In squid I need to combine acl conditions in one line:
acl allowed_conn src && dstdomain intranet.loc
acl allowed_conn src && dstdomain anothersite.net

I know that I could instead define two like so:
acl allow_src src
acl allow_domain intranet.loc

And then I could do:
http_access allow allow_src allow_domain
but in this way I will need to create new http_access lines for different acl combinations. I would like to have one http_access line like so:
http_access allow allowed_conn


Unfortunately, the fixed AND/OR logic of Squid's ACL list means that you can only implement an AND condition on the access line, not on the ACL line:

You've probably noticed (and been frustrated by) the fact that you cannot combine access controls with terms like "and" or "or." These operations are already built in to the access control scheme in a fundamental way which you must understand.

All elements of an acl entry are OR'ed together.
All elements of an access entry are AND'ed together

Is there some real reason you can't do it this way?

  • essentially I want to have a file that has very specific per src ip rules. One file would make things easier to maintain: src dstdomain intranet.loc \n src dstdomain anothersite.net – Alex Nov 9 '11 at 6:30

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.