#### Proxy SQUID
http_port ip_do_seu_servidor:3128
icp_port 0

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl purge method PURGE
acl sqstat src 192.168.0.3/255.255.255.255
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl SSL_ports port 81
acl SSL_ports port 10000
acl Safe_ports port 80 # http
acl Safe_ports port 20 # ftp
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 81
acl Safe_ports port 666
acl Safe_ports port 8080-8091
acl Safe_ports port 2020-2021
acl Safe_ports port 2121-2130
acl Safe_ports_webmin port 10000 # webmin
acl CONNECT method CONNECT

cache_effective_user squid
cache_effective_group squid
httpd_suppress_version_string on
visible_hostname big-brother.proxy-local.com.br
cache_mem 1024 MB
shutdown_lifetime 3 seconds
uri_whitespace allow
maximum_object_size_in_memory 2048 KB
memory_replacement_policy heap LFUDA
cache_replacement_policy heap LFUDA
cache_mgr helpdesk@proxy-inc.com
cache_dir ufs /var/spool/squid 1024 128 256
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
pid_filename /var/run/squid.pid
#minimum_object_size 0 KB
#maximum_object_size 10 KB
max_filedesc 16384
cache_swap_low 90
cache_swap_high 95
mail_program mail
delay_pools 0
error_directory /usr/share/squid/errors/Portuguese
hosts_file /etc/hosts
coredump_dir /var/spool/squid
ftp_passive on
cachemgr_passwd secret all


dns_nameservers DNS DA REDE

##### Redes proxy / net2
acl net_proxy src RANGE DA SUA REDE

##### LOG DETALHADO SÓ HABILITEI PARA SOLUCIONAR PROBLEMAS
#logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
#logformat squidmime %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt [%>h] [%<h]
#logformat common %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st %Ss:%Sh
#logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

######## Não faz cache das urls dentro do arquivo "/var/squid/acl/donotcache.acl"

acl donotcache dstdomain "/etc/squid/acl/donotcache.acl"
cache deny donotcache

####### ACL usuarios sem autenticacao por IP ou por MAC
acl noauth src "/etc/squid/acl/noauth.acl"
acl arpnoauth arp "/etc/squid/acl/arpnoauth.acl"
#http_access allow arpnoauth
######## Inicio - Autenticacao no LDAP
auth_param basic program /usr/lib/squid/squid_ldap_auth -v 3 -b "dc=proxy-local,dc=com,dc=br" -f "uid=%s" -h IP DO SERVIDOR LDAP
auth_param basic children 10
auth_param basic realm INFORME SEU NOME DE USUARIO E SENHA DE REDE
auth_param basic credentialsttl 4 hour
auth_param basic casesensitive on
acl password proxy_auth REQUIRED

####### ACL proxy
######## ACL usuario nestas acls devem ser cadastrados apenas nomes de usuario de rede
#### Cadastre todos os usuários de cada departamento

#### Cadastre todos os usuários que não devem ter restrições
acl proxy_unrestricted_users proxy_auth "/etc/squid/acl/proxy/proxy_unrestricted_users.acl"

### Aquid você deve cadastrar todos os usuários do departamento administrativo
acl proxy_administrativo_users proxy_auth "/etc/squid/acl/proxy/proxy_administrativo_users.acl"

