hi,

is there any way to allow blocked particular site to particular IP in squid or dansguardian.

will be very much thankfull

Yes. This was actually asked and answered less than a week ago right here.

hi,

thanx for your reply

you not yet understand my question

i blocked Facebook & Orkut to all user but now i want to open only facebook to particular user or IP


Thankx

im not intimately familiar with users in squid, but if you want to allow IPs, just add an ACL for the IP range (or several ACL's for each nonadjacent IP) and place some http_access_allow <ACL NAME> lines above the http_access_deny lines

if you provide the appropriate sections of your /etc/squid/squid.conf file, i could probably give you specific examples.

Only allow the IP to bypass the restriction on Facebook, right (not Orkut)?

You need to stick an http_access line above the one(s) which block the domains. Example:

hi,

thanks win32sux

finally u resoved my problem, u r genious

my last question to u it is possible to create one file like exception ip list for particular site instead of creating acl for each ip & site

For Ex.

192.168.0.2 facebook.com
192.168.0.3 orkut.com
192.168.0.50 facebook.com

because no.of acl list may affect on performance of squid proxy

Once again thanx for your quick reply.

yes, this is possible. make your file. lets call it /etc/squid/badsites.acl and add this to your config file

acl badsites dstdomain "/etc/squid/badsites.acl"
http_access deny badsites

your file should look like this (one url per line):
url1
url2
url3

restart squid

I think you'd wanna do like gr33d said, but with an exception IP list instead.

You'd then match that ACL to certain domains, like:You could also stick both client IPs and destination domains into lists, then do like:

hi,
i want to restrict sites like orkut, gmail in squid but i want to give access of these sites to some specific users, how can i achieve it

Have you tried the examples provided above?

hi,

win32sux

thanx for your valuable reply i tried both the option both are working fine
u given solution exactly what i want.


thanx u r genious in linux


Regards

Sachin J.

hi,

win32sux

i have one query again i think u could able solve

i denied download by creating extndeny.acl for all
now i want allow some VIP user to download what i denied in extndeny.acl, how should i do that

REgards

Sachin J.

Create an ACL to match the VIP then stick an allow statement above the deny perhaps? Example:Or maybe use an inverted match (depending on how everything else is set)? Example:

hi,

thanks for your quick reply, i tried your setting but after putting this setting my squid failed to start.
every thing is working fine
i restricted to access proxy,
blocked websides
i allowed blocked webside to VIP user
i blocked download by extension to all but i want to allowed those blocked extension download to vip user, i tried your setting but my squid fail to start
so i am giving my whole setting so you will get idea is there i did wrong or i have to change


acl extndeny url_regex -i "/etc/squid/extndeny.acl"
acl badURL url_regex -i games
acl badURL url_regex -i porn
acl download method GET
http_access deny badURL
http_access deny extndeny download
acl my_safeports port 80 81 21 443 1025-65535
acl special_client1 src "/etc/squid/special_client1.acl"
acl special_client2 src "/etc/squid/special_client2.acl"
acl special_client3 src "/etc/squid/special_client3.acl"
acl bad_domain1 dstdomain "/etc/squid/bad_domain1.acl"
acl good_ip src "/etc/squid/goodip.acl"
acl bad_domain2 dstdomain "/etc/squid/bad_domain2.acl"
acl bad_domain3 dstdomain "/etc/squid/bad_domain3.acl"
http_access allow bad_domain1 special_client1
http_access allow bad_domain2 special_client2
http_access allow bad_domain3 special_client3
http_access allow good_ip all
http_access deny bad_domain1
http_access deny bad_domain2
http_access deny bad_domain3
acl my_networks src "/etc/squid/allowips.acl"
http_access allow my_networks
http_access deny all


REgards

Sachin j.

What error message does Squid produce when it fails?

BTW, I don't see any ACL for the VIP user in the configuration you posted.

FWIW, this line you have would affect everyone:The VIP http_access line would need to be above that (or included as an inverted match) in order to bypass.