Squid

deuz
(usa Debian)

Enviado em 28/05/2010 - 11:50h

Olá, amigos, instalei ontem o squid no fedora 10, tudo funciona, menos o bloqueio de paginas da black list, veja as regras que estou usando:

visible_hostname 192.168.1.254
acl localnet src 192.168.1.0/24 # RFC1918 possible internal network
http_access allow localhost
http_access allow localnet

# Opcoes de acls de controles
# acl pra sites direto, nãar pelo cache
acl NOCACHE url_regex "/etc/squid/direto.txt" \?
no_cache deny NOCACHE

#Acl para liberar acesso a partir das 08
acl intervalo time M T W H F 06:00-08:00
acl inter src 192.168.1.42 192.168.1.24 192.168.1.29 192.168.1.31 192.168.1.25 192.168.1.49 192.168.1.18 192.168.1.17 192.168.1.26 192.168.1.37 192.168.1.162 192.168.1.33 192.168.1.133 192.168.1.22 192.169.1.62 192.168.1.122 192.168.1.54 192.168.1.154 192.168.1.52 192.168.1.5 192.168.1.207
http_access deny intervalo inter

# Acl para bloquear por horario
acl restric time M T W H F 16:30-23:59
acl restringir src 192.168.1.24 192.168.1.32
http_access deny restric restringir

acl liber url_regex --i "/etc/squid/libert.txt"
http_access allow liber

# acl para bloquear tudo
acl teste url_regex -i "/etc/squid/teste.txt"
http_access deny teste all


# acl bloqueia maquinas para nao acessarem a internet
acl negatudo src 192.168.1.247 192.168.1.3 192.168.1.64 192.168.1.35 192.168.1.5 192.168.1.251 192.168.1.163 192.168.1.34 192.168.1.43 192.168.1.244
http_access deny negatudo

# acl pra bloquear palavras nos endereco liberar excessao
acl nodownload urlpath_regex -i "/etc/squid/nodown.txt"
http_access deny nodownload

#acl para restringir o acesso ao msn, somente essas maquinas acessam o msn.
acl IPLIBERAR src 192.168.1.31 192.168.1.161 192.168.1.13 192.168.1.51 192.168.1.15 192.168.1.28 192.168.1.12 192.168.1.11 192.168.1.103 192.168.1.1 192.168.1.205 192.168.1.106 192.168.1.10 192.168.1.157 192.168.1.52 192.168.1.50 192.168.1.2
http_access allow IPLIBERAR

acl msn dstdomain loginnet.passport.com
http_access deny msn

acl msnmessenger url_regex -i gateway.dll
acl gate req_mime_type -i ^application/x-msn-messenger$
http_access deny gate
http_access deny msnmessenger

acl proibidos url_regex -i "/etc/squid/proibidos.txt"
#acl libera url_regex "/etc/squid/libera"
#http_access allow libera all
http_access deny proibidos all

acl hotmail_domains dstdomain .hotmail.msn.com header_access Accept-Encoding deny hotmail_domains
error_directory /usr/share/squid/errors/Portuguese


#
acl SSL_ports port 8181
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet

# And finally deny all other access to this proxy
http_access allow localhost
http_access deny all
icp_access allow localnet
icp_access deny all
htcp_access allow localnet
htcp_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
cache_mem 2048 MB
maximum_object_size_in_memory 2048 MB
cache_dir ufs /var/spool/squid 2048 16 256
minimum_object_size 0 KB
maximum_object_size 800 MB
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern (cgi-bin|\?) 0 0% 0
refresh_pattern . 0 20% 4320

Se alguem tiver alguma ideia, agradeço muito.

irado
(usa XUbuntu)

Enviado em 28/05/2010 - 16:16h

uma vez que a primeira acl é pra liberar a localnet, não tem como bloquear mais nada, a aplicação das acls é sequencial.