squid (proxy)server problem

pankajkarde · 03-06-2007, 05:34 AM

hi friends,
i have installed REDHAT centos on my server.i set up the squid-2.5 STABLE as a proxy server on it.Now i have blocked many sites using this proxy server.but from the client side , if anyone access the site using the ip address of respective site, then client can aess the site easily.
i.e i have blocked yahoo.com using the proxy server, but suppose ip of yahoo.com is 69.143.23.44 and if client want to access the yahoo.com then he can easily access using http://69.143.23.44 .
i want the sites which i have blocked using proxy server should not be accessed using their respective ip address also.
will u please help me to solve this problem?

jimbo1954 · 03-09-2007, 02:30 AM

You need to set up your IPTables (probably using some firewall manager like shorewall) to redirect all port 80 (http) traffic to another port (generally 3128), then make Squid listen on 3128. You also have to set up squid as "transparent" (there are two different ways of doing this, depending on the version of squid you are using, see comments in /etc/squid.conf).

There are loads of howtos in google, try searching "squid transparent howto"

HTH
Jimbo

shawnbishop · 03-09-2007, 05:36 AM

Hi

This is rather difficult, as some of the most popular websites actually have a number of IP addresses, eg , hotmail has 6 IP addresses

but...

Squid will in such case reverse lookup IP addresses, but this only works
when the IP is registered as the name of the site..

To fully block access to specific IP addresses you can use the "dst"
type ACL.

Cheers

deoren · 03-09-2007, 11:53 AM

If you do not want your squid proxy users to use ip addresses in their requests do the following:

Code:

acl IPForHostname dstdom_regex ~[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$
http_access deny IPForHostname

Just make sure to include that before the usual allow rules.

I can't take credit for that as I found it in the O'Reilly 'Squid book'

pankajkarde · 03-09-2007, 10:25 PM

thank you very much,
the solution provided by you really worked fine and now i can easily restrict the users who tries to access sites by putting the ipaddress in the url.

jimbo1954 · 03-11-2007, 03:43 PM

Sorry Guys, I got the completely wrong end of the question...embarrassed or what? Thanks to the other contributors for not saying what a *complete* mess I made of that.

Jimbo