On Tue, 4 Nov 2003, Andrew wrote: > I am running Squid on FreeBSD with two NICs. > Lets say for example, NIC1 = 1.1.1.1 and NIC2 = 2.2.2.1. > And my default gateway is 1.1.1.2 (the gateway (router) also has an IP > address of 2.2.2.2 but we use 1.1.1.2 as the gateway) > I have bound Squid to the 2.2.2.1 IP address.
Hmm.. I don't quite get your setup here... what does your physical network look like? > When Squid goes and requests something from the internet, how can I be > sure that it will ONLY be received/downloaded by NIC2? Does the binding > affect this? Or is this a kernel thing (I would need to run BGP or > something?) This is a routing and access control question. There is two ways to approach your question a) If your network is private and without routing to the Internet, make Squid always use an Internet address (tcp_outgoing_address). As a sub-option of this alternative (when the internal network has routing to the Internet) use policy routing and/or firewalling to make sure this Interent address is not allowed to talk to your internal network. b) Access controls in Squid, denying any requests with destination in the internal networks, best done using dst type ACL. [insert somewhere before your first custom http_access allow rule] # Deny any attempts to access our internal networks via the proxy acl to_internal_net dst 192.168.1.0/24 ... http_access deny to_internal_net My advice is to use approach 'b'. It is tricky to get 'a' correct, and often the conditions which uphold the restriction in 'a' changes over time often invalidating the setup, suddenly allowing the proxy to reach internal resources when other components in the network change. Regards Henrik