<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><div>Trying to understand what I am doing wrong with my ACLs (yes I've read the ACL guide on squid site.. but still confused).. <span style="font-size: 12pt;">My client is 172.16.10.101, trying to block access to facebook (and other dstdomain file lists), but it is not working from the client I can still access fb.</span></div><div><br></div><div>Is this because I have this rule below..?</div><div><br></div><div>acl localnet src 172.16.0.0/12</div><div>http_access allow localnet</div><div><br></div><div>Instead of denying everything access and manually maintaining rules, I want to allow http/https access for everything except explicitly defined ACLs (in this case the facebook acl as a test).</div><div><br></div><div>I've tried to set debugging to debug_options ALL,1 33,2 to see more info on ACLs (read on some site this is the debug flags to set) but I don't see any ACL details in my access.log file.</div><div><br></div><div>my squid.conf (for SQUID 3.3.3) file is below..</div><div><br></div><div>acl localnet src 10.0.0.0/8 # RFC1918 possible internal network</div><div>acl localnet src 172.16.0.0/12 # RFC1918 possible internal network</div><div>acl localnet src 192.168.0.0/16 # RFC1918 possible internal network</div><div><br></div><div>acl SSL_ports port 443 8180 8443 563 1494 2598 8531</div><div>acl Safe_ports port 80<span class="Apple-tab-span" style="white-space:pre"> </span># http</div><div>acl Safe_ports port 81 <span class="Apple-tab-span" style="white-space:pre"> </span># http for Pacific Brokerage</div><div>acl Safe_ports port 21<span class="Apple-tab-span" style="white-space:pre"> </span># ftp</div><div>acl Safe_ports port 443 563<span class="Apple-tab-span" style="white-space:pre"> </span># http</div><div>acl Safe_ports port 70<span class="Apple-tab-span" style="white-space:pre"> </span># gopher</div><div>acl Safe_ports port 210<span class="Apple-tab-span" style="white-space:pre"> </span># wais</div><div>acl Safe_ports port 280<span class="Apple-tab-span" style="white-space:pre"> </span># http-mgmt</div><div>acl Safe_ports port 488<span class="Apple-tab-span" style="white-space:pre"> </span># gss-http</div><div>acl Safe_ports port 591<span class="Apple-tab-span" style="white-space:pre"> </span># filemaker</div><div>acl Safe_ports port 777<span class="Apple-tab-span" style="white-space:pre"> </span># multiling http</div><div>acl Safe_ports port 8080 8081 8082 8088 8180</div><div>acl Safe_ports port 3128 <span class="Apple-tab-span" style="white-space:pre"> </span># Squid http server</div><div>acl Safe_ports port 1494 2598 <span class="Apple-tab-span" style="white-space:pre"> </span># ICA - Citrix</div><div>acl Safe_ports port 7000 8000 <span class="Apple-tab-span" style="white-space:pre"> </span># Oracle</div><div>acl Safe_ports port 9000 <span class="Apple-tab-span" style="white-space:pre"> </span># Oracle</div><div>acl Safe_ports port 8530<span class="Apple-tab-span" style="white-space:pre"> </span># WSUS</div><div>acl Safe_ports port 55905<span class="Apple-tab-span" style="white-space:pre"> </span># WSUS</div><div>acl Safe_ports port 1025-65535<span class="Apple-tab-span" style="white-space:pre"> </span># unregistered ports</div><div>acl CONNECT method CONNECT</div><div><br></div><div>http_access allow localhost manager</div><div>http_access deny manager</div><div>http_access deny !Safe_ports</div><div>http_access deny CONNECT !SSL_ports</div><div>http_access deny to_localhost</div><div><br></div><div><b>acl ads dstdomain "/etc/squid/blacklists/ads/domains"</b></div><div><b>acl adult dstdomain "/etc/squid/blacklists/adult/domains"</b></div><div><b>acl gambling dstdomain "/etc/squid/blacklists/gambling/domains"</b></div><div><b>acl fb dstdomain .facebook.com</b></div><div><br></div><div>http_access allow localnet</div><div>http_access allow localhost</div><div><br></div><div><b>http_access deny ads adult gambling fb</b></div><div><br></div><div>http_access deny all</div><div><br></div><div>http_port 8080</div><div>dns_nameservers 172.16.11.3 172.16.11.2 172.16.11.1</div><div>visible_hostname www-proxy</div><div><br></div><div>hierarchy_stoplist cgi-bin ?</div><div><br></div><div>logformat oppy %ts.%03tu %6tr %>a %>A %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt</div><div>access_log daemon:/var/log/squid/access.log oppy</div><div>cache_store_log daemon:/var/log/squid/store.log</div><div>cache_log /var/log/squid/cache.log</div><div>cache_mem 64 MB</div><div>logfile_rotate 4</div><div>debug_options ALL,1</div><div># ACL Debug Options</div><div># debug_options ALL,1 33,2</div><div># debug_options ALL,1 33,2 28,9</div><div>coredump_dir /var/log/squid/squid</div><div><br></div><div>shutdown_lifetime 3 seconds</div><div>dns_v4_first on</div><div>retry_on_error on</div><div>forward_max_tries 25</div><div>forward_timeout 30 seconds</div><div>connect_timeout 30 seconds</div><div>read_timeout 30 seconds</div><div>request_timeout 30 seconds</div><div>persistent_request_timeout 1 minute</div><div><br></div><div>cache_dir ufs /var/cache/squid 100 16 256</div><div>cache_mgr ittechs@domain.com</div><div><br></div><div>snmp_port 0</div><div>icp_port 0</div><div>htcp_port 0</div><div><br></div><div>refresh_pattern ^ftp:<span class="Apple-tab-span" style="white-space:pre"> </span>1440<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre"> </span>10080</div><div>refresh_pattern ^gopher:<span class="Apple-tab-span" style="white-space:pre"> </span>1440<span class="Apple-tab-span" style="white-space:pre"> </span>0%<span class="Apple-tab-span" style="white-space:pre"> </span>1440</div><div>refresh_pattern -i (/cgi-bin/|\?) 0<span class="Apple-tab-span" style="white-space:pre"> </span>0%<span class="Apple-tab-span" style="white-space:pre"> </span>0</div><div>refresh_pattern .<span class="Apple-tab-span" style="white-space:pre"> </span>0<span class="Apple-tab-span" style="white-space:pre"> </span>20%<span class="Apple-tab-span" style="white-space:pre"> </span>4320</div> </div></body>
</html>