## ACLs acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 20 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl git_ports port 9418 # git protocol acl CONNECT method CONNECT http_access deny !Safe_ports http_access allow CONNECT git_ports http_access deny CONNECT !SSL_ports http_access allow CONNECT git_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all ## Service configuration http_port 192.168.178.20:3128 intercept https_port 192.168.178.20:3130 intercept ssl-bump cert=/etc/squid3/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # sslproxy_capath /etc/ssl/certs # obsolete in 4.0.1 #sslproxy_cafile /usr/local/openssl/cabundle.file # unclear where it is in package manager installation # insecure -> use for debugging only sslproxy_cert_error allow all # sslproxy_flags DONT_VERIFY_PEER # obsolete in 4.0.1 cache_dir ufs /var/squid/cache 100 16 256 coredump_dir /var/squid/cache #refresh_pattern ^ftp: 1440 20% 10080 #refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 432000 99% 4320000 refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|tar\.gz|txz|tar\.xz|ram|rar|bin|ppt|doc|tiff|gz|git)$ 100800 99% 432000 store-stale refresh_pattern -i .* 100800 99% 432000 store-stale refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 ftp_port 192.168.178.20:3129 cache_effective_user squid cache_effective_group squid access_log /usr/local/squid/var/log/access.log cache_store_log /usr/local/squid/var/log/cache_store.log cache_log /usr/local/squid/var/log/cache.log pid_filename /usr/local/squid/var/run/squid.pid ## Cache access acl domain_all dstdom_regex -i .* cache allow domain_all # avoid caching of results from IP lookup services (unclear why they're cached # anyway, i.e. whether squid configuration of HTTP reply is badly configured) acl ip_services dstdomain "/etc/squid3/no-cache.acl" cache deny ip_services always_direct allow ip_services ## Cache storage maximum_object_size 20 GB maximum_object_size_in_memory 20 MB minimum_object_size 0 KB ## Others range_offset_limit -1 dns_v4_first on url_rewrite_program /usr/local/squid/lib/apt-cacher-ng_rewriter.py
_______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
