# Squid-cache 2.6.x
# Testeado en FreeBSD 6.2
# Ultimo cambio (dd-mm-aaaa) 22-10-2007
# Squid FAQ http://wiki.squid-cache.org/SquidFaq
# Opciones de configuracion:
# Dentro del port /usr/ports/www/squid/
# haga un make config y active las opciones 
#
# [X] SQUID_DELAY_POOLS
# [X] SQUID_SSL
# [X] SQUID_WCCP
# [X] SQUID_IDENT
# [X] SQUID_ARP_ACL
# [X] SQUID_KQUEUE
#
# luego guarde e instale con un make install clean


# NETWORK OPTIONS
# -----------------------------------------------------------------------------
# Squid normally listens to port 3128
#http_port 3128
# Opcion para Proxy Transparente
http_port 3128 transparent


# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY

# Apache mod_gzip and mod_deflate known to be broken so don't trust
# Apache to signal ETag correctly on such responses
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache


# OPTIONS WHICH AFFECT THE CACHE SIZE
# -----------------------------------------------------------------------------
#Default:
cache_mem 8 MB

#Default:
maximum_object_size 4096 KB


# LOGFILE PATHNAMES AND CACHE DIRECTORIES
# -----------------------------------------------------------------------------
#Default:
# cache_dir ufs /usr/local/squid/cache 100 16 256
cache_dir ufs /usr/local/squid/cache 4000 16 256
#  To log the request via syslog specify a filepath of "syslog"
access_log /usr/local/squid/logs/access.log squid

#Default:
cache_log /usr/local/squid/logs/cache.log

#  TAG: mime_table
#	Pathname to Squid's MIME table. You shouldn't need to change
#	this, but the default file contains examples and formatting
#	information if you do.
#
#Default:
#mime_table /usr/local/etc/squid/mime.conf


# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------
#
# NOTA:
# Solo se puede hacer redireccion a un solo programa (squidGuard o squidclam)
#
# Opcion para enlazar Squid-cache + squidGuard
# Archivo de configuracion en /usr/local/etc/squid/squidGuard.conf
redirect_program  /usr/local/bin/squidGuard
#
# Opcion para enlazar Squid-cache + ClamAV mediante squidclam
# Archivo de configuracion en /etc/squidclam.conf
#redirect_program /usr/local/bin/squidclam


# OPTIONS FOR TUNING THE CACHE
# -----------------------------------------------------------------------------
#Suggested default:
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern .		0	20%	4320


# TIMEOUTS
# -----------------------------------------------------------------------------


# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443		# https
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

####################################################################################################

# Declaro mis redes
acl RedclaseC src 192.168.1.0/24

# MSN MESSENGER INICIO
# MAC Address de los que pueden usar MSN Messenger
#                      Carlos D          Jaime S
acl MSN_Permitidos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51
acl msn_url url_regex -i gateway.dll
acl msnmessenger req_mime_type -i ^application/x-msn-messenger$
acl msn_port port 1863
acl msn_method method POST
acl MSN_Messenger browser ^Mozilla.compatible;.MSN Messenger.
#
http_access allow msnmessenger MSN_Permitidos
http_access deny msnmessenger
http_access deny msn_method msn_url
http_access deny msn_port
http_access deny CONNECT msn_port
http_access deny MSN_Messenger
#
# MSN MESSENGER FIN

# Yahoo Messenger Inicio
# MAC Address de los que pueden usar Yahoo! Messenger
#                                  Carlos D
acl Yahoo_Messenger_Permitidos arp 00:1B:78:81:14:CC
acl yahoo url_regex -i http.pager.yahoo.com
acl yahoo url_regex -i http.msg.yahoo.com
acl yahoo url_regex -i messenger.yahoo.com
#
http_access allow yahoo Yahoo_Messenger_Permitidos
http_access deny yahoo
#
# Yahoo Messenger Fin

