Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Before I posted this question, I read several set up guides online, the squid docs, c-icap docus, and also the ICAP RFC (3507). Unfortunately, the documentation for SQUID and C-ICAP does not provide much in the way of examples when it comes to URL filtering, only when it comes to the simple set up of using ClamAv.

So, I'm trying to figure out how to set up simple URL filtering using Squid and the C-ICAP Server. Specifically, I'm starting out trying to use SquidGuard Databases (but not the Squidguard program) as a source of black lists. I have Squid set up and running (proxying) just fine, and I have C-ICAP set up and running (responding to options request) just fine. However, I have no clue why the URL filtering is not running, as I've followed the examples as closely as possible.

My squid.conf is set up as follows for ICAP:

#Icap Options
icap_enable on
icap_service svcBlocker reqmod_precache icap:// bypass=off

At the bottom of the c-icap.conf file, I have included the icap service I want to use:

# End module: ldap_module
#URL Check Services
Include srv_url_check.conf

I've set up the srv_url_check.conf file, following the c-icap documentation:

# Default:
#None set
#Example: url_check.LoadSquidGuardDB audio-video /home/dranfu/Downloads/blacklists/audio-video/

When I send an options request to C-ICAP, it works fine:

ICAP server:localhost, ip:, port:1344

    Allow 204: Yes
    Preview: 1024
    Keep alive: Yes

    ICAP/1.0 200 OK:
    Service:C-ICAP/0.2.4 server - Echo demo service
    Date:Tue, 26 Feb 2013 10:57:13 GMT
    X-Include:X-Authenticated-User, X-Authenticated-Groups

But when I send a standard web request to a site that is on the blacklist, I get a fairly empty response:

/usr/local/c-icap/bin/c-icap-client -p 8080 -req 

ICAP server:localhost, ip:, port:8080

And furthermore, I am still able to proxy to the website with no problem. So, if anyone has any experience with setting up squid with pure C-ICAP using URL filtering, it would be awesome to have any assistance or basic guide on how to get this working. The documentation is just too sparse, for me at least, to figure out what is going wrong. No doubt it's something I'm missing, though.

share|improve this question
I expected this may be hard to answer, but I'm researching, and once I figure it out...or someone informs me, I'll post back here so someone can make use of it. – user1647568 Feb 28 '13 at 14:43

There are other solutions specifically designed for ICAP web filtering present on Squid web site (, qlproxy as an example. It may be easier to set up ICAP than C-ICAP.

share|improve this answer
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Dec 19 '13 at 13:45

I also use c-ICAP for AntiVirus filtering with Squid3 And SquidClamAV, I have posted my configuration at our site.

the relevant sections are commented out, but its pretty straight forward.

    icap_enable on
    icap_send_client_ip on
    icap_send_client_username on
    icap_client_username_encode off
    icap_client_username_header X-Authenticated-User
    icap_preview_enable on
    icap_preview_size 1024
    icap_service service_req reqmod_precache bypass=1 icap://
    adaptation_access service_req allow all
    icap_service service_resp respmod_precache bypass=1 icap://
    adaptation_access service_resp allow all

However, I use squids integrated ACL support and have yet to find any need for Dansguardian or Squidgard for url filtering.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.