1

I know, that I can turn off X-Forwarded-For header in Squid completley by using directive "forwarded_for off" or "forwarded_for delete" globally. I would like to be able to disable that header only for specific ACLs, so I can disable this header only for given URLs and have it enabled for others. Is there any way to do that?

2 Answers 2

0

You can create an ACL based on an external file to store URLs (easier to manage in my opinion) :

acl NoXForwardedFor dstdomain "/etc/squid/NoXForwardedFor.txt"

The content of /etc/squid/NoXForwardedFor.txt would be something like this :

.serverfault.com
.superuser.com
.stackoverflow.com

Then remove X-Forwarded-From from the header for the given ACL :

request_header_access X-Forwarded-For deny NoXForwardedFor

Note : You can use the dst directive instead of the dstdomain directive. But it requires URL host's IP address, so make sure the target domain has fixed ip address(es).

Maybe some useful links for deeper understanding :

5
  • Thank you very much, but from what I know - maybe I am wrong - this is not the same thing, as removing the X-Forwarded-For header completly. This just stops parsing of the value of that header to track the original location. My use case is different - I want to get rid of the header completly (remove it from the request that goes from squid to the website), but only for specific domains.
    – dotz
    Feb 6, 2014 at 8:43
  • @dotz I have edited my answer. Give it a try !
    – krisFR
    Feb 6, 2014 at 9:06
  • Thanks a million, the second approach works. Please edit your reply so it includes only the second approach (as the first one simply does not do what I wanted) and I'll accept it as an answer. THANKS!
    – dotz
    Feb 7, 2014 at 7:02
  • @dotz You are welcome, glad it works ! Ok, edited.
    – krisFR
    Feb 7, 2014 at 8:15
  • Thank you for your assistance and a great contribution to serverfault.
    – dotz
    Feb 7, 2014 at 11:39
-1

I tried the same and the correct syntax is

acl NoXForwardedFor dst "/usr/pbi/squid-amd64/etc/squid/NoXForwardedFor.txt"

request_header_access X-Forwarded-For deny NoXForwardedFor

where NoXForwardedFor.txt contains domain names.

1
  • This doesn't seem to add anything compared to the accepted answer.
    – Kenster
    Jun 13, 2014 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .