browolf Posted April 19, 2007 Posted April 19, 2007 trying to block an ip range in squid thru webmin created an acl rogue_laptops Client Address 192.168.107.240-192.168.107.246 added it to proxy restrictions and moved it up Allow manager localhost Deny manager Allow purge localhost Deny purge Deny !Safe_ports Deny CONNECT !SSL_ports Allow localhost Deny rogue_laptops << here Allow academic Deny all when i try to apply changes: Failed to reconfigure squid : 2007/04/19 14:48:39| ACL name 'rogue_laptops' not defined! FATAL: Bungled squid.conf line 1883: http_access deny rogue_laptops Squid Cache (Version 2.5.STABLE9): Terminated abnormally. why this happening? cheers andy
Geoff Posted April 19, 2007 Posted April 19, 2007 rogue_laptops Client Address 192.168.107.240-192.168.107.246 That is not the correct syntax for a squid acl definition. It should look like this: acl rogue_laptops src 192.168.107.240-192.168.107.246/32
browolf Posted April 19, 2007 Author Posted April 19, 2007 thats what i pasted out of webmin but in the squid.conf it looks like what you put except the /32 where'd that come from? it applies changes ok if i dont create a proxy restriction
Joedetic Posted April 19, 2007 Posted April 19, 2007 Hmmm....at least it's not CISCO ACLs with wildcard masking....fun fun fun.
Geoff Posted April 19, 2007 Posted April 19, 2007 /32 where'd that come from the 'src' acl type expects ip/subnet. If you want to specific a range you must give it a range of subnets. a /32 subnet is a subnet containing 1 ip address.
browolf Posted April 19, 2007 Author Posted April 19, 2007 the way webmin does things i can change it to acl rogue_laptops src 192.168.107.240/255.255.255.248 but it still dont like it the others are like that acl localservers dst 192.168.0.0/255.255.0.0 127.0.0.1/255.255.255.255 acl localserversdomains dstdomain .lsahtc.net acl sophosservers dst 10.36.6.20/255.255.255.255 acl rogue_laptops src 192.168.107.240/255.255.255.248
Joedetic Posted April 19, 2007 Posted April 19, 2007 The usual convention is for a / to be followed by the number of bits in the subnet mask, not an actual subnet mask isnt it? (or have i got the wrong end of the stick) ie /8 = 255.0.0.0 /16 = 255.255.0.0 /24 = 255.255.255.0 /32 = 255.255.255.255 So maybe you could work out the number of bits in your subnet mask and try it without the whole mask but using the slash mask instead?
browolf Posted April 19, 2007 Author Posted April 19, 2007 well its already working with the netmasks. i'm trying block students own laptops which they're plugging into the network and getting a ip thru dhcp, but im forcing them onto a specific range with reservations. had a thought i block them if they dont have a fqdn by having a allowing acl fqdn srcdomain .ourdomain.lancs.sch.uk and refusing anything else but webmin is coming back with the same sort of error
Geoff Posted April 19, 2007 Posted April 19, 2007 i'm trying block students own laptops which they're plugging into the network and getting a ip thru dhcp Wrong tool for the job. You need to implement Network Access Control. I discussed the implmentation of this previously, either with 802.1X http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=4767 or using Packetfence. http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=7650
browolf Posted April 19, 2007 Author Posted April 19, 2007 network access control on the dhcp? havent got time for that. this is(was) a quick fix to stop them getting on the internet, which is why they do it.
Geoff Posted April 19, 2007 Posted April 19, 2007 Packet Fence uses ARP poisoning by default. You can use DHCP or VLAN isolation instead if prefer. 802.1X works just like it does for WiFi, however your switches need to support it.
browolf Posted April 19, 2007 Author Posted April 19, 2007 they're unplugging pcs and using the cable
Geoff Posted April 19, 2007 Posted April 19, 2007 You misunderstand how PacketFence works. Nodes must register (via their mac address) with PacketFence before they are allowed network access. This can either be automated or pre-configured or a mixture. In your situation you'd probably want a simple pre-configured setup.
browolf Posted April 19, 2007 Author Posted April 19, 2007 ah right i understand. that may be the proper way of doing it but thats too much work. this was only supposed to take 10mins lol. back to the original problem: it occurs to me it might just be webmin being stupid. so i'll try it on squid.conf
Geoff Posted April 20, 2007 Posted April 20, 2007 it might just be webmin being stupid. so i'll try it on squid.conf That seems likely. The ACLs I've posted should work fine and do what you want.
browolf Posted April 20, 2007 Author Posted April 20, 2007 apparently not if i try and restart squid from the console it says the same thing ive changed it to acl fqdn srcdomain .ourdomain.lancs.sch.uk always direct deny !fqdn and still the same...
Geoff Posted April 20, 2007 Posted April 20, 2007 presumably you've enabled DNS resolution of client IPs?
browolf Posted April 20, 2007 Author Posted April 20, 2007 erm i have no idea. but seeing as had the exact same error when trying the ip method....
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now