Product
Pricing
arrow
Get Proxies
arrow
Use Cases
arrow
Locations
arrow
Help Center
arrow
Program
arrow
Email
Enterprise Service
menu
Email
Enterprise Service
Submit
Basic information
Waiting for a reply
Your form has been submitted. We'll contact you in 24 hours.
Close
Home/ Blog/ How to configure access control for Squid cache proxy using ACL?

How to configure access control for Squid cache proxy using ACL?

PYPROXY PYPROXY · May 19, 2025

Access Control Lists (ACLs) are an essential part of configuring Squid Cache Proxy to manage and control access to resources in a network. By using ACLs, system administrators can ensure that only authorized users or devices can access specific web resources while denying unauthorized access. Squid, as a widely-used proxy server, supports advanced access control mechanisms to enhance security and optimize caching. This article provides a comprehensive guide on how to use ACLs to configure access control in Squid Cache Proxy, offering a step-by-step approach that can help administrators secure their networks effectively.

1. Understanding ACLs and Squid Proxy

Before delving into configuring ACLs for Squid Cache Proxy, it is crucial to understand what ACLs are and how Squid works. An ACL in Squid is essentially a rule or filter that defines the conditions under which a request is allowed or denied. These rules can be based on several factors, such as IP addresses, source networks, protocols, time of day, and more.

Squid Proxy is a caching and forwarding HTTP proxy that provides network security, bandwidth optimization, and access control. It stores frequently accessed content in its cache, reducing the load on external servers and improving response times. Squid is commonly used for web traffic monitoring and controlling internet access within an organization.

2. Basic Concepts of ACL in Squid Proxy

In Squid, ACLs are defined using the `acl` directive, followed by the type of rule (e.g., IP address, domain, or URL pattern) and the criteria for the match. Once an ACL is defined, it can be used in the `http_access` directive to allow or deny traffic based on the conditions specified in the ACL.

For PYPROXY, an ACL can specify which users or networks are permitted to access the internet through the proxy. Similarly, administrators can create rules to restrict access to specific websites or services, enforce browsing hours, or limit traffic based on protocol types.

3. Configuring ACL for IP-based Access Control

One of the most common ways to use ACLs in Squid is to control access based on IP addresses. For instance, an administrator may want to allow only certain IP addresses or networks to access the internet via the proxy, while denying all other requests.

To implement IP-based ACLs, follow these steps:

1. Define the ACL for Allowed IPs:

In the Squid configuration file (`/etc/squid/squid.conf`), you can define an ACL for a specific IP address or range. For pyproxy:

```

acl allowed_ips src 192.168.1.0/24

```

This rule allows traffic from the `192.168.1.0/24` network to be processed by the proxy server.

2. Allow Access Based on the ACL:

To allow access for the specified IP range, you can use the `http_access` directive:

```

http_access allow allowed_ips

```

3. Deny All Other Traffic:

To deny all traffic that does not match the `allowed_ips` ACL, you can add a default deny rule:

```

http_access deny all

```

This basic configuration allows only users within the specified IP range to use the Squid proxy while denying others.

4. Using ACL to Control Access Based on URL or Domain

Besides controlling access based on IP addresses, Squid also allows access control based on URLs or domain names. This feature can be useful when administrators need to block or allow specific websites.

Here’s how you can configure ACLs to restrict access to certain websites:

1. Define the ACL for Allowed Domains:

Create an ACL to allow specific domains:

```

acl allowed_sites dstdomain .pyproxy.com .pyproxy.org

```

This rule permits access to `pyproxy.com` and `pyproxy.org`.

2. Allow Access to Allowed Domains:

Use the `http_access` directive to allow traffic to the allowed domains:

```

http_access allow allowed_sites

```

3. Deny Access to All Other Domains:

Finally, deny access to all domains except the allowed ones:

```

http_access deny all

```

This configuration blocks access to any domain not specified in the `allowed_sites` ACL, providing a basic method for domain-based access control.

5. Time-based Access Control

Sometimes, organizations may want to limit internet access during certain hours of the day. Squid supports time-based access control, allowing administrators to define rules based on the time of day or day of the week.

To set up time-based ACLs:

1. Define Time Periods Using ACL:

First, define a time-based ACL. For pyproxy, to allow access only between 9 AM and 5 PM on weekdays:

```

acl work_hours time 09:00-17:00

acl weekdays time MTWHF

```

This ACL restricts access to the specified time range on Monday through Friday.

2. Allow Access During Work Hours:

Use the `http_access` directive to allow access during the specified times:

```

http_access allow work_hours weekdays

```

3. Deny Access Outside Work Hours:

Deny access outside the defined work hours:

```

http_access deny all

```

This configuration ensures that internet access is available only during work hours.

6. Combining Multiple ACLs for Granular Control

Squid allows combining multiple ACLs to create more granular access control. For pyproxy, you might want to allow access to certain websites only for users within a specific IP range during work hours. This can be done by combining the ACLs for IP range and time.

For pyproxy:

```

acl allowed_ips src 192.168.1.0/24

acl work_hours time 09:00-17:00

acl weekdays time MTWHF

acl allowed_sites dstdomain .pyproxy.com .pyproxy.org

http_access allow allowed_ips work_hours weekdays allowed_sites

http_access deny all

```

In this case, access is granted only if the user is within the allowed IP range, is accessing the site within work hours, and is trying to visit the allowed sites.

7. Logging and Monitoring Access Control

Once the ACLs are configured, it is important to monitor the proxy server’s performance and access logs. Squid logs all access attempts, which can be invaluable for troubleshooting and ensuring compliance with the access policies.

To enable logging in Squid, configure the following directive in the Squid configuration file:

```

access_log /var/log/squid/access.log

```

By regularly reviewing the access log, administrators can identify unauthorized access attempts, misconfigurations, or performance issues.

In conclusion, using ACLs to configure access control for Squid Cache Proxy is a powerful way to secure and optimize network access. By defining rules based on IP addresses, domains, time periods, and other factors, system administrators can exercise fine-grained control over what content is accessible, to whom, and when. Proper configuration of ACLs not only enhances security but also ensures efficient use of network resources, providing a better user experience while maintaining compliance with organizational policies.

By following the steps outlined in this article, administrators can configure Squid Proxy to meet their specific access control needs effectively.

Related Posts