RE: [squid-users] dstdomain acl is not working for IP addresses- squid-STABLE10

From: Henrik Nordstrom <hno@dont-contact.us>
Date: Mon, 6 Jun 2005 00:15:08 +0200 (CEST)

On Fri, 3 Jun 2005 cgfreita@unipam.edu.br wrote:

> I am still looking for help.
> I realized that this IP number doesn't have a reverse lookup, but, in
> this case, how to solve the problem? If I use the IP the URL is
> loaded fine.

The most reliable method is to add the IP to your blacklist after you have
confirmed using the IP gives the same site.

There is no automatic means by which Squid can magically determine that
http://www.miniclip.com and http://66.165.172.181 is the same site, all it
can determine is that the two is served by the same server
(66.165.172.181).

As already mentioned Squid assumes that if the reverse lookup of an IP
returns something then this is the main use of that IP.

If you want to be strict about this and block every site on servers
hosting sites you have blacklisted then use the dst type ACL instead of
dstdomain.

acl badservers dst www.miniclip.com

will match all sites on the 66.165.172.181(www.miniclip.com) server,
including http://www.miniclip.com/ and http://66.165.172.181/ but also any
other site which may be hosted on the same server.

Regards
Henrik
Received on Sun Jun 05 2005 - 16:15:10 MDT

This archive was generated by hypermail pre-2.1.9 : Fri Jul 01 2005 - 12:00:02 MDT