[squid-users] Config Analysis for VPN Access

Hi Squid Users / Admins,

Below is my squid.conf of 3.1.23 running on openSuSe 11.4 32-bit using
transparent mode and Shoreline Firewall.
The server controls five networks, four of them through VPNs.

Problems...
- Failure to access Internet on VPNs unless proxy settings are added
- Failure to reach DNS and HQ public IP Address
- Some "admin" IP addresses are randomly (time) blocked from accessing
the Internet

Where could we be going wrong? How can the set-up be improved?

## Start squid.conf

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

alnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

acl usul src 10.40.1.0/24 10.40.2.0/24 10.40.3.0/24 10.40.4.0/24 10.40.5.0/24

acl noaccess src "/etc/squid/noaccess.txt"
acl admin src "/etc/squid/admin.txt"
acl a37 src "/etc/squid/one37.txt"
acl srvips src "/etc/squid/srvips.txt"
acl mgrs src "/etc/squid/mgrs.txt"
acl clerix src "/etc/squid/clerix.txt"

acl NoGenNet time MTWHFA 08:00-12:59
acl NoGenNet time MTWHFA 13:59-16:59
acl NoGenNet time S 07:00-12:59
acl NoGenNet time SMTWHFA 19:00-23:59
acl NoGenNet time SMTWHFA 00:00-06:59

acl YouTube time SMTWHFA 19:00-23:59
acl YouTube time SMTWHFA 00:00-07:59

acl nommq req_mime_type -i "/etc/squid/nommq.txt"

acl donot urlpath_regex -i "/etc/squid/donot.txt"
acl srvurls dstdomain -i "/etc/squid/srvurls.txt"
acl fewurls dstdomain -i "/etc/squid/fewww.txt"
acl one37 dstdomain -i "/etc/squid/url37.txt"
acl malice dstdomain -i "/etc/squid/malware.acl"
acl porn dstdomain -i "/etc/squid/xxx.acl"
acl ads dstdomain -i "/etc/squid/ads.acl"
acl tubeyou dstdomain -i "/etc/squid/utube.txt"

http_access allow manager localhost

http_access allow srvurls all
http_access allow fewurls all
http_access allow admin mgrs all

http_access allow one37 a37

http_access deny tubeyou !YouTube

http_access deny malice all
http_access deny porn all
http_access deny ads all

http_access deny noaccess
http_access deny srvips !srvurls all

http_access deny NoGenNet clerix all

http_access deny donot !admin
http_access deny nommq !admin !mgrs
http_access allow usul all

http_access deny manager noaccess

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

http_access deny to_localhost

http_access allow localhost

http_access deny all

error_directory /usr/share/squid/errors/en

icp_access allow usul
icp_access deny all

htcp_access allow usul
htcp_access deny all

http_port 3128 intercept

#http_port 80 intercept ## ?!
#http_port 8080 intercept ## ?!

#http_port all intercept ## Best each port above or this?

hierarchy_stoplist cgi-bin ?

cache_mem 400 MB

cache_dir ufs /var/cache/squid 20000 16 256

coredump_dir /var/cache/squid

access_log /var/log/squid/access.log squid

minimum_object_size 512 KB
maximum_object_size 4 MB
maximum_object_size_in_memory 6 MB

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

dns_nameservers 41.##.##.# 41.##.##.#

visible_hostname ######
icp_port 3130
cache deny YouTube tubeyou

## End squid.conf

-- 
Thank you and kind regards,
I.P. Edmonds