topic Re: squid acl - plz help in Operating System - Linux

squid acl - plz help

Maaz — Fri, 06 Oct 2006 13:56:41 GMT

acl mynet src 192.168.1.0/24
httpd_access allow mynet

Now I have to deny 192.168.1.13-34 and 192.168.40-71. Right now I have done the following
acl mynet src 192.168.1.0/24

acl pc13 src 192.168.1.13/32
.
.
.
acl pc13 src 192.168.1.34/32
acl pc13 src 192.168.1.40/32
.
.
.
acl pc13 src 192.168.1.71/32

httpd_access deny pc13
.
.
httpd_access deny pc34
.
.
httpd_access deny pc71
httpd_access allow mynet

Any better approach/suggestion/efficient way to acheive the target ? plz share

Regards
Maaz

Re: squid acl - plz help

Maaz — Fri, 06 Oct 2006 14:03:16 GMT

I made mistake in previous post, following are the correct acls.
acl pc13 src 192.168.1.13/32
.
.
.
acl pc34 src 192.168.1.34/32
acl pc40 src 192.168.1.40/32
.
.
.
acl pc71 src 192.168.1.71/32

Thanks

Re: squid acl - plz help

Alexander Chuzhoy — Fri, 06 Oct 2006 14:16:45 GMT

This will also work:
acl mynet src 192.168.1.0/24
acl bad_pc src 192.168.1.34 192.168.1.40 192.168.1.71
httpd_access deny bad_pc
httpd_access allow mynet

you can get more info here:
http://www.squid-cache.org/Doc/FAQ/FAQ-10.html

Re: squid acl - plz help

Steven E. Protter — Sat, 07 Oct 2006 13:01:30 GMT

Shalom Maaz,

You configuration is fine, don't forget to test it to make sure it denies and allows as you think it should.

Even after sucessfully making this work for RHCE class I'm not a big fan of this tool. I suppose its useful to improve access speeds by caching content.

SEP

Re: squid acl - plz help

Maaz — Thu, 12 Oct 2006 09:34:40 GMT

Thanks Alexander and SEP, and sorry for late ack.

>acl bad_pc src 192.168.1.34 192.168.1.40 192.168.1.71
>httpd_access deny bad_pc
Alexander, this will only blck 3 machines i.e 34, 40, and 71. I need to deny the range of ipes .. from 13-34, and from 40-71.

Anyway thanks for help.

Regards
Maaz

Re: squid acl - plz help

Ivan Ferreira — Thu, 12 Oct 2006 10:02:33 GMT

A best approach will be to use an external file and add to the file all IP addresses that are denied, for example:

acl badip src "/etc/squid/ip.deny"
http_access deny badip

Then specify the denied ip addresses in the ip.deny file, one IP by line.