|
Hm, beside the order, it looks good. So if i understand correct, you want to deny everything except whats in
your whitelist_primaire file.? Than take this copy of my home config, and i adjusted to your settings
already. so you should be able to copy past this. ;-) it mostly a default file for the learning process. Look where i put your rules and look at the
order. #--------------FROM HERE --------------------------- acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 1025-65535 # unregistered ports acl CONNECT method CONNECT # own ACL rules acl localnet src 192.168.0.0/24 # RFC 1918 local private network (LAN) # and maybe also add : acl localnet src 192.168.1.0/24 # RFC 1918 local
private network (LAN) # # OR acl localnet src 192.168.0.0/23 # RFC 1918 local private network
(LAN) # since i see 192.168.0.0 and 192.168.1.x in you mails. # acl to explicit allowed sites. acl whitelist_prim dstdomain "/etc/squid3/whitelist_primaire" ## To always block ads, put them above all other rules. ## optional block advertising site rules here. ## https://calomel.org/squid_adservers.html
# # Recommended minimum Access Permission configuration: # # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Only allow cachemgr access from localhost http_access allow localhost manager http_access deny manager # We strongly recommend the following be uncommented to protect
innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # Allow sites in whitelist_primaire http_access allow whitelist_prim # Deny sites not in whitelist_primaire http_access deny !whitelist_prim # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # other rules http_port 192.168.0.28:3128 cache_mem 512 MB maximum_object_size_in_memory 1024 KB cache_dir ufs /var/spool/squid3 5000 16 256 ################################### ## If /dev/null is specified to any of the above log files, ## logfile rotate MUST also be set to 0 or else risk Squid ## rotating away /dev/null making it a plain log file ###################################### access_log daemon:/var/log/squid3/access.log squid #access_log none cache_log /var/log/squid3/cache.log #cache_log /dev/null cache_store_log /var/log/squid3/cache.log #cache_store_log none ####################################### coredump_dir /var/spool/squid3 # change this to you country code the "nl" to .. error_directory /usr/share/squid-langpack/nl pinger_enable off # # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 httpd_suppress_version_string on #--------------TO HERE --------------------------- Greetz, Louis > -----Oorspronkelijk bericht----- > Van: squid-users [mailto:squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx] Namens > adego70@xxxxxxxxx > Verzonden: vrijdag 19 augustus 2016 13:38 > Aan: squid-users@xxxxxxxxxxxxxxxxxxxxx > Onderwerp: Re: HTTPS - THE PROXY SERVER IS REFUSING > > Thank you for your help (both L.P.H. van Belle & Amos Jeffries). > > I changed my squid.conf but now, I don't obtain any url deny... > In fact, any http & https url are allowed even if they not in > whitelist_primaire. > I made many tests but I can't find the good way... > Please find enclosed the conf for Firefox. > > My new conf : > http_port 3128 > acl localnet src 192.168.0.0/24 # RFC 1918 local private network (LAN) > > acl SSL_ports port 443 > > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl Safe_ports port 1025-65535 # unregistered ports > > acl CONNECT method CONNECT > > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow localhost manager > http_access deny manager > > > acl whitelist_prim dstdomain "/etc/squid3/whitelist_primaire" > http_access deny !whitelist_prim > > http_access allow localnet > http_access allow localhost > http_access deny all > > coredump_dir /var/spool/squid3 > > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > |
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