#### Nesta acl você deve cadastrar apenas usuarios
acl users_whitelist_sites proxy_auth "/etc/squid/acl/proxy/users_whitelist_sites.acl"
acl users_msn_whitelist_web proxy_auth -i "/etc/squid/acl/proxy/users_msn_whitelist_web.acl"
acl users_msn_whitelist proxy_auth "/etc/squid/acl/proxy/users_msn_whitelist.acl"
acl users_webmail_whitelist proxy_auth "/etc/squid/acl/proxy/users_webmail_whitelist.acl"
acl users_streaming1_whitelist proxy_auth "/etc/squid/acl/proxy/users_streaming1_whitelist.acl"
acl users_streaming2_whitelist proxy_auth "/etc/squid/acl/proxy/users_streaming2_whitelist.acl"
acl users_download_whitelist proxy_auth "/etc/squid/acl/proxy/users_download_whitelist.acl"
acl users_downaudio_whitelist proxy_auth "/etc/squid/acl/proxy/users_downaudio_whitelist.acl"
acl users_url_whitelist proxy_auth "/etc/squid/acl/proxy/users_url_whitelist.acl"
acl users_palavra_whitelist proxy_auth "/etc/squid/acl/proxy/users_palavra_whitelist.acl"
acl users_sites_down_whitelist proxy_auth "/etc/squid/acl/proxy/users_sites_down_whitelist.acl"
acl users_sites_videos_whitelist proxy_auth "/etc/squid/acl/proxy/users_sites_videos_whitelist.acl"
acl users_sites_blog_whitelist proxy_auth "/etc/squid/acl/proxy/users_sites_blog_whitelist.acl"
acl users_relacio_whitelist proxy_auth "/etc/squid/acl/proxy/users_relacio_whitelist.acl"
acl proxy_googledoc_users proxy_auth "/etc/squid/acl/proxy/proxy_googledoc_users.acl"

#### Aqui você deve cadastrar sites, mime types, palavras, dominios
acl whitelist_all dstdom_regex "/etc/squid/acl/whitelist_all.acl"
acl proxy_webmail_whitelist dstdom_regex -i "/etc/squid/acl/proxy/proxy_webmail_whitelist.acl"
acl proxy_streaming1_whitelist rep_mime_type "/etc/squid/acl/proxy/proxy_streaming1_whitelist.acl"
acl proxy_streaming2_whitelist req_mime_type "/etc/squid/acl/proxy/proxy_streaming2_whitelist.acl"
acl proxy_download_whitelist urlpath_regex "/etc/squid/acl/proxy/proxy_download_whitelist.acl"
acl proxy_url_whitelist url_regex "/etc/squid/acl/proxy/proxy_url_whitelist.acl"
acl proxy_palavra_whitelist url_regex "/etc/squid/acl/proxy/proxy_palavra_whitelist.acl"
acl proxy_sites_down_whitelist dstdom_regex "/etc/squid/acl/proxy/proxy_sites_down_whitelist.acl"
acl proxy_sites_videos_whitelist dstdom_regex "/etc/squid/acl/proxy/proxy_sites_videos_whitelist.acl"
acl proxy_googledoc_whitelist url_regex "/etc/squid/acl/proxy/proxy_googledoc_whitelist.acl"

######### ACLs blacklist Sites, downloads, messengers, streaming e etc
######### Nestas deve-se apenas inserir os sites, extensoes urls, palavras
######### Nao utilize ip de usuarios e nem nomes de usuartios
acl proxy_blacklist_all dstdom_regex -i "/etc/squid/acl/proxy_blacklist.acl"
acl proxy_blacklist_sites dstdom_regex -i "/etc/squid/acl/proxy/proxy_blacklist_sites.acl"
acl proxy_msn_blacklist_web dstdom_regex -i "/etc/squid/acl/proxy/proxy_msn_blacklist_web.acl"
acl proxy_msn_blacklist url_regex "/etc/squid/acl/proxy/proxy_msn_blacklist.acl"
acl proxy_webmail_blacklist dstdom_regex "/etc/squid/acl/proxy/proxy_webmail_blacklist.acl"
acl proxy_streaming1_blacklist rep_mime_type "/etc/squid/acl/proxy/proxy_streaming1_blacklist.acl"
acl proxy_streaming2_blacklist req_mime_type "/etc/squid/acl/proxy/proxy_streaming2_blacklist.acl"
acl proxy_download_blacklist urlpath_regex "/etc/squid/acl/proxy/proxy_download_blacklist.acl"
acl proxy_downaudio_blacklist urlpath_regex "/etc/squid/acl/proxy/proxy_downaudio_blacklist.acl"
acl proxy_url_blacklist url_regex "/etc/squid/acl/proxy/proxy_url_blacklist.acl"
acl proxy_palavra_blacklist url_regex "/etc/squid/acl/proxy/proxy_palavra_blacklist.acl"
acl proxy_sites_down_blacklist dstdom_regex "/etc/squid/acl/proxy/proxy_sites_down_blacklist.acl"
acl proxy_sites_videos_blacklist dstdom_regex "/etc/squid/acl/proxy/proxy_sites_videos_blacklist.acl"
acl proxy_relacio_blacklist url_regex "/etc/squid/acl/proxy/proxy_relacio_blacklist.acl"
acl proxy_sites_blog_blacklist url_regex "/etc/squid/acl/proxy/proxy_sites_blog_blacklist.acl"

