Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to deny all URL beginning by iso, in squid 3.2.3 So, I've put in squid.conf:

  acl torrent_sites dstdom_regex -i iso
  acl music_sites dstdom_regex -i music

and my http control like:

  http_access allow localhost
  http_access allow localnetp1
  http_access deny torrent_sites localnetp1
  http_access deny music_sites
  http_access deny ftp_request
  http_access deny localnetp1 norm_conn
  http_access deny all

but i can enter to the page, why?

share|improve this question
up vote 1 down vote accepted

Rules are processed in order. Once an http_access allow has been reached processing stops and the connection is permitted. What is the localnetp1 ACL doing? Does that happen to be a src acl with a list of all your IP addresses perhaps?

Your rules generally be ordered like thisgo

# all the specific denies first
http_access deny asdf
http_access deny sdfa
# any explicit allows
http_access allow dfas
# deny everything else
http_access deny all
share|improve this answer
yes, localnetp1 is a src with a list o ip addresses. – BanKtsu Dec 4 '12 at 18:07
Right, so my answer applies, and you should try re-ordering your ACLs. – Zoredache Dec 4 '12 at 18:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.