nixCraft

Hi All,

I am using Squid Proxy in my lan it's working fine. Now i want to restrict some ip's for particular websites is there any way to do this.

I want to do following.......

I want to give access to www.yahoo.com,www.gmail.com,www.hotmail.com, etc. to this ips 192.168.1.5 (6,8,10,25,55) only mentioned must be able to access this sites. All other ip must be restrict.

Thanks In Advance

VJ

acl yahoo dstdomain Yahoo!
acl allowip src 192.168.1.5 192.168.1.6 192.168.1.8 192.168.1.10 192.168.1.25 192.168.1.55

http_access allow allowip yahoo
http_access deny yahoo all

That should work, might not be lol. I found it easier in squidGuard to do it as it allows easier blocking for IP's

y dont u try this i may work


acl weballow 192.168.1.5 192.168.1.6 192.168.1.8 192.168.1.10 192.168.1.25 192
http_access allow weballow
acl myallow url_regex .google.com .yahoo.com .hotmail.com
http_access alllow myallow

good answers so far. Something a little more robust and more easily editable (you won't need to keep editing squid.conf after this, just the files that it points to)

Using Giri's idea we go one step further:
Create a file in
call it
do this using

add the ips you want to allow to this file one per line

this is no different to doing the following inside of squid.conf

and then using the acl name (allowed-ips) in http_access rule

make sure that squid can read this file. at the command line type
now create a new file called
also in
.

to this add each url one per line
again, make sure that squid can read this file

Now change the acl lines in your squid .conf to read

remembering that squid only parses the conf file until it finds a match, to achieve your aim you need to combine these rules into a single http_access rules

what happens here is squid looks to see if the ip is a permitted ip, if it is it then checks to see if the url is also permitted. Only if both are true will the site be allowed on the users machine.

Make sure that you put the above line above (before) any other http_access lines that may match one of the conditions and allow other users out to these sites. Also don't forget to have a http_access rule that allows these users to access other sites as well, if they are permitted, otherwise they will only ever be able to see these ones.

Using compounded acls you can create pretty complex access rules.

As you choose to add or remove permitted users and sites, you just edit the two files allowed-ips and allowed-sites to keep everything up-to-date.

Oh, yeah don't forget to restart or reload your squid

Shane