Squid - Bloquear por IP { Resolvido }

[mgottfried]

Ola Pessoal
tenho servidor Ubuntu 10.10 rodando squid configurado para bloquear certos sites e msn em toda rede , mas agora tenho que alterar essas regras preciso configurar por ip ex: do ip 192.168.1.5 oa IP 10 acesso total e o restante restrito para alguns sites .

[zekkerj]

Mostre seu squid.conf.

[mgottfried]

http_port 3128 transparent
visible_hostname squid.server
cache_mem 64 MB
maximum_object_size_in_memory 8 MB
maximum_object_size 8 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid/cache1 30 16 256
cache_dir ufs /var/spool/squid/cache2 30 16 256
cache_dir ufs /var/spool/squid/cache3 30 16 256
cache_dir ufs /var/spool/squid/cache4 30 16 256
cache_dir ufs /var/spool/squid/cache5 30 16 256
cache_dir ufs /var/spool/squid/cache6 30 16 256


cache_access_log /var/log/squid/access.log

error_directory /usr/share/squid/errors/Portuguese
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

acl blockedsites url_regex -i "/etc/squid/sites_block.txt"
acl unblockedsites url_regex -i "/etc/squid/sites_free.txt"
http_access deny blockedsites !unblockedsites

# Bloquear MSN
acl HOST_MSN src 192.168.1.0/255.255.255.255
acl Negar_MSN dstdomain "/etc/squid/msn.txt"
acl Negar_MSN2 url_regex "/etc/squid/msn2.txt"
acl msn url_regex -i /gateway/gateway.dll

http_access allow HOST_MSN
http_access deny Negar_MSN
http_access deny Negar_MSN2
http_access deny msn

acl redelocal src 192.168.1.0/24
http_access allow redelocal
http_access allow localhost

http_access deny all

[zekkerj]

acl ips_liberados src "/etc/squid/ips_liberados.txt"
acl sites_restritos dstdomain "/etc/squid/sites_restritos.txt"

http_access deny sites_restritos !ips_liberados

[Paulinunes]

Apenas complementando a resposta anterior:

http_port 3128 transparent
visible_hostname squid.server
cache_mem 64 MB
maximum_object_size_in_memory 8 MB
maximum_object_size 8 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid/cache1 30 16 256
cache_dir ufs /var/spool/squid/cache2 30 16 256
cache_dir ufs /var/spool/squid/cache3 30 16 256
cache_dir ufs /var/spool/squid/cache4 30 16 256
cache_dir ufs /var/spool/squid/cache5 30 16 256
cache_dir ufs /var/spool/squid/cache6 30 16 256


cache_access_log /var/log/squid/access.log

error_directory /usr/share/squid/errors/Portuguese
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

acl blockedsites url_regex -i "/etc/squid/sites_block.txt"
acl unblockedsites url_regex -i "/etc/squid/sites_free.txt"
http_access deny blockedsites !unblockedsites

# Bloquear MSN
acl HOST_MSN src 192.168.1.0/255.255.255.255
acl Negar_MSN dstdomain "/etc/squid/msn.txt"
acl Negar_MSN2 url_regex "/etc/squid/msn2.txt"
acl msn url_regex -i /gateway/gateway.dll
acl ips_liberados src "/etc/squid/ips_liberados.txt"
acl sites_restritos dstdomain "/etc/squid/sites_restritos.txt"

http_access deny sites_restritos !ips_liberados
http_access allow HOST_MSN
http_access deny Negar_MSN
http_access deny Negar_MSN2
http_access deny msn

acl redelocal src 192.168.1.0/24
http_access allow redelocal
http_access allow localhost

http_access deny all

[mgottfried]

mesmo com a alteração continua negando acesso.

[zekkerj]

Se por "site restrito" vc estava querendo dizer MSN, então está funcionando exatamente como esperado...

Pq o controle novo não interfere no bloqueio de MSN, que continua sendo absoluto. Se vc tinha a intenção de liberar MSN pra algumas pessoas, as regras seriam diferentes.

[mgottfried]

quero liberar total para 3 ips da rede , msn e sites em geral.

[zekkerj]

Então é só desativar o trecho específico do MSN, e colocar o URL do MSN nos sites restritos.

[mgottfried]

como ficou



acl blockedsites url_regex -i "/etc/squid/sites_block.txt
acl ips_liberados src "/etc/squid/ips_liberados.txt"
http_access deny blockedsites !ips_liberados