He's right, it will work but the loopback trigger will happen and be logged, What I found easier was using a simple proxy for the outer proxy so that you don't have the caching overhead, and using squid internally using ACL's.. The bigger problem is that you can't tell squid to use a certain parent for 1 outgoing ACL and a different one for another (as far as I can tell). So I have basically accomplished this (still waiting on a few bugs in squid-3 that are showstoppers before I can move it to production) by writing a patch to DansGuardian that would add an X-Naughty header when a page is naughty, and squid uses an external ACL to check on the reply header (this needed a patch) and then used deny_info on the http_reply_access acl (which also needed a patch). Once I have this all stable I'll send the patches upstream.. if you want them now you can email me offlist or whatever, at least one of them is in squids bugzilla but needs to be rewritten cleaner for inclusion.. Hope this helps..
Joshua Brindle UNIX Administrator Southern Nazarene University >>> Robert Collins <[EMAIL PROTECTED]> 09/27/03 05:34PM >>> On Sun, 2003-09-28 at 07:58, Chris Wilcox wrote: > Hmm, apparently it is being done with one squid instance by at least 2 > people I've messaged on a forum though they've yet to describe it fully > enough for me to understand. I was kinda wondering why I can't just send > localhost requests direct (either direct to the web or direct to a true > parent proxy) and requests from the LAN through to the DansGuardian > instances. This wouldn't loop as far as I can see? network->squid instance X->dansguardian->squid instance X ^ loop detection will trigger here. Please, see the FAQ on running two instances, and then setup it up. Rob -- GPG key available at: <http://members.aardvark.net.au/lifeless/keys.txt>.