https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268064#M81295 solved by using some other setup Tue, 19 Apr 2011 12:48:04 GMT gnana prakasam 2011-04-19T12:48:04Z https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268062#M81293 Dear all,<BR /> i just wanted to block some sites through my proxy server.i am using red hat linux 5.0 and squid proxy version 3.0. attached the configuration file also.tried through acl file but not success. can anybody suggest what went wrong on this config file?<BR />thanks in advance Sat, 01 Jan 2011 13:24:35 GMT https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268062#M81293 gnana prakasam 2011-01-01T13:24:35Z https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268063#M81294 Your configuration file syntax looks OK to me.<BR /><BR />The problem is probably in the ordering of the rules: according to squid documentation, squid processes the access list rules (= the http_access lines) in order, and when the first rule that matches the request is found, it stops processing the rules and does what the matching rule said.<BR /><BR />Because the default squid.conf file contains a lot of comments, it is sometimes useful to filter out everything else and look only at the important lines:<BR /><BR />$ grep '^[^#]*http_access' squid.conf | less<BR /><BR />This command shows only those lines which contain the word "http_access" and are *not* commented out.<BR /><BR />From your file, this command produces this output:<BR /><BR />http_access deny kgpsites<BR />http_access allow intra<BR />http_access deny kgpsites<BR />http_access allow manager localhost<BR />http_access deny manager<BR />http_access deny blockeddomain<BR />http_access deny !Safe_ports<BR />http_access deny CONNECT !SSL_ports<BR />http_access allow localhost<BR />http_access deny all<BR />http_access deny blockeddomain<BR /><BR />You have "http_access deny kgpsites" and "http_access deny blockeddomain" listed twice: in both cases, the second line is non-functional and can be removed.<BR /><BR />Your first "http_access deny kgpsites" works, because it is located before "http_access allow intra". This first kgpsites line is located immediately after the "acl kgpsites" line, away from the other http_access lines, so you probably didn't realize it's there. <BR /><BR />Before squid gets to the first "http_access deny blockeddomain", it sees "http_access allow intra" and thinks: "OK! This access is allowed. I can stop reading the rules for this request."<BR /><BR />For the same reason, the second "http_access deny kgpsites" is non-functional.<BR /><BR />The second-to-last line is "http_access deny all": it matches everything, so the last line "http_access deny blockeddomain" is never reached. So that line is useless.<BR /><BR />If adjusting ordering of your access list rules doesn't solve the problem, please try this:<BR /><BR /><A href="http://wiki.squid-cache.org/SquidFaq/SquidAcl#I_set_up_my_access_controls.2C_but_they_don.27t_work.21__why.3F" target="_blank">http://wiki.squid-cache.org/SquidFaq/SquidAcl#I_set_up_my_access_controls.2C_but_they_don.27t_work.21__why.3F</A><BR /><BR />MK Sat, 01 Jan 2011 16:20:04 GMT https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268063#M81294 Matti_Kurkela 2011-01-01T16:20:04Z https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268064#M81295 solved by using some other setup Tue, 19 Apr 2011 12:48:04 GMT https://community.hpe.com/t5/operating-system-linux/configure-squid-proxy-to-block-some-sites/m-p/5268064#M81295 gnana prakasam 2011-04-19T12:48:04Z