# Logging
cache_log /var/log/squid/cache.log
# Memory and storage limits
# Basically, 16 MB RAM and 100 MB disk space
cache_mem 24 MB
cache_dir ufs /var/cache/squid 100 16 256
# Continue downloading even if user aborts,
# if there is less than 90% left
quick_abort_pct 90
# What port to listen for requests on
http_port 8080
# Needed for transparant proxy
# (also requeries some iptables rules)
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
# Some acl's from one of the examples
acl manager proto cache_object
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
# Networks
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255
acl wlan src 10.1.0.0/255.255.0.0
acl lan src 192.168.1.0/255.255.255.0
acl vpn src 10.3.0.0/255.255.0.0
acl skole src 194.255.108.253/32
# Black and whitelists
acl blacklist_ads url_regex -i "/etc/squid/blacklist_ads.txt"
acl whitelist url_regex -i "/etc/squid/whitelist.txt"
# Timecontrolled access for kids
#acl bedtime time SMTWHFA 23:30-23:59
#acl bedtime time SMTWHFA 00:00-06:00
#acl kids src 10.2.0.32
# With customized error page, that kindly tells them to go to bed
#deny_info ERR_BEDTIME bedtime
#http_access deny kids bedtime
# Only allow cachemgr access from localhost
#http_access allow manager localhost
#http_access deny manager
# Only allow purge requests from localhost
#http_access allow purge localhost
#http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
# Ads are blocked with a non-intrusive error page
deny_info ERR_ADVERTISEMENT blacklist_ads
http_access deny !whitelist blacklist_ads
# Network based access
http_access allow localhost
http_access deny wlan
http_access allow lan
http_access deny vpn
http_access allow skole
# Deny anything else
http_access deny all
# FTP proxy stuff
ftp_user proxy@xyborx.dk
# Various settings
visible_hostname Ulriklykke.dk
forwarded_for off
cache_mgr proxy@ulriklykke.dk
coredump_dir /var/cache/squid
# Anonymizer (for some reason this breaks access to gmail)
#header_access Allow allow all
#header_access Authorization allow all
#header_access WWW-Authenticate allow all
#header_access Cache-Control allow all
#header_access Content-Encoding allow all
#header_access Content-Length allow all
#header_access Content-Type allow all
#header_access Date allow all
#header_access Expires allow all
#header_access Host allow all
#header_access If-Modified-Since allow all
#header_access Last-Modified allow all
#header_access Location allow all
#header_access Pragma allow all
#header_access Accept allow all
#header_access Accept-Charset allow all
#header_access Accept-Encoding allow all
#header_access Accept-Language allow all
#header_access Content-Language allow all
#header_access Mime-Version allow all
#header_access Retry-After allow all
#header_access Title allow all
#header_access Connection allow all
#header_access Proxy-Connection allow all
#header_access Cookie allow all
#header_access User-Agent allow all
#header_access Referer allow all
#header_access All deny all
#Anonymizer (another approach, banning specific headers and allowing all others)
header_access X-Forwarded-For deny all
header_access Proxy-Connection deny all
header_access Via deny all
header_access All allow all