Re: squid acl entries

From: Lionel Bouton <>
Date: Wed, 05 Nov 1997 20:03:36 +0100

Miles Lott wrote:

> I am having problems excluding by IP address. This is
> to limit local usage only, so all users are on the same
> subnet. I enter the following:
> acl all src
> acl na1 src
> acl na2 src
> http_access deny na1
> http_access deny na2
> http_access allow all
> ...which somehow disables all in the range "all" and otherwise.
> If I leave out the na1 & na2 lines, the entire net is allowed
> based on src address. Do I have the syntax wrong?

I'm new to squid but I didn't saw many replies so I'll try to help.

I don't think you have to use a netmask when you want to make an access list
based on a range of ip-adresses.

Try instead:

   acl all src
   acl na1 src
   acl na2 src

I think that you want to allow only a subnet to access your proxy.
Why don't simply use:

acl all src # here you use a network number, the whole
                            # Internet one and the corresponding netmask.
acl subnet src # here the ip-adress range of

                            # your allowed users.

http_access allow subnet
http_access deny all

(remember access-rules are tried sequentially so the first acl which match
an access is used to determine if squid allow/deny the request -> access
granted only for the subnet)

It should explain why with your current config the entire net is disabled
too :
na1 refers to all adresses matching
and using the netmask you can guess every adress in the range
- matches the na1 acl.
Your first line is: http_access deny na1 -> you deny access to the whole
In fact in your config na1,na2 and all refer to the same net because of the
netmask's use.

I have a doubt on your subnet range:
Isn't it 192->223?
Indeed 193 = 11000001 and 224 11100000
It should be 11000000 and 11011111 in order to have all adresses
coresponding to 110?????. then you could use: for the network adress and for the
corresponding netmask
(224 = 11100000)

If doing so, you could use a different acl for your subnet, here using a

acl subnet src

Hope it helps,


Lionel Bouton
French student @ Supelec
E-mail :
Snail-mail : 4, place Edouard Branly
              57070 Metz (France)
Received on Wed Nov 05 1997 - 11:23:14 MST

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:37:27 MST