Configure squid proxy to block some sites

[gnana prakasam]

Dear all,
i just wanted to block some sites through my proxy server.i am using red hat linux 5.0 and squid proxy version 3.0. attached the configuration file also.tried through acl file but not success. can anybody suggest what went wrong on this config file?
thanks in advance

[Matti_Kurkela]

Your configuration file syntax looks OK to me.

The problem is probably in the ordering of the rules: according to squid documentation, squid processes the access list rules (= the http_access lines) in order, and when the first rule that matches the request is found, it stops processing the rules and does what the matching rule said.

Because the default squid.conf file contains a lot of comments, it is sometimes useful to filter out everything else and look only at the important lines:

$ grep '^[^#]*http_access' squid.conf | less

This command shows only those lines which contain the word "http_access" and are *not* commented out.

From your file, this command produces this output:

http_access deny kgpsites
http_access allow intra
http_access deny kgpsites
http_access allow manager localhost
http_access deny manager
http_access deny blockeddomain
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
http_access deny blockeddomain

You have "http_access deny kgpsites" and "http_access deny blockeddomain" listed twice: in both cases, the second line is non-functional and can be removed.

Your first "http_access deny kgpsites" works, because it is located before "http_access allow intra". This first kgpsites line is located immediately after the "acl kgpsites" line, away from the other http_access lines, so you probably didn't realize it's there.

Before squid gets to the first "http_access deny blockeddomain", it sees "http_access allow intra" and thinks: "OK! This access is allowed. I can stop reading the rules for this request."

For the same reason, the second "http_access deny kgpsites" is non-functional.

The second-to-last line is "http_access deny all": it matches everything, so the last line "http_access deny blockeddomain" is never reached. So that line is useless.

If adjusting ordering of your access list rules doesn't solve the problem, please try this:

http://wiki.squid-cache.org/SquidFaq/SquidAcl#I_set_up_my_access_controls.2C_but_they_don.27t_work.21__why.3F

MK

[gnana prakasam]

solved by using some other setup