# Google Talk (Gtalk) Inicio
# Bloquear el chat integrado en Gmail sin bloquear el correo
#acl gtalk url_regex -i mail.google.com/mail/channel/bind
#http_access deny gtalk
# Google Talk (Gtalk) Fin

################### YouTube Edit (1/2) #############
# MAC Address de los que pueden ver video en youtube
#                          Gallo             Alejo
acl youtube_permitidos arp 00:14:51:64:D1:E3 00:0A:95:A8:24:94
acl youtube url_regex youtube.com/get_video\?video_id
http_access allow youtube youtube_permitidos
http_access deny youtube
################### End YouTube Edit (1/2) #############
#
################### YouTube Edit (2/2) #############
# EDIT THIS ---> this is where your replacement video lives
deny_info http://alpha.telemedellin.tv/video/Transformer.flv youtube
################### End YouTube Edit (2/2) #############

# Skype Inicio
#
# UDP source port 1247 is the initial control channel.
# Once the connection is established, the rest of the
# communications is done in TCP over non-default source ports with ranges
# sweeping from 2940-3000.
#
# Your acl definitions
#acl numeric_IPs urlpath_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
#acl connect method CONNECT
# Apply your acls
#http_access deny connect numeric_IPs all
#
# Skype Fin

# BLOQUEO INTERNET EXPLORER INICIO
#
# (User-Agent strings):
# Test: http://www.clavister.com/support/kb/10026/httprequestinfo/
# Listado http://www.useragentstring.com/pages/Internet%20Explorer/
#
# Las MAC Address de los que pueden usar IE sin restricciones
#                 Carlos Duque      Jaime S
acl ieadictos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 
#
# Otros cacharros que se identifican como IE
# Jaime S PDA
acl pda arp 00:0B:6C:51:F2:A6
#
# Algunas paginas web problematicas que solo funcionan con IE
acl soloie url_regex -i https://occired.bancodeoccidente.com.co
acl soloie url_regex -i http://www.icfesinteractivo.gov.co/
acl soloie url_regex -i http://www.enlaceoperativo.com
acl soloie url_regex -i http://gestion.suaporte.com.co/
acl soloie url_regex -i http://www.bancolombia.com
acl soloie url_regex -i http://www.grupobancolombia.com
acl soloie url_regex -i http://www.bancodeoccidente.com.co
acl soloie url_regex -i http://www.grupoaval.com
acl soloie url_regex -i http://www.fiduciariabancolombia.com
acl soloie url_regex -i http://www.bbva.com.co
acl soloie url_regex -i http://www.bancosantander.com.co
acl soloie url_regex -i http://www.banrep.gov.co
acl soloie url_regex -i http://www.bancodebogota.com.co
acl soloie url_regex -i http://www.colmena.com.co
acl soloie url_regex -i http://www.colpatria.com.co
acl soloie url_regex -i http://www.megabanco.com.co
acl soloie url_regex -i http://www.acim.com
acl soloie url_regex -i http://www.contratos.gov.co
acl soloie url_regex -i http://www.cnsc.gov.co
acl soloie url_regex -i http://www.pdfonline.com/
acl soloie url_regex -i http://www.comfama.com
acl soloie url_regex -i http://windowsmedia.com
#
# La de macromedia para el Flash Player
acl flashplayer dstdomain .macromedia.com
#
# Permitimos descargar Firefox desde nuestro servidor
acl firefox url_regex -i http://alpha/share/public/FirefoxSetup-es-ES.exe
#
# Permitir windowsupdate con IE
acl windowsupdate dstdomain .windowsupdate.com
acl windowsupdate dstdomain .microsoft.com
acl windowsupdate dstdomain .public-trust.com
acl windowsupdate dstdomain .windows.com
acl windowsupdate dstdomain .webiqonline.com
acl windowsupdate dstdomain 207.46.224.158
acl windowsupdate dstdomain .msn.com
always_direct allow windowsupdate
#
# Permitimos una especial con el mensaje de por que no usar IE
acl noie url_regex -i http://alpha.telemedellin.tv
#
# Deny access to MS Internet Explorer
acl MSIE browser MSIE
#
http_access allow ieadictos
http_access allow pda
http_access allow soloie
http_access allow flashplayer
http_access allow firefox
#http_access allow windowsupdate
http_access allow noie
http_access deny MSIE
deny_info http://alpha.telemedellin.tv/mensaje4.html MSIE
#deny_info http://alpha.telemedellin.tv/noie/popup.html MSIE
#deny_info http://alpha/noie/popupsquid.html MSIE
#
# BLOQUEO INTERNET EXPLORER FIN

