Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wanted to restrict the download limit in the Squid proxy so I added the following two lines in the squid.conf.

acl officelan dst 192.168.1.0/24

reply_body_max_size 30000000 deny officelan

Now, I want to allow some/particular IP to download more than 30MB limitation so I included another acl as alowedip and included the following lines but this is not working.

acl allowedip dst 192.168.1.81

reply_body_max_size 0 allow allowedip

How do I allow acl allowedip to have unlimited download ?

Warm Regards

Supratik

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Squid checks for matches in the order they are written in the conf file from top to bottom.

Make sure that the

reply_body_max_size 0 allow allowedip

is before the

reply_body_max_size 30000000 allow officelan

If you're using a new (>v3) version of squid then there is no need for the allow and deny e.g.

reply_body_max_size 0 allowedip
reply_body_max_size 30000000 officelan

EDIT

Tested using centos 5.5 and squid 2.6.STABLE21 2 machines on the same network as the proxy. Here's the relevant entries from my squid.conf

acl t1 src 192.168.254.200
acl t2 src 192.168.254.0/24

http_access allow t1
http_access allow t2

reply_body_max_size 0 allow t1
reply_body_max_size 100000 allow t2

This works as expected - reducing the byte size in the second statement (and restarting squid) eventually causes squid to refuse the transfer.

share|improve this answer
    
My Squid version is squid-2.6.STABLE21-6.el5 Running under CentOS release 5.4 I used the following order but not luck. reply_body_max_size 0 allow allowedip reply_body_max_size 30000000 deny officelan –  Supratik Nov 24 '10 at 11:34
    
Then use your original statements and ensure the allow is before the deny. –  Iain Nov 24 '10 at 11:37
    
I just checked the documentation properly and the deny should be allow too. –  Iain Nov 24 '10 at 11:54
    
I tried as you suggested, now my configuration looks the following acl allowedip dst 192.168.1.81 acl officelan dst 192.168.1.0/24 reply_body_max_size 0 allow allowedip reply_body_max_size 30000000 allow officelan but still able to download a large file more than 30MB from all IP's. Only one statement is working at a time. Any idea ? –  Supratik Nov 24 '10 at 12:07
    
I've just had an opportunity to test this and it works as expected. See the edit to my answer for the statements I used. –  Iain Nov 24 '10 at 19:07
add comment

Just re-order your reply_body_max_size lines. Squid check them in order.

This is from squid config file:

When the reply headers are received,
the reply_body_max_size lines are processed, and the first line with
a result of "allow" is used as the maximum body size for this reply.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.