| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192 |
- # WELCOME TO SQUID 6.6
- # ----------------------------
- #
- # This is the documentation for the Squid configuration file.
- # This documentation can also be found online at:
- # http://www.squid-cache.org/Doc/config/
- #
- # You may wish to look at the Squid home page and wiki for the
- # FAQ and other documentation:
- # http://www.squid-cache.org/
- # https://wiki.squid-cache.org/SquidFaq
- # https://wiki.squid-cache.org/ConfigExamples
- #
- # Example rule allowing access from your local networks.
- # Adapt to list your (internal) IP networks from where browsing
- # should be allowed
- acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
- acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
- acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
- acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
- acl localnet src 172.0.0.0/8
- acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
- acl localnet src fc00::/7 # RFC 4193 local private network range
- acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
- acl SSL_ports port 443
- acl Safe_ports port 80 # http
- acl Safe_ports port 81
- acl Safe_ports port 443 # https
- #
- # Recommended minimum Access Permission configuration:
- #
- # Deny requests to certain unsafe ports
- http_access deny !Safe_ports
- # Deny CONNECT to other than secure SSL ports
- http_access deny CONNECT !SSL_ports
- # Only allow cachemgr access from localhost
- http_access allow localhost manager
- http_access deny manager
- # This default configuration only allows localhost requests because a more
- # permissive Squid installation could introduce new attack vectors into the
- # network by proxying external TCP connections to unprotected services.
- http_access allow localhost
- # The two deny rules below are unnecessary in this default configuration
- # because they are followed by a "deny all" rule. However, they may become
- # critically important when you start allowing external requests below them.
- # Protect web applications running on the same server as Squid. They often
- # assume that only local users can access them at "localhost" ports.
- http_access deny to_localhost
- # Protect cloud servers that provide local users with sensitive info about
- # their server via certain well-known link-local (a.k.a. APIPA) addresses.
- http_access deny to_linklocal
- #
- # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
- #
- include /etc/squid/conf.d/*.conf
- # For example, to allow access from your local networks, you may uncomment the
- # following rule (and/or add rules that match your definition of "local"):
- # http_access allow localnet
- # And finally deny all other access to this proxy
- http_access deny all
- # Squid normally listens to port 3128
- http_port 3128
- # Leave coredumps in the first cache dir
- coredump_dir /var/spool/squid
- #
- # Add any of your own refresh_pattern entries above these.
- #
- refresh_pattern ^ftp: 1440 20% 10080
- refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
- refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
- refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
- refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
- refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
- # example pattern for deb packages
- #refresh_pattern (\.deb|\.udeb)$ 129600 100% 129600
- refresh_pattern . 0 20% 4320
|
