Squid3 - ACL

[Hightower]

I've just installed a squid server and am trying to have it so all sites are blocked unless there are in a file that we have added (a whitelist basically).

 

Can anybody assist me in how to achieve this? Followed this guide

SquidFaq/SquidAcl - Squid Web Proxy Wiki

But it isn't working for me? What am I doing wrong? Here's the relevant parts of conf

 

acl AllowedSites dstdomain "/etc/squid3/AllowedSites"
acl localnet src 10.0.0.0/8

 

http_access allow localnet
http_access allow AllowedSites
http_access deny all

[pete]

acl AllowedSites dstdomain "/etc/squid3/AllowedSites"
acl localnet src 10.0.0.0/8

 

http_access allow localnet
http_access allow AllowedSites
http_access deny all

 

I'm working from memory here using Squid 2.* as a reference, but parsed that reads (iirc): Let everyone from the local network access stuff. Let everyone access the sites in allowed sites. Deny everyone else.

 

Try changing to:

http_access deny !localnet
http_access deny !AllowedSites
http_access deny all

 

Which says "if you're not on a 10.*, no access. If you're not looking at a whitelisted site, no access." You may need an allow in there somewhere, I don't have a squid.conf in front of me.

Edited January 16, 2009 by pete

[Hightower]

Right - sussed it with this:

 

http_access deny !localnet
http_access allow allowedsites
http_access deny all

 

P.S. How do I restart the squid server from a website (i.e. Click here to restart server)

[wensleydale]

Have you installed webmin? This one of the best webbased remote server control. In webmin goto servers>>squid>>start/stop Squid

[Hightower]

Have you installed webmin? This one of the best webbased remote server control. In webmin goto servers>>squid>>start/stop Squid

 

No, I don't want to install webmin. I have a custom webpage and I want to be able to click a link on it to restart squid - is this possible?

[srochford]

Key thing that I picked up in Squid is that it processes the lines in order. As soon as it comes to something which matches "allow" then it stops. In your example "allow localnet" comes first so anyone on "localnet" can do anything and that's why reversing the logic works - you're now saying "allow these sites" and "deny everything if they're not on my network"

[Hightower]

Key thing that I picked up in Squid is that it processes the lines in order. As soon as it comes to something which matches "allow" then it stops. In your example "allow localnet" comes first so anyone on "localnet" can do anything and that's why reversing the logic works - you're now saying "allow these sites" and "deny everything if they're not on my network"

 

Not having a problem with it now - sorted (as posted above) - Just need to know how to restart the server from a custom webscript?