# BLOQUEO STREAMING INICIO
#
## MAC Address de los que pueden
#
#                 Carlos Duque      Jaime S           Juan D            Gerencia          Dir Noticias
acl LISTENERS arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:1B:78:40:6C:3A 00:15:00:21:C6:4F 00:1B:78:81:12:6E
#                 Graficacion Gallo Graficacion Alejo Graficacion Juan
acl LISTENERS arp 00:14:51:64:D1:E3 00:0A:95:A8:24:94 00:16:17:A7:6D:C3
# Portatil DELL (wireless y fija)
#acl LISTENERS arp 00:12:F0:7E:7E:F5
#acl LISTENERS arp ??:??:??:??:??:??
# Portatil P (wireless y fija)
acl LISTENERS arp 00:16:B6:4A:2E:67
acl LISTENERS arp 00:0B:CD:31:9D:79
#
## Especifico por programa
acl player browser -i ^.*Windows-Media-Player.*
acl player browser -i ^.*NSPlayer.*
acl player browser -i ^.*MPlayer/*
acl player browser -i ^.*QuickTime*/*
acl player browser -i ^.*Winamp/*
acl player browser -i ^.*xmms/*
acl player browser -i ^.*gator/*
#
## Especifico por mime
acl STREAMING rep_mime_type ^video/* ^audio/*
#
## Especifico por extenciones
acl STREAMING_EXT url_regex -i \.(ra?m|mpe?g?|mov|m3u|pls|ivf|asf|asx|avi|wax|wma|wmv|wvx|wmp|wmx|m1v|mp2|mp3|mpa|mpe|mpv2)($|\?)
#
http_access allow player LISTENERS
http_access allow STREAMING LISTENERS
http_access allow STREAMING_EXT LISTENERS
http_access deny player
http_access deny STREAMING
http_access deny STREAMING_EXT
deny_info http://alpha.telemedellin.tv/mensaje3.html player
deny_info http://alpha.telemedellin.tv/mensaje3.html STREAMING
deny_info http://alpha.telemedellin.tv/mensaje3.html STREAMING_EXT
#
# BLOQUEO STREAMING FIN

# CONFLICTIVOS O GRANDES INICIO
#
## MAC Address de los que pueden
#                          Carlos Duque      Jaime S
acl abren_conflictivos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51
# Declaro conflictivos
acl conflictivos url_regex -i \.exe$ \.iso$ \.ccd$ \.cue$ \.img$ \.nrg$ \.sub$
#
# Plugins importantes para navegacion
acl plugins url_regex -i http://port25.technet.com/videos/downloads/wmpfirefoxplugin.exe
acl plugins url_regex -i http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_player.exe
#
# El Firefox
acl firefox url_regex -i http://alpha/share/public/FirefoxSetup-es-ES.exe
#
http_access allow conflictivos abren_conflictivos
http_access allow plugins
http_access allow firefox
http_access deny conflictivos
deny_info http://alpha.telemedellin.tv/mensaje2.html conflictivos
#
# CONFLICTIVOS O GRANDES FIN 

