Filtering home Internet access with Squid
The next step is to modify the ACL
(Access Control List) settings in squid.conf. To assign different filter rules to different users – for example, stricter rules for children – you first need to tell Squid what criteria to apply to incoming requests.
Listing 2 adds client IP addresses for Mom (Marion), Dad (Archie), a son (Simon), and a daughter (Tanja). At the same time, the listing tells Squid to accept requests from the local network.
# Individual client definitions acl marion src 192.168.1.1/32 acl archie src 192.168.1.2/32 acl simon src 192.168.1.3/32 acl tanja src 192.168.1.4/32 01 # Allow Squid to accept requests from the local network 02 acl localhost src 192.168.1.0/24 03 acl to_localhost dst 192.168.1.0/24
Time-Based and Manual Blocks
In my experience, it is often hard to keep the kids off the computer, especially if they have Internet access. Squid lets you block online access at certain times of the day. Listing 3 gives an example that defines a time slot for older kids between 1:00pm and 9:00pm Monday through Friday, while restricting access for the younger kids to 1:00pm and 7:00pm.
acl big_kids time MTWHF 13:00-21:00 acl small_kids time MTWHF 13:00-19:00 http_access deny simon ! big_kids http_access deny tanja ! small_kids
Because Simon is older, he is allowed to surf later than his little sister, Tanja; this is set in the http_access lines, which are read as follows: "The client called Simon is not allowed to surf the Internet, except at the times defined in the ACL big_kids." Both kids are allowed unrestricted Internet access on weekends, and no restrictions apply to the parents.
Sometimes it makes sense to completely block Internet access for a client. Just add the contents of Listing 4 to the configuration file. The /usr/share/squid/blocked_clients file itself only contains the IP addresses and netmasks of the clients you want to block (Listing 5).
acl blocked_clients src "/usr/share/squid/blocked_clients" http_access deny blocked_clients
A simple shell command is all it takes to add clients to the list. The command
echo 192.168.1.3/32 >> && /usr/share/squid/blocked_clients && /etc/init.d/squid reload
puts Simon on the block list. Typing
sed /^192.168.1.3\\/32$/d -i && /usr/share/squid/blocked_clients && /etc/init.d/squid reload
removes the entry.
Ads and Cookies
In addition to simple website blocking, Squid offers more advanced features: In combination with the free Privoxy  tool, it will filter banners and similar elements while you surf the web. To enable Privoxy, just add the lines from Listing 6.
01 # adding Privoxy as a filter 02 cache_peer 127.0.0.1 parent 8118 7 no-query 03 never_direct allow all 04 05 # Do not route FTP requests via Privoxy 06 acl ftp proto FTP 07 always_direct allow ftp
Buy this article as PDF
Mozilla’s script blocker add-on could be putting malware sites on the whitelist.
The Internet community officially banishes the notoriously unsafe Secure Sockets Layer protocol.
Popular desktop environment continues the Gnome 2 legacy – with new support for the Gnome 3 toolkit.
The Obama White House has issued a memorandum telling all US government agencies they must use HTTPS for all websites and web communication.
New program will dial up security for the Firefox browser.
Red Hat's community distro embraces the cloud.
New partnership will bring more and better CS training to US schools
Criminals offer online help over Tor network
Sophisticated malware is still present on Joomla and WordPress sites around the world.
Future versions of Ubuntu's code service will support the popular Git version control system used with Linux and other open source projects.