Re: when 'cache_peer_access <cache> deny all_dst' is not enough

Dancer wrote:

> third-party interfacing requires me to do a DNS lookup in a redirector.
> Yes, I've implemented my own caches....but I would love to be able to
> force squid to perform the lookup earlier in the lifetime of the
> request, so that it will be in the DNS cache (positively or negatively)
> when we get to needing it in the redirector.

Use http_access which does block for lookups and is used prior to
redirection.

Insert the following somewhere before where your requests are being
allowed:

acl all_destinations dst 0.0.0.0/0
acl none 0.0.0.0/32
http_access allow all_destinations none

The intent of the above is to have ACL processing use destination IP
withour actually doing anything with it. No clients ever matches the
none acl, so the http_access line is never true.

--
Henrik Nordstrom
Squid hacker