Squid not blocking ip addresses

Fantus · 07-16-2009, 01:50 PM

On my network, certain computers are allowed online and others just get local access. I'm trying to figure out a way either in shorewall or squid to get them blocked. I edited squid:

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
acl luisg src 192.168.0.27
acl leah src 192.168.0.16
acl irene src 192.168.0.26
acl irma src 192.168.0.14
acl julie src 192.168.0.19
acl vanessa src 192.168.0.22
acl laura src 192.168.0.186
acl marisol src 192.168.0.23
acl thania src 192.168.0.20
acl bernice src 192.168.0.17
acl raquel src 192.168.0.229
acl jasmine src 192.168.0.25
acl rena src 192.168.0.24
acl vanessae src 192.168.0.184
acl luis src 192.168.0.185
acl javier src 192.168.0.29
acl isidro src 192.168.0.28
acl daniel src 192.168.0.182

http_access deny luisg
http_access allow leah
http_access allow irene
http_access deny irma
http_access deny julie
http_access allow vanessa
http_access deny laura
http_access allow marisol
http_access deny thania
http_access deny bernice
http_access deny raquel
http_access allow jasmine
http_access allow rena
http_access deny vanessae
http_access deny luis
http_access allow isidro
http_access deny daniel
http_access allow javier
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

However, no one is being blocked. I tried gimicking with the shorewall blacklist file but it didnt seem to work either. Any ideas?

anomie · 07-16-2009, 05:47 PM

Are you sure their requests are coming through the squid proxy (i.e. and not being masqueraded through a NAT device instead)? What are you seeing in squid's access.log? Successful attempts from any of the clients that should be denied?

Fantus · 07-17-2009, 03:47 PM

Everyone is moving just fine through squid. /var/log/squid/access.log is full of people doing what they're doing, and I've got sarg up to compile reports.

win32sux · 07-19-2009, 01:13 PM

Can you post a log sample of someone who is supposed to be blocked? For example:

Code:

grep 192.168.0.27 /var/log/squid/access.log | tail

BTW, I see you're allowing localhost. Any chance users are accessing via a separate daemon which is then accessing via the loopback interface? This would show up in your Squid log as requests with source address 127.0.0.1.