# service iptables status
Table: mangle
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 TTL all -- 0.0.0.0/0 0.0.0.0/0 TTL set to 128

Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 LOG tcp -- 172.22.0.0/24 0.0.0.0/0 tcp spts:1024:65535 dpt:80 LOG flags 4 level 6 prefix `New onnection: '
2 REDIRECT tcp -- 172.22.0.0/24 0.0.0.0/0 tcp spts:1024:65535 dpt:80 redir ports 3128
3 LOG tcp -- 172.22.0.0/24 0.0.0.0/0 tcp spts:1024:65535 dpt:443 LOG flags 4 level 6 prefix `New connection: '
4 REDIRECT tcp -- 172.22.0.0/24 0.0.0.0/0 tcp spts:1024:65535 dpt:443 redir ports 3129
5 REDIRECT tcp -- 172.22.0.0/24 0.0.0.0/0 tcp spts:1024:65535 dpt:8080 redir ports 3128

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- 172.22.0.0/24 0.0.0.0/0
2 SNAT icmp -- 172.22.0.0/24 0.0.0.0/0 to:172.28.228.203

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

# cat /etc/squid/squid.conf
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
#acl to_localhost dst 127.0.0.0/8
#acl kolyan src 172.28.228.209/32
acl allowed_hosts src 172.22.0.0/255.255.255.0
#acl all src 172.0.0.0/24
acl icq_ports port 443 563 5190
acl open_ports port 80 8080 8000 443
acl open_ports port 21
#acl SSL_ports port 443
#acl Safe_ports port 80 # http
#acl Safe_ports port 21 # ftp
#acl Safe_ports port 443 # https
#acl Safe_ports port 70 # gopher
#acl Safe_ports port 210 # wais
#acl Safe_ports port 1025-65535 # unregistered ports
#acl Safe_ports port 280 # http-mgmt
#acl Safe_ports port 488 # gss-http
#acl Safe_ports port 591 # filemaker
#acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl snmppublic snmp_community mocat
http_access allow localhost
http_access allow allowed_hosts
http_access allow icq_ports
http_access allow open_ports
#http_access allow to_localhost
#http_access allow all
http_access deny all
icp_access deny all
icp_port 0
http_port 172.28.228.203:3128 transparent
https_port 172.28.228.203:3129 transparent key=/etc/squid/ssl/squid.key cert=/etc/squid/ssl/squid.pem
hierarchy_stoplist cgi-bin ?
cache_mem 512 MB
maximum_object_size_in_memory 8 KB
cache_dir ufs /squid 204800 32 256
maximum_object_size 8192 KB
minimum_object_size 1 KB
ipcache_size 8192
cache_replacement_policy heap LFUDA
memory_replacement_policy heap LFUDA
access_log /var/log/squid/access.log squid
cache_effective_user squid
cache_effective_group squid
debug_options ALL,1
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
visible_hostname tjk-squid001
negative_ttl 1 minutes
read_timeout 5 minutes
request_timeout 60 seconds
client_lifetime 8 hour
half_closed_clients off
shutdown_lifetime 3 seconds
snmp_port 3401
snmp_access allow all
snmp_access deny all
snmp_incoming_address 0.0.0.0
snmp_outgoing_address 255.255.255.255
always_direct allow localhost
always_direct deny all
check_hostnames off
forwarded_for on
coredump_dir /var/spool/squid
dns_nameservers 85.9.129.36
#refresh_pattern ^http: 0 100% 1440 override-expire override-lastmod
#reload-into-ims
#ignore-reload ignore-no-cache ignore-no-store ignore-must-revalidate
#ignore-private
#ignore-auth refresh-ims