Squid 3 issues

opethdisciple · 25 Feb 2016 at 21:35

I'm having a little play around with Squid 3 running on a ubuntu server at home.

It works. I made a backup of the squid.conf file and added an acl in to block espn.com as an learning experience.

It worked!

I commented out the acl using the # symbol, stopped/restarted squid but espn.com was still blocked.

I removed the acl entirely. Stopped/restarted squid and again espn.com is blocked.

Super odd. So I restored the original squid.conf file.

I've moved on from trying to figure out why I couldn't unblock espn.com, however I have noticed that some sites work through the proxy whilst others do not. "The proxy server is refusing connections" is the message. I've figured this out. Becuase it wasnt using the proxy!

This is with a default out of the box config file.

Also does any one know how to turn on https proxying? If I enable https proxy in Firefox, I start seeing denied entries in the access.log file. But by default HTTPS seems to be enabled in squid. so I am still confused. Because it doesn't work!

opethdisciple · 25 Feb 2016 at 22:45

Solved the HTTPS issue. Erm.... I hadnt given the localnet access to the proxy.

celliott · 27 Feb 2016 at 15:20

Did you get the problem fixed with blocking domains? It's much easier to manage using an external list than editing squid.conf each time

e.g. Add this in the ACL section:

acl blockdomain dstdomain "/etc/squid/blocked-domains.conf"

Then make your http_access line look like this:

http_access allow localnet !blockdomain

Now you can add domains one per line into /etc/squid/blocked-domains.conf and do service squid reload / systemctl squid reload to re-read that file.

Add entries like this (no http/https/www prefix):
.badaddress.com

If your still having problems let us know

opethdisciple · 27 Feb 2016 at 16:07

celliott said:
Did you get the problem fixed with blocking domains? It's much easier to manage using an external list than editing squid.conf each time

e.g. Add this in the ACL section:

acl blockdomain dstdomain "/etc/squid/blocked-domains.conf"

Then make your http_access line look like this:

http_access allow localnet !blockdomain

Now you can add domains one per line into /etc/squid/blocked-domains.conf and do service squid reload / systemctl squid reload to re-read that file.

Add entries like this (no http/https/www prefix):
.badaddress.com

If your still having problems let us know

Cool. Thanks for that. I guess that makes it easier to manage and also makes it less likely that by editing the main squid.conf file you could do some epic screw up!!