squid acl - plz help

[Maaz]

acl mynet src 192.168.1.0/24
httpd_access allow mynet

Now I have to deny 192.168.1.13-34 and 192.168.40-71. Right now I have done the following
acl mynet src 192.168.1.0/24

acl pc13 src 192.168.1.13/32
.
.
.
acl pc13 src 192.168.1.34/32
acl pc13 src 192.168.1.40/32
.
.
.
acl pc13 src 192.168.1.71/32



httpd_access deny pc13
.
.
httpd_access deny pc34
.
.
httpd_access deny pc71
httpd_access allow mynet

Any better approach/suggestion/efficient way to acheive the target ? plz share

Regards
Maaz

[Maaz]

I made mistake in previous post, following are the correct acls.
acl pc13 src 192.168.1.13/32
.
.
.
acl pc34 src 192.168.1.34/32
acl pc40 src 192.168.1.40/32
.
.
.
acl pc71 src 192.168.1.71/32

Thanks

[Alexander Chuzhoy]

This will also work:
acl mynet src 192.168.1.0/24
acl bad_pc src 192.168.1.34 192.168.1.40 192.168.1.71
httpd_access deny bad_pc
httpd_access allow mynet

you can get more info here:
http://www.squid-cache.org/Doc/FAQ/FAQ-10.html

[Steven E. Protter]

Shalom Maaz,

You configuration is fine, don't forget to test it to make sure it denies and allows as you think it should.

Even after sucessfully making this work for RHCE class I'm not a big fan of this tool. I suppose its useful to improve access speeds by caching content.

SEP

[Maaz]

Thanks Alexander and SEP, and sorry for late ack.

>acl bad_pc src 192.168.1.34 192.168.1.40 192.168.1.71
>httpd_access deny bad_pc
Alexander, this will only blck 3 machines i.e 34, 40, and 71. I need to deny the range of ipes .. from 13-34, and from 40-71.

Anyway thanks for help.

Regards
Maaz

[Ivan Ferreira · Accepted solution]

A best approach will be to use an external file and add to the file all IP addresses that are denied, for example:

acl badip src "/etc/squid/ip.deny"
http_access deny badip

Then specify the denied ip addresses in the ip.deny file, one IP by line.