squid-cache.org

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

	Defining an Access List

	Every access list definition must begin with an aclname and acltype, 
	followed by either type-specific arguments or a quoted filename that
	they are read from.

	   acl aclname acltype argument ...
	   acl aclname acltype "file" ...

	When using "file", the file should contain one item per line.

	By default, regular expressions are CASE-SENSITIVE.
	To make them case-insensitive, use the -i option. To return case-sensitive
	use the +i option between patterns, or make a new ACL line without -i.

	Some acl types require suspending the current request in order
	to access some external data source.
	Those which do are marked with the tag [slow], those which
	don't are marked as [fast].
	See http://wiki.squid-cache.org/SquidFaq/SquidAcl
	for further information

	***** ACL TYPES AVAILABLE *****

	acl aclname src ip-address/mask ...	# clients IP address [fast]
	acl aclname src addr1-addr2/mask ...	# range of addresses [fast]
	acl aclname dst ip-address/mask ...	# URL host's IP address [slow]
	acl aclname localip ip-address/mask ... # IP address the client connected to [fast]

	acl aclname arp      mac-address ... (xx:xx:xx:xx:xx:xx notation)
	  # The arp ACL requires the special configure option --enable-arp-acl.
	  # Furthermore, the ARP ACL code is not portable to all operating systems.
	  # It works on Linux, Solaris, Windows, FreeBSD, and some
	  # other *BSD variants.
	  # [fast]
	  #
	  # NOTE: Squid can only determine the MAC address for clients that are on
	  # the same subnet. If the client is on a different subnet,
	  # then Squid cannot find out its MAC address.

	acl aclname srcdomain   .foo.com ...
	  # reverse lookup, from client IP [slow]
	acl aclname dstdomain   .foo.com ...
	  # Destination server from URL [fast]
	acl aclname srcdom_regex [-i] \.foo\.com ...
	  # regex matching client name [slow]
	acl aclname dstdom_regex [-i] \.foo\.com ...
	  # regex matching server [fast]
	  #
	  # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
	  # based URL is used and no match is found. The name "none" is used
	  # if the reverse lookup fails.

	acl aclname src_as number ...
	acl aclname dst_as number ...
	  # [fast]
	  # Except for access control, AS numbers can be used for
	  # routing of requests to specific caches. Here's an
	  # example for routing all requests for AS#1241 and only
	  # those to mycache.mydomain.net:
	  # acl asexample dst_as 1241
	  # cache_peer_access mycache.mydomain.net allow asexample
	  # cache_peer_access mycache_mydomain.net deny all

	acl aclname peername myPeer ...
	  # [fast]
	  # match against a named cache_peer entry
	  # set unique name= on cache_peer lines for reliable use.

	acl aclname time [day-abbrevs] [h1:m1-h2:m2]
	  # [fast]
	  #  day-abbrevs:
	  #	S - Sunday
	  #	M - Monday
	  #	T - Tuesday
	  #	W - Wednesday
	  #	H - Thursday
	  #	F - Friday
	  #	A - Saturday
	  #  h1:m1 must be less than h2:m2

	acl aclname url_regex [-i] ^http:// ...
	  # regex matching on whole URL [fast]
	acl aclname urllogin [-i] [^a-zA-Z0-9] ...
	  # regex matching on URL login field
	acl aclname urlpath_regex [-i] \.gif$ ...
	  # regex matching on URL path [fast]

	acl aclname port 80 70 21 0-1024...   # destination TCP port [fast]
	                                      # ranges are alloed
	acl aclname localport 3128 ...	      # TCP port the client connected to [fast]
	                                      # NP: for interception mode this is usually '80'

	acl aclname myportname 3128 ...       # http(s)_port name [fast]

	acl aclname proto HTTP FTP ...        # request protocol [fast]
 
	acl aclname method GET POST ...       # HTTP request method [fast]

	acl aclname http_status 200 301 500- 400-403 ... 
	  # status code in reply [fast]

	acl aclname browser [-i] regexp ...
	  # pattern match on User-Agent header (see also req_header below) [fast]

	acl aclname referer_regex [-i] regexp ...
	  # pattern match on Referer header [fast]
	  # Referer is highly unreliable, so use with care

	acl aclname ident username ...
	acl aclname ident_regex [-i] pattern ...
	  # string match on ident output [slow]
	  # use REQUIRED to accept any non-null ident.

	acl aclname proxy_auth [-i] username ...
	acl aclname proxy_auth_regex [-i] pattern ...
	  # perform http authentication challenge to the client and match against
	  # supplied credentials [slow]
	  #
	  # takes a list of allowed usernames.
	  # use REQUIRED to accept any valid username.
	  #
	  # Will use proxy authentication in forward-proxy scenarios, and plain
	  # http authenticaiton in reverse-proxy scenarios
	  #
	  # NOTE: when a Proxy-Authentication header is sent but it is not
	  # needed during ACL checking the username is NOT logged
	  # in access.log.
	  #
	  # NOTE: proxy_auth requires a EXTERNAL authentication program
	  # to check username/password combinations (see
	  # auth_param directive).
	  #
	  # NOTE: proxy_auth can't be used in a transparent/intercepting proxy
	  # as the browser needs to be configured for using a proxy in order
	  # to respond to proxy authentication.