# POTENCIALMENTE PELIGROSOS INICIO
#
## MAC Address de los que pueden PELIGRO!
#                         Carlos Duque
acl abren_peligrosos arp 00:1B:78:81:14:CC
#
## Declaro peligrosos
acl peligrosos url_regex -i \.scr$ \.reg$ \.vbs$ \.bat$ \.lnk$ \.pif$
#
#http_access allow peligrosos abren_peligrosos  # PELIGRO! NO ACTIVAR 
http_access deny peligrosos
deny_info http://alpha.telemedellin.tv/mensaje2.html peligrosos
#
# POTENCIALMENTE PELIGROSOS FIN

# HORARIOS INICIO
#
acl morning time MTWHFA 05:30-12:00
#
acl lunch time MTWHFA 12:00-14:00
#
acl evening time MTWHF 14:00-21:00
#
# HORARIOS FIN

# EQUIPOS A LOS QUE AFECTARA EL HORARIO INICIO
#
acl bravo arp 00:80:5F:95:88:A7
#
# EQUIPOS A LOS QUE AFECTARA EL HORARIO FIN

# ADMINISTRACION HORARIO EQUIPOS INICIO
#
http_access allow bravo morning
http_access allow bravo lunch
http_access allow bravo evening
#
# ADMINISTRACION HORARIO EQUIPOS FIN

# EQUIPOS QUE NO PUEDEN NAVEGAR INICIO
#
# Ejemplo de como limitar equipos por IP
# Ejemplo limitar PC (BADPC)
# acl BADPC src 192.168.1.111
# http_access deny BADPC
# Ejempo de como limitar equipos por MAC ADDRESS
# acl BADPC arp 00:80:5F:95:88:A7
# http_access deny BADPC
#
acl inscriberx arp 00:14:38:EB:E3:DA
http_access deny inscriberx
#
acl nexio arp 00:0E:0C:A0:EB:4C
http_access deny nexio
#
# EQUIPOS QUE NO PUEDEN NAVEGAR FIN

# OBLIGATORIO PERMITIR EL localhost
http_access allow localhost

# OBLIGATORIO PERMITIR NUESTRA RED
http_access allow RedclaseC


####################################################################################################

# And finally deny all other access to this proxy
http_access deny all

# and finally allow by default
http_reply_access allow all

#Allow ICP queries from everyone
icp_access allow all


# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
#Default:
# cache_mgr webmaster
cache_mgr ingenieria@telemedellin.com.co


# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------


# HTTPD-ACCELERATOR OPTIONS
# -----------------------------------------------------------------------------


# ICAP OPTIONS
# -----------------------------------------------------------------------------


# MISCELLANEOUS
# -----------------------------------------------------------------------------
#Default:
# error_directory /usr/local/etc/squid/errors/English

# Con esta linea muestra mensajes de error en espanol
error_directory /usr/local/etc/squid/errors/Spanish


# MISCELLANEOUS
# -----------------------------------------------------------------------------
#
#Todos los usuarios de nuestra LAN ser�n vistos por los servidores web
#externos como si usasen Mozilla en Linux. :)
# Viejo metodo
#anonymize_headers deny User-Agent
#fake_user_agent Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6+) Gecko/20011122
# Nuevo metodo
#header_access User-Agent deny all
#header_replace User-Agent Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.8.1.4) Gecko/20070531 Firefox/2.0.0.4


# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
# -----------------------------------------------------------------------------
#
# Ejemplo 1 Inicio
# http://www.linux-club.de/ftopic23572.html
#
acl SlowFiles url_regex -i ftp .exe .iso .bin .ccd .cue .img .nrg .sub .mp3 .ogg .vqf .tar.gz .gz .ace .arj .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .raw .wav .mov .vivo .vob .divx .pdf
delay_pools 1
delay_class 1 1
# si supera los 6 MB bajara a 25 KB/s
delay_parameters 1 25000/6000000
delay_access 1 allow SlowFiles
delay_access 1 deny all
#
# Ejemplo 1 Fin


# LEAVE COREDUMPS
# -----------------------------------------------------------------------------
#
# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/cache