######## Bloqueia proxy free para todos da rede
acl proxy_blacklist_all dstdom_regex -i "/etc/squid/acl/proxy_blacklist.acl"

##### Libera acesso geral sem autenticação

http_access allow all noauth
http_reply_access allow all noauth
http_access allow noauth

http_access allow all arpnoauth
http_reply_access allow all arpnoauth
http_access allow arpnoauth

######## Libera sites geral para todos no rede
http_access allow whitelist_all all
http_reply_access allow whitelist_all all

##### INICIO - REGRAS ALLOW FULL
####### Acesso geral para todos usuarios cadastrados no arquivo /etc/squid/acl/proxy/proxy_unrestricted_users.acl

http_access allow all proxy_unrestricted_users
http_reply_access allow all proxy_unrestricted_users

#### FIM - REGRAS ALLOW FULL

#### Por usuario
http_access allow proxy_blacklist_sites users_whitelist_sites
http_access allow proxy_msn_blacklist_web users_msn_whitelist_web
http_access allow proxy_msn_blacklist users_msn_whitelist
http_reply_access allow proxy_msn_blacklist users_msn_whitelist
http_access allow proxy_webmail_blacklist users_webmail_whitelist
http_access allow proxy_streaming1_blacklist users_streaming1_whitelist
http_access allow proxy_streaming2_blacklist users_streaming2_whitelist
http_reply_access allow proxy_streaming1_blacklist users_streaming1_whitelist
http_reply_access allow proxy_streaming2_blacklist users_streaming2_whitelist
http_access allow proxy_download_blacklist users_download_whitelist
http_reply_access allow proxy_download_blacklist users_download_whitelist
http_access allow proxy_palavra_blacklist users_palavra_whitelist
http_access allow proxy_sites_down_blacklist users_sites_down_whitelist
http_access allow proxy_sites_videos_blacklist users_sites_videos_whitelist
http_access allow proxy_sites_blog_blacklist users_sites_blog_whitelist
http_access allow proxy_relacio_blacklist users_relacio_whitelist

###### Deny all com exessao do grupo proxy_unrestricted_users proxy_unrestricted_hosts o restante sera bloqueado
http_access deny proxy_blacklist_all
http_access deny proxy_webmail_blacklist
http_access deny proxy_streaming1_blacklist
http_reply_access deny proxy_streaming1_blacklist
http_access deny proxy_streaming2_blacklist
http_reply_access deny proxy_streaming2_blacklist
http_access deny proxy_sites_videos_blacklist
http_access deny proxy_sites_down_blacklist
http_access deny proxy_blacklist_sites
http_access deny proxy_msn_blacklist_web
http_access deny proxy_msn_blacklist
http_access deny proxy_download_blacklist
http_access deny proxy_downaudio_blacklist
http_access deny proxy_url_blacklist
http_access deny proxy_palavra_blacklist
http_access deny proxy_sites_blog_blacklist
http_access deny proxy_relacio_blacklist

http_access allow manager sqstat
http_access allow manager localhost
http_access allow localhost
#http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
cache deny QUERY

#### LIBERA INTERNET PARA AS REDES net_proxy
http_access allow password

##### DENY FOR ALL
http_access deny all