4

When I connect to freenode, I am getting the following error.

You are banned from this server- Your host is an open proxy (HTTP GET (3128)).                              
Email proxyscan@freenode.net when corrected.        
karthick [~karthick@117.206.87.12] has quit [K-Lined]            
ERROR Closing Link: 117.206.87.12 (K-Lined)                
Irssi: Connection lost to irc.freenode.net

I am using squid in my standalone system to block few websites and downloads.Here is my squid configuration.

acl manager proto cache_object              
acl localhost src 127.0.0.1/32                       
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32                     
acl SSL_ports port 443                             
acl Safe_ports port 80  # http                  
acl Safe_ports port 21  # ftp              
acl Safe_ports port 443  # https                 
acl Safe_ports port 70  # gopher                 
acl Safe_ports port 210  # wais                 
acl Safe_ports port 1025-65535 # unregistered ports                    
acl Safe_ports port 280  # http-mgmt                
acl Safe_ports port 488  # gss-http                  
acl Safe_ports port 591  # filemaker                     
acl Safe_ports port 777  # multiling http                    
acl CONNECT method CONNECT                     
acl badURL url_regex -i movie                  
acl badURL url_regex -i movies                     
acl badURL url_regex -i chat             
acl whitelist dstdomain "/etc/squid3/whitelist"                 
acl bad URL url_regex "/etc/squid3/websites"                   
acl badURL url_regex "/etc/squid3/blockdownload"                     
acl badURL url_regex "/etc/squid3/blockedsites"               
http_access allow manager localhost                     
http_access deny !Safe_ports                    
http_access deny CONNECT !SSL_ports                   
http_access allow whitelist               
http_access deny badURL                  
icp_access deny all              
htcp_access deny all               
http_port 3128              
hierarchy_stoplist cgi-bin ?             
access_log /var/log/squid3/access.log squid                 
refresh_pattern ^ftp:  1440 20% 10080                
refresh_pattern ^gopher: 1440 0% 1440                  
refresh_pattern (cgi-bin|\?) 0 0% 0               
refresh_pattern .  0 20% 4320             
icp_port 3130

Some said enabling squid authentication will solve my problem. But I'm not sure on doing that. Any suggestions??

MatejMecka
  • 103
karthick87
  • 81,947

1 Answers1

5

At the moment, squid is listening on all of your network interfaces. If you change it to only listen on your internal network, then nobody on the internet will be able to connect. If you are only using it on a single machine, this is easy. Change the line

http_port 3128

to

http_port 127.0.0.1:3128

This means squid will only listen on your localhost interface.

If you have other machines accessing the proxy with one network card for the internet and one for the internal network, you'd repeat the above change but substitute your internal network IP address for 127.0.0.1.

This is documented at http://www.squid-cache.org/Doc/config/http_port/ - see the bottom paragraph.

It'd probably be worth checking that your firewall is running and configured as well - 3128 doesn't need to be visible to the outside world.

Roger Light
  • 1,384