Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to restrict the download limit in the Squid proxy so I added the following two lines in the squid.conf.

acl officelan dst

reply_body_max_size 30000000 deny officelan

Now, I want to allow some/particular IP to download more than 30MB limitation so I included another acl as alowedip and included the following lines but this is not working.

acl allowedip dst

reply_body_max_size 0 allow allowedip

How do I allow acl allowedip to have unlimited download ?

Warm Regards


share|improve this question
up vote 3 down vote accepted

Squid checks for matches in the order they are written in the conf file from top to bottom.

Make sure that the

reply_body_max_size 0 allow allowedip

is before the

reply_body_max_size 30000000 allow officelan

If you're using a new (>v3) version of squid then there is no need for the allow and deny e.g.

reply_body_max_size 0 allowedip
reply_body_max_size 30000000 officelan


Tested using centos 5.5 and squid 2.6.STABLE21 2 machines on the same network as the proxy. Here's the relevant entries from my squid.conf

acl t1 src
acl t2 src

http_access allow t1
http_access allow t2

reply_body_max_size 0 allow t1
reply_body_max_size 100000 allow t2

This works as expected - reducing the byte size in the second statement (and restarting squid) eventually causes squid to refuse the transfer.

share|improve this answer
My Squid version is squid-2.6.STABLE21-6.el5 Running under CentOS release 5.4 I used the following order but not luck. reply_body_max_size 0 allow allowedip reply_body_max_size 30000000 deny officelan – Supratik Nov 24 '10 at 11:34
Then use your original statements and ensure the allow is before the deny. – Iain Nov 24 '10 at 11:37
I just checked the documentation properly and the deny should be allow too. – Iain Nov 24 '10 at 11:54
I tried as you suggested, now my configuration looks the following acl allowedip dst acl officelan dst reply_body_max_size 0 allow allowedip reply_body_max_size 30000000 allow officelan but still able to download a large file more than 30MB from all IP's. Only one statement is working at a time. Any idea ? – Supratik Nov 24 '10 at 12:07
I've just had an opportunity to test this and it works as expected. See the edit to my answer for the statements I used. – Iain Nov 24 '10 at 19:07

Just re-order your reply_body_max_size lines. Squid check them in order.

This is from squid config file:

When the reply headers are received,
the reply_body_max_size lines are processed, and the first line with
a result of "allow" is used as the maximum body size for this reply.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.