	acl aclname snmp_community string ...
	  # A community string to limit access to your SNMP Agent [fast]
	  # Example:
	  #
	  #	acl snmppublic snmp_community public

	acl aclname maxconn number
	  # This will be matched when the client's IP address has
	  # more than <number> TCP connections established. [fast]
	  # NOTE: This only measures direct TCP links so X-Forwarded-For
	  # indirect clients are not counted.

	acl aclname max_user_ip [-s] number
	  # This will be matched when the user attempts to log in from more
	  # than <number> different ip addresses. The authenticate_ip_ttl
	  # parameter controls the timeout on the ip entries. [fast]
	  # If -s is specified the limit is strict, denying browsing
	  # from any further IP addresses until the ttl has expired. Without
	  # -s Squid will just annoy the user by "randomly" denying requests.
	  # (the counter is reset each time the limit is reached and a
	  # request is denied)
	  # NOTE: in acceleration mode or where there is mesh of child proxies,
	  # clients may appear to come from multiple addresses if they are
	  # going through proxy farms, so a limit of 1 may cause user problems.

	acl aclname random probability
	  # Pseudo-randomly match requests. Based on the probability given.
	  # Probability may be written as a decimal (0.333), fraction (1/3)
	  # or ratio of matches:non-matches (3:5).

	acl aclname req_mime_type [-i] mime-type ...
	  # regex match against the mime type of the request generated
	  # by the client. Can be used to detect file upload or some
	  # types HTTP tunneling requests [fast]
	  # NOTE: This does NOT match the reply. You cannot use this
	  # to match the returned file type.

	acl aclname req_header header-name [-i] any\.regex\.here
	  # regex match against any of the known request headers.  May be
	  # thought of as a superset of "browser", "referer" and "mime-type"
	  # ACL [fast]

	acl aclname rep_mime_type [-i] mime-type ...
	  # regex match against the mime type of the reply received by
	  # squid. Can be used to detect file download or some
	  # types HTTP tunneling requests. [fast]
	  # NOTE: This has no effect in http_access rules. It only has
	  # effect in rules that affect the reply data stream such as
	  # http_reply_access.

	acl aclname rep_header header-name [-i] any\.regex\.here
	  # regex match against any of the known reply headers. May be
	  # thought of as a superset of "browser", "referer" and "mime-type"
	  # ACLs [fast]

	acl aclname external class_name [arguments...]
	  # external ACL lookup via a helper class defined by the
	  # external_acl_type directive [slow]

	acl aclname user_cert attribute values...
	  # match against attributes in a user SSL certificate
	  # attribute is one of DN/C/O/CN/L/ST [fast]

	acl aclname ca_cert attribute values...
	  # match against attributes a users issuing CA SSL certificate
	  # attribute is one of DN/C/O/CN/L/ST [fast]

	acl aclname ext_user username ...
	acl aclname ext_user_regex [-i] pattern ...
	  # string match on username returned by external acl helper [slow]
	  # use REQUIRED to accept any non-null user name.

	acl aclname tag tagvalue ...
	  # string match on tag returned by external acl helper [slow]

	acl aclname hier_code codename ...
	  # string match against squid hierarchy code(s); [fast]
	  #  e.g., DIRECT, PARENT_HIT, NONE, etc.
	  #
	  # NOTE: This has no effect in http_access rules. It only has
	  # effect in rules that affect the reply data stream such as
	  # http_reply_access.

IF USE_SSL
	acl aclname ssl_error errorname
	  # match against SSL certificate validation error [fast]
	  #
	  # For valid error names see in /usr/local/squid/share/errors/templates/error-details.txt
	  # template file.
	  #
	  # The following can be used as shortcuts for certificate properties:
	  #  [ssl::]certHasExpired: the "not after" field is in the past
	  #  [ssl::]certNotYetValid: the "not before" field is in the future
	  #  [ssl::]certUntrusted: The certificate issuer is not to be trusted.
	  #  [ssl::]certSelfSigned: The certificate is self signed.
	  #  [ssl::]certDomainMismatch: The certificate CN domain does not
	  #         match the name the name of the host we are connecting to.
	  #
	  # The ssl::certHasExpired, ssl::certNotYetValid, ssl::certDomainMismatch,
	  # ssl::certUntrusted, and ssl::certSelfSigned can also be used as
	  # predefined ACLs, just like the 'all' ACL.
	  #
	  # NOTE: The ssl_error ACL is only supported with sslproxy_cert_error,
	  # sslproxy_cert_sign, and sslproxy_cert_adapt options.
ENDIF

	Examples:
		acl macaddress arp 09:00:2b:23:45:67
		acl myexample dst_as 1241
		acl password proxy_auth REQUIRED
		acl fileupload req_mime_type -i ^multipart/form-data$
		acl javascript rep_mime_type -i ^application/x-javascript$