19 tcp6 ::1:41124 ::1:1344 squid squid 31274 22 tcp4 127.0.0.1:3128 *:* squid squid 31274 23 tcp6 ::1:3128 *:* squid squid 31274 24 tcp4 127.0.0.1:3129 *:* squid squid 31274 25 tcp6 ::1:3129 *:* squid squid 31274 26 tcp4 172.17.213.1:3128 *:* clamav clamd 2247 4 tcp4 127.0.0.1:3310 *:*
Testen
Der Download aus dem LAN sollte für die Testviren auf eicar.org blockiert werden.