Добрый день!Я использую локальный прокси сервер для туннелирования трафика от браузера через различние openvpn каналы (в зависимости от порта).
Сейчас появилась необходимость не "палить" локальный адрес за прокси как и само использование прокси.
В связи с этим вопрос - что мне нужно поменять в squid.conf для этого? Какие строки с 'reply_header_access' раскоментить для этого?
# AUTOGENERATED LINES
http_port 3131 name=3131
acl tasty3131 myportname 3131 src 10.12.0.58
http_access allow tasty3131
tcp_outgoing_address 10.12.0.58 tasty3131
http_port 3129 name=3129
acl tasty3129 myportname 3129 src 10.200.1.7
http_access allow tasty3129
tcp_outgoing_address 10.200.1.7 tasty3129
http_port 3128 name=3128
acl tasty3128 myportname 3128 src 10.44.0.7
http_access allow tasty3128
tcp_outgoing_address 10.44.0.7 tasty3128
http_port 3130 name=3130
acl tasty3130 myportname 3130 src 10.44.0.6
http_access allow tasty3130
tcp_outgoing_address 10.44.0.6 tasty3130
# AUTOGENERATED LINES
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
# example lin deb packages
#refresh_pattern (\.deb|\.udeb)$ 129600 100% 129600
refresh_pattern . 0 20% 4320
# TAG: request_header_access
# Usage: request_header_access header_name allow|deny [!]aclname ...
#
# WARNING: Doing this VIOLATES the HTTP standard. Enabling
# this feature could make you liable for problems which it
# causes.
#
# This option replaces the old 'anonymize_headers' and the
# older 'http_anonymizer' option with something that is much
# more configurable. This new method creates a list of ACLs
# for each header, allowing you very fine-tuned header
# mangling.
#
# This option only applies to request headers, i.e., from the
# client to the server.
#
# You can only specify known headers for the header name.
# Other headers are reclassified as 'Other'. You can also
# refer to all the headers with 'All'.
#
# For example, to achieve the same behavior as the old
# 'http_anonymizer standard' option, you should use:
#
# request_header_access From deny all
# request_header_access Referer deny all
# request_header_access Server deny all
# request_header_access User-Agent deny all
# request_header_access WWW-Authenticate deny all
# request_header_access Link deny all
#
# Or, to reproduce the old 'http_anonymizer paranoid' feature
# you should use:
#
# request_header_access Allow allow all
# request_header_access Authorization allow all
# request_header_access WWW-Authenticate allow all
# request_header_access Proxy-Authorization allow all
# request_header_access Proxy-Authenticate allow all
# request_header_access Cache-Control allow all
# request_header_access Content-Encoding allow all
# request_header_access Content-Length allow all
# request_header_access Content-Type allow all
# request_header_access Date allow all
# request_header_access Expires allow all
# request_header_access Host allow all
# request_header_access If-Modified-Since allow all
# request_header_access Last-Modified allow all
# request_header_access Location allow all
# request_header_access Pragma allow all
# request_header_access Accept allow all
# request_header_access Accept-Charset allow all
# request_header_access Accept-Encoding allow all
# request_header_access Accept-Language allow all
# request_header_access Content-Language allow all
# request_header_access Mime-Version allow all
# request_header_access Retry-After allow all
# request_header_access Title allow all
# request_header_access Connection allow all
# request_header_access All deny all
#
# although many of those are HTTP reply headers, and so should be
# controlled with the reply_header_access directive.
#
# By default, all headers are allowed (no anonymizing is
# performed).
#Default:
# none
# TAG: reply_header_access
# Usage: reply_header_access header_name allow|deny [!]aclname ...
#
# WARNING: Doing this VIOLATES the HTTP standard. Enabling
# this feature could make you liable for problems which it
# causes.
#
# This option only applies to reply headers, i.e., from the
# server to the client.
#
# This is the same as request_header_access, but in the other
# direction.
#
# This option replaces the old 'anonymize_headers' and the
# older 'http_anonymizer' option with something that is much
# more configurable. This new method creates a list of ACLs
# for each header, allowing you very fine-tuned header
# mangling.
#
# You can only specify known headers for the header name.
# Other headers are reclassified as 'Other'. You can also
# refer to all the headers with 'All'.
#
# For example, to achieve the same behavior as the old
# 'http_anonymizer standard' option, you should use:
#
# reply_header_access From deny all
# reply_header_access Referer deny all
# reply_header_access Server deny all
# reply_header_access User-Agent deny all
# reply_header_access WWW-Authenticate deny all
# reply_header_access Link deny all
#
# Or, to reproduce the old 'http_anonymizer paranoid' feature
# you should use:
#
# reply_header_access Allow allow all
# reply_header_access Authorization allow all
# reply_header_access WWW-Authenticate allow all
# reply_header_access Proxy-Authorization allow all
# reply_header_access Proxy-Authenticate allow all
# reply_header_access Cache-Control allow all
# reply_header_access Content-Encoding allow all
# reply_header_access Content-Length allow all
# reply_header_access Content-Type allow all
# reply_header_access Date allow all
# reply_header_access Expires allow all
# reply_header_access Host allow all
# reply_header_access If-Modified-Since allow all
# reply_header_access Last-Modified allow all
# reply_header_access Location allow all
# reply_header_access Pragma allow all
# reply_header_access Accept allow all
# reply_header_access Accept-Charset allow all
# reply_header_access Accept-Encoding allow all
# reply_header_access Accept-Language allow all
# reply_header_access Content-Language allow all
# reply_header_access Mime-Version allow all
# reply_header_access Retry-After allow all
# reply_header_access Title allow all
# reply_header_access Connection allow all
# reply_header_access All deny all
#
# although the HTTP request headers won't be usefully controlled
# by this directive -- see request_header_access for details.
#
# By default, all headers are allowed (no anonymizing is
# performed).
#Default:
# none