Sunday, May 12, 2013

Configure Squid to block HTTP request to specific web sites


This article show step to configure Squid proxy server to block client from accessing specific web address (to block URL address).  Open and edit the configuration file of Squid proxy server that usually located under /etc/squid/squid.conf..

1.  Find and edit ACCESS CONTROL part and put in the ( acl bad_url dstdomain "/etc/squid/bad-sites.squid" ) as shown in example below.

# ACCESS CONTROLS-------------------------------------- **** +++++
#Examples

#acl macaddress arp 09:00:2b:23:45:67
#acl myexample dst_as 1241
#acl password proxy_auth REQUIRED
#acl fileupload req_mime_type -i ^multipart/form-data$
#acl javascript rep_mime_type -i ^application/x-javascript$
#
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 2083 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 2083 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl FTP proto FTP
acl bad_url dstdomain "/etc/squid/bad-sites.squid"

2.  Then put the (http_access deny bad_url) on http_access part.

# TAG: http_access
# Allowing or Denying access based on defined access lists
#
# Access to the HTTP port:
# http_access allow|deny [!]aclname ...
#
# NOTE on default values:
#
# If there are no "access" lines present, the default is to deny
# the request.
#
# If none of the "access" lines cause a match, the default is the
# opposite of the last line in the list. If the last line was
# deny, the default is allow. Conversely, if the last line
# is allow, the default will be deny. For these reasons, it is a
# good idea to have an "deny all" or "allow all" entry at the end
# of your access lists to avoid potential confusion.
#
#Default:
# http_access deny all
#
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
http_access deny bad_url

3.  Then save and exit the Squid configuration file.

4.  Create file new file called bad-sites.squid and then enter sites URI that clients not suppose to access, save and exit the file:.

[root@cempakasari ~]# cat /etc/squid/bad-sites.squid
...
.fanfiction.net
.meebo.com
.playboy.com
.myspace.com
[root@cempakasari ~]#

5.  Restart or reload the Squid proxy server to make sure the new configuration apply.

RESTART:
[root@linux fedora]# /sbin/service squid stop
[root@linux fedora]# /sbin/service squid start

RELOAD:
[root@linux fedora]# /sbin/service squid reload

6.  Then point the browser URL adrress to the site that you put in the bad site list to verify the changes that you made, if nothing goes wrong you should see the ERROR page that say "The requested URL could not be retrieved".