Filtering home Internet access with Squid
Client Maintenance
The next step is to modify the ACL
(Access Control List) settings in squid.conf. To assign different filter rules to different users – for example, stricter rules for children – you first need to tell Squid what criteria to apply to incoming requests.
Listing 2 adds client IP addresses for Mom (Marion), Dad (Archie), a son (Simon), and a daughter (Tanja). At the same time, the listing tells Squid to accept requests from the local network.
Listing 2
ACL Settings
# Individual client definitions acl marion src 192.168.1.1/32 acl archie src 192.168.1.2/32 acl simon src 192.168.1.3/32 acl tanja src 192.168.1.4/32 01 # Allow Squid to accept requests from the local network 02 acl localhost src 192.168.1.0/24 03 acl to_localhost dst 192.168.1.0/24
Time-Based and Manual Blocks
In my experience, it is often hard to keep the kids off the computer, especially if they have Internet access. Squid lets you block online access at certain times of the day. Listing 3 gives an example that defines a time slot for older kids between 1:00pm and 9:00pm Monday through Friday, while restricting access for the younger kids to 1:00pm and 7:00pm.
Listing 3
Time Slots
acl big_kids time MTWHF 13:00-21:00 acl small_kids time MTWHF 13:00-19:00 http_access deny simon ! big_kids http_access deny tanja ! small_kids
Because Simon is older, he is allowed to surf later than his little sister, Tanja; this is set in the http_access lines, which are read as follows: "The client called Simon is not allowed to surf the Internet, except at the times defined in the ACL big_kids." Both kids are allowed unrestricted Internet access on weekends, and no restrictions apply to the parents.
Sometimes it makes sense to completely block Internet access for a client. Just add the contents of Listing 4 to the configuration file. The /usr/share/squid/blocked_clients file itself only contains the IP addresses and netmasks of the clients you want to block (Listing 5).
Listing 4
Blocking Access
acl blocked_clients src "/usr/share/squid/blocked_clients" http_access deny blocked_clients
Listing 5
blocked_clients
192.168.1.3/32 192.168.1.4/32
A simple shell command is all it takes to add clients to the list. The command
echo 192.168.1.3/32 >> && /usr/share/squid/blocked_clients && /etc/init.d/squid reload
puts Simon on the block list. Typing
sed /^192.168.1.3\\/32$/d -i && /usr/share/squid/blocked_clients && /etc/init.d/squid reload
removes the entry.
Ads and Cookies
In addition to simple website blocking, Squid offers more advanced features: In combination with the free Privoxy [3] tool, it will filter banners and similar elements while you surf the web. To enable Privoxy, just add the lines from Listing 6.
Listing 6
Enable Privoxy
« Previous 1 2 3 4 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.
-
Linux Usage Increases in Two Key Areas
If market share is your thing, you'll be happy to know that Linux is on the rise in two areas that, if they keep climbing, could have serious meaning for Linux's future.
-
Vulnerability Discovered in xz Libraries
An urgent alert for Fedora 40 has been posted and users should pay attention.
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs