<html><head></head><body><div class="ydpa261fa7cyahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div></div>
<div dir="ltr" data-setdir="false">Thanks Amos and Klauss for your response.<br><br></div><div><br></div>
</div><div id="ydp44daa09ayahoo_quoted_5886555351" class="ydp44daa09ayahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Wednesday, 24 February, 2021, 05:03:57 pm IST, Amos Jeffries <squid3@treenet.co.nz> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">On 24/02/21 10:14 pm, Klaus Brandl wrote:<br clear="none">> The acl for the url must be of type url_regex, or something else:<br clear="none">> <br clear="none">> acl allowedurl url_regex "url.txt"<br clear="none">> <br clear="none"><br clear="none">This line tells Squid to load a file full of regex patterns. Nothing more.<br clear="none"><br clear="none"><br clear="none">The http_access line is the list of rules that determines when those <br clear="none">loaded values are tested against a URL, and what happens when the URL <br clear="none">matches (or not) any of the patterns.<br clear="none"><br clear="none"><br clear="none">> <br clear="none">> Am Dienstag, den 23.02.2021, 18:09 +0000 schrieb Arjun K:<br clear="none">>> Hi Team<br clear="none">>><br clear="none">>> Could you please let me know how to define an acl so that a specific<br clear="none">>> set of IPs can access alone a specific set of URLs.<br clear="none"><br clear="none"><br clear="none">Have you read the docs on how Squid does access control?<br clear="none"> <br clear="none"><<a shape="rect" href="https://wiki.squid-cache.org/SquidFaq/SquidAcl#The_Basics:_How_the_parts_fit_together" rel="nofollow" target="_blank">https://wiki.squid-cache.org/SquidFaq/SquidAcl#The_Basics:_How_the_parts_fit_together</a>><br clear="none"><br clear="none">The example config you showed indicates a lack of understanding the <br clear="none">syntax. That understanding is key to these things actually working the <br clear="none">way you want.<br clear="none"><br clear="none"><br clear="none">Lets look at your stated requirements:<br clear="none"><br clear="none"> > define an acl<br clear="none"><br clear="none">acl okay_urls url_regex "/etc/squid/url.txt"<br clear="none"><br clear="none"><br clear="none"> > a specific set of IPs can access alone a specific set of URLs.<br clear="none"><br clear="none">That sentence is an access policy. It has three parts:<br clear="none"><br clear="none"> 1) "set of IPs"<br clear="none"><br clear="none"> I have assumed from the "can access" words that you mean client IPs. <br clear="none">Which in networking are the TCP src-IP value.<br clear="none"><br clear="none">So ...<br clear="none"><br clear="none"> acl set_of_IPs src 192.0.2.1 192.0.2.45 192.0.2.156<br clear="none"><br clear="none"> 2) "set of URLs"<br clear="none"><br clear="none">So ...<br clear="none"><br clear="none"> acl set_of_urls url_regex "/etc/squid/url.txt"<br clear="none"><br clear="none"><br clear="none"> 3) "can access alone"<br clear="none"><br clear="none">I assume that means you want these IPs to access the URLs. But no others <br clear="none">to be able to access those same URLs.<br clear="none"><br clear="none">So ...<br clear="none"> # permit set_of_ips<br clear="none"> http_access allow set_of_ips set_of_urls<br clear="none"> http_access deny set_of_urls<br clear="none"><br clear="none"><br clear="none"><br clear="none"> > Also, I have an existing configuration which should not get affected<br clear="none"> > and it should not interfere in the rules which were allowed for the<br clear="none"> > servers previously.<br clear="none"><br clear="none">The most important word there is "previously".<br clear="none"><br clear="none">This is where *you* understanding how Squid access controls fit together <br clear="none">matters *a lot*.<br clear="none"><br clear="none">The first http_access line that matches entirely will _end_ processing <br clear="none">of the 'http_access' sequence. The action (allow/deny) specified on that <br clear="none">matched line will be done.<br clear="none"><br clear="none">So where you place the above http_access lines determine which <br clear="none">transactions will be able to reach and be tested by them.<br clear="none"><br clear="none"><br clear="none">Amos<div class="ydp44daa09ayqt7181983771" id="ydp44daa09ayqtfd01034"><br clear="none">_______________________________________________<br clear="none">squid-users mailing list<br clear="none"><a shape="rect" href="mailto:squid-users@lists.squid-cache.org" rel="nofollow" target="_blank">squid-users@lists.squid-cache.org</a><br clear="none"><a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" rel="nofollow" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br clear="none"></div></div></div>
</div>
</div></body></html>