How to block domain with transparent on Debian Squid?

http_port 3128 transparent

but I still have to set the manual proxy on the browser.

NB: I'm using Debian Wheezy with squid 2.7

  • 1
    Your question is not clear! Are you asking about blocking a specific domain or now to configure transparent proxy? – Khaled Feb 22 '17 at 14:36
  • blocking a specific domain. Do I have to set the proxy manually on the client's browser? – user401880 Feb 22 '17 at 14:39
  • @user401880, Your transparent proxy is not working. So first make sure you have a working transparent proxy. Thtat means the user doesn't need to set the proxy in browser. When this works, then you can try the domain blocking part. If the user traffic is not going through the proxy then it is useless whatever acl you put in squid. – Diamond Feb 22 '17 at 22:45
  • As pointed out by @bangal, these are two different issues. If you were looking to block a domain entirely, then I am not sure transparent mode is the best choice (to make that work for HTTPS, you would need to effectively MITM your users). I would ditch the transparent mode, configure your clients explicitly to use your proxy, and then configure squid (or use something like DansGuardian) to block the domain. If you run a DNS server, you could also create a record to redirect the domain to a specific IP (e.g. localhost, or some server you run). – iwaseatenbyagrue Mar 9 '17 at 8:43

If you want to block specific domain using squid proxy, you can use acl to define the domain to block and apply it to specific client IPs.

acl bad_dom dstdomain example.com
http_access deny bad_dom

You need to pay attention to other defined ACLs, because ACLs order does matter. So, this htt_access deny line should appear before allow everything else to some clients.

| improve this answer | |
  • okay. Do I have to set the proxy configuration on the browser? – user401880 Feb 22 '17 at 14:45
  • @user401880: No, if you have proxy working transparently. – Khaled Feb 22 '17 at 14:46
  • not working even when I have already made the proxy work transparently with http_port 3128 transparent – user401880 Feb 22 '17 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.