squid acls

squid acls

[Luca Ferrari]

Hi,
I'd like to know if it is possible to enforce a squid acl to check, at the 
same time, the couple IP and MAC address; I mean to verify that a requests 
come from a couple ip and mac specified. Anybody had already done it?

Luca
-- 
Luca Ferrari,
fluca1978@infinito.it

Re: squid acls

[Richard Nairn]

Hi Luca

It can be done. The FAQ says so...

The access control has the "arp" keyword. According the FAQ you have to  
have compiled squid with the --enable-arp-acl switch to enable this.

I think you would use it such:

acl USERARP arp arp1 arp2
acl USERSRC src src1 src2
http_access allow USERARP USERSRC

Since ACL entries are or'd and ACCESS is AND'd.

On Wed, 20 Apr 2005 10:43:53 -0600, Luca Ferrari <fluca1978@infinito.it>  
wrote:

> Hi,
> I'd like to know if it is possible to enforce a squid acl to check, at  
> the
> same time, the couple IP and MAC address; I mean to verify that a  
> requests
> come from a couple ip and mac specified. Anybody had already done it?
>
> Luca



-- 
  |       Richard Nairn          Specializing in Linux
  |     Nairn Consulting         Web / Database Solutions
  |        Calgary, AB
  | Richard@NairnConsulting.ca

Re: squid acls

[Luca Ferrari]

On Wednesday 20 April 2005 21:25 Richard Nairn's cat walking on the keyboard  
wrote:

> Hi Luca
>
> It can be done. The FAQ says so...
>
> The access control has the "arp" keyword. According the FAQ you have to
> have compiled squid with the --enable-arp-acl switch to enable this.
>
> I think you would use it such:
>
> acl USERARP arp arp1 arp2
> acl USERSRC src src1 src2
> http_access allow USERARP USERSRC
>
> Since ACL entries are or'd and ACCESS is AND'd.
>

I already do this, but this implies that a valid ip and mac in the two acls 
can connect, while I need to check if a couple ip and mac (not any 
combination of them) can connect.

Luca

-- 
Luca Ferrari,
fluca1978@infinito.it

Re: squid acls

[Adrian C.]

I think it's best for you to use INPUT chain for such filtering. Just 
match port number for squid.

--Adrian.

Luca Ferrari wrote:

>On Wednesday 20 April 2005 21:25 Richard Nairn's cat walking on the keyboard  
>wrote:
>
>  
>
>>Hi Luca
>>
>>It can be done. The FAQ says so...
>>
>>The access control has the "arp" keyword. According the FAQ you have to
>>have compiled squid with the --enable-arp-acl switch to enable this.
>>
>>I think you would use it such:
>>
>>acl USERARP arp arp1 arp2
>>acl USERSRC src src1 src2
>>http_access allow USERARP USERSRC
>>
>>Since ACL entries are or'd and ACCESS is AND'd.
>>
>>    
>>
>
>I already do this, but this implies that a valid ip and mac in the two acls 
>can connect, while I need to check if a couple ip and mac (not any 
>combination of them) can connect.
>
>Luca
>
>  
>