Need Help in Squid Config

krishvij · 03-31-2005, 04:32 AM

Hi,

Am using RHEL 3 and I have configured squid to act as a proxy on my RHEL 3 box. everything works fine. Everybody can browse any website. Now, that is my problem

I have to restrict 15 IPs in my local network in such a way that they can only browse to 1 particular website. and no other site. So, if i want that 192.168.10.35 should be able to browse to only www.redhat.com, then how do I do this in squid. If I can get a hang of this, then I can roll it out for all my other requirements.

linuxxed · 03-31-2005, 07:34 AM

You need to read squid.conf. It is extremely well documented in the file. Make use of acl and http_access directive.

For eg:

acl mynetwork src 192.168.0.0/24 (define your network)
acl browsablesites dstdomain *.redhat.com

http_access allow mynetwork browsablesites

http_access deny all

Note that if multiple acls are specified in http_access then they are anded together.

http://www.squid-cache.org/Doc/FAQ/FAQ.html

krishvij · 03-31-2005, 08:12 AM

Hi Linuxxed,

Thanks for ur reply. Got the hang of it. One more query. I want to allow 1 IP to access ftp. so, what do i do? I tried the following :-

acl one_ip url_regex -i 192.168.10.158 ftp
delay_pools 2
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_access 1 allow one_ip

but squid gave me an error and stopped when i tried service squid restart

any ideas? is my code ok?

linuxxed · 04-01-2005, 03:29 AM

Quote:

Originally posted by krishvij
Hi Linuxxed,

Thanks for ur reply. Got the hang of it. One more query. I want to allow 1 IP to access ftp. so, what do i do? I tried the following :-

acl one_ip url_regex -i 192.168.10.158 ftp
delay_pools 2
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1
delay_access 1 allow one_ip

but squid gave me an error and stopped when i tried service squid restart

any ideas? is my code ok?

I don't think you need to do all of that. Try the proto directive

acl FTP proto FTP
acl mynetwork src 192.168.10.158/255.255.255.255
http_access allow mynetwork FTP

or maybe
acl ftp_ports port 21

If it does not work then turn the acl debugging on.