Thanks so much, that solved the problem. Looks like I had the syntax wrong for allowing a specific group of machines access to a specific IP range. Thanks again! -----Original Message----- From: John Doe [mailto:guest01@xxxxxxxxx] Sent: Wednesday, December 22, 2010 11:55 AM To: Volker-Yoblick, Adam Cc: 'squid-users@xxxxxxxxxxxxxxx' Subject: Re: Having trouble denying http_access to the proxy On 12/22/2010 05:43 PM, Volker-Yoblick, Adam wrote: > Greetings, > > I seem to be having some trouble denying access to my proxy. I'm running squid 3.1.9. Here's the relevant part of my squid.conf: > > # my machine only > acl myMachine src 10.8.144.43 > > # some destination servers > acl dest1 dst 10.8.110.13 > acl dest2 dst 10.8.110.14 > acl dest3 dst 10.10.12.213 > > # allow access to the specified servers, deny to everything else > http_access allow myMachine > http_access allow dest1 > http_access allow dest2 > http_access allow dest3 > http_access deny all > > (I've commented out the "http_access allow localnet" and "http_access > allow localhost" lines) > > I'm connecting from 10.8.145.177 and the proxy seems to forward the requests just fine. Nothing is cached, because I have some other cache options in my file, but I'm wondering why the request isn't denied. > > I also have some refresh_pattern options, but I believe those are only supposed to affect caching. Those should have no bearing on http access, correct? > > I've looked through the docs, and I can't figure out what I'm doing wrong. > > Anyone have any ideas? > > Thanks for your time, > > -Adam > just a quick guess ... first match counts if you are surfing from 10.8.144.43, it works because of this acl: http_access allow myMachine if you are using from another src address to either dest1, dest2 or dest3, it works because of one of the next 3 acls. It will probably not work, if you are surfing to other destinations because it that case, the deny all will prevent it if you only want to allow 10.8.144.43 to surf to one of these addresses, try this: http_access allow myMachine dest1 http_access allow myMachine dest2 http_access allow myMachine dest3 http_access deny all Now it should work.
