Blocking All websites except 2 websites for some users

[Stat_jack]

Hello Everyone
How is it going?
I'm trying to use SquidGuard to block all websites for some of the company pcs except mail.yahoo.com and gmail.com
but I don't want to block everyone just them
can please someone give me the detailed instructions on how i can do that?
Thanks

[mer]

I can't give you detailed instructions, but the computers you want to block, are they at fixed IP addresses or do they always get the same addresses from DHCP?

[Stat_jack]

Yea They Have Fixed Ips

[mer]

A quick google for squidguard source based access

http://www.squidguard.org/Doc/extended.html#sourceIP

I have no idea how you you add that to your configuration

[chris4916]

I would personally not rely on IP, MAC or whatever like this if goal is to block some users and allow some others.
As trigger is "user", this means account thus proxy authentication in order to distinguish between users then apply profiling rules, either deny or allow.

[Stat_jack]

Detailed iinstructions please if possible

[chris4916]

I won't describe how to implement this using pfSense GUI as I don't use Squid as embedded pfSense package but I can at least explain what to do in Squid ;-)

1 - if you have very few impacted users, you could achieve this directly in Squid conf but I won't promote such approach which means that you will have to change your Squid conf each and every time you have some changes here. Better to rely, if possible on groups, meaning external group, e.g. in from LDAP.

2 - create the group of users with limited access

acl restricted_group external your_AD_group

3 - as  mail.yahoo.com and gmail.com will be authorized to all, you can create ACL for each.
e.g.

ACL yahoo dest mail.yahoo.com
ACL gmail destdomain gmaill.com

notice that if target was host for both, you could manage only one ACL, e.g. ACL mail dest mail.yahoo.com  sometihng.gmail.com

3 - then authorize these for destinations for all

http_access allow yahoo
http_access allow gmail
http_access deny restricted_group
http_access allow all (or better if you have it  http_access allow authorized_group)
http_access deny all

group membership obviously requires authentication therefore explicit proxy.
You will find plenty of howto and tutorials about Wiki ACL surfing internet  ;)

Does it make sense?

[chris4916]

This is an example directly in Squid.
Almost similar behaviour can be achieved using Squidguard that is also able to handle ACL, users and groups. It should perhaps be feasible using pfSense GUI, this I don't know as I'm not Squid user on pfSense  8)

logic is always pretty much the same:

• define white list covering what is allowed to all
• allow white list access
• deny group of restricted users
• authorize all others