# Squid-cache 2.6.x
# Testeado en FreeBSD 6.3
# Ultimo cambio (dd-mm-aaaa) 08-04-2008
# Squid FAQ http://wiki.squid-cache.org/SquidFaq
# Opciones de configuracion:
# Dentro del port /usr/ports/www/squid/
# haga un make config y active las opciones 
#
# [X] SQUID_DELAY_POOLS
# [X] SQUID_SSL
# [X] SQUID_WCCP
# [X] SQUID_IDENT
# [X] SQUID_ARP_ACL
# [X] SQUID_KQUEUE
#
# luego guarde e instale con un make install clean


# NETWORK OPTIONS
# -----------------------------------------------------------------------------
# Squid normally listens to port 3128
#http_port 3128
# Opcion para Proxy Transparente
http_port 3128 transparent


# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY

# Apache mod_gzip and mod_deflate known to be broken so don't trust
# Apache to signal ETag correctly on such responses
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache


# OPTIONS WHICH AFFECT THE CACHE SIZE
# -----------------------------------------------------------------------------
#Default:
cache_mem 8 MB

#Default:
maximum_object_size 4096 KB


# LOGFILE PATHNAMES AND CACHE DIRECTORIES
# -----------------------------------------------------------------------------
#Default:
# cache_dir ufs /usr/local/squid/cache 100 16 256
cache_dir ufs /usr/local/squid/cache 4000 16 256
# Adicion de cache en otros discos y le doy mas capacidad 
# Para inicializar el cache, hay que parar squid
# /usr/local/etc/rc.d/squid stop
# Inicializar el cache
# squid -z
# Luego iniciamos squid nuevamente
# /usr/local/etc/rc.d/squid start
cache_dir ufs /usr/home/hd2/squid/cache2 4000 16 256
cache_dir ufs /usr/home/hd3/squid/cache3 8000 16 256

# Squid no loguea el tipo de mime de las aplicaciones por defecto,
# si lo necesitamos para crear acl's nuevas, lo activamos con:
#log_mime_hdrs on

#Default:
# cache_access_log /usr/local/squid/logs/access.log

#  To log the request via syslog specify a filepath of "syslog"
#access_log /usr/local/squid/logs/access.log squid

# Emular el formato del log de apache
#emulate_httpd_log on

# Es muy grande (4.1 GB), lo pongo en otro lugar
access_log /usr/home/hd3/squid/logs/access.log squid

# Specifies the number of logfile rotations to make when you
# type 'squid -k rotate'.  The default is 10, which will rotate
# with extensions 0 through 9.
logfile_rotate 7
# rotacion manual, como root # squid -k rotate y borrar el access.log0

#Default:
#cache_log /usr/local/squid/logs/cache.log

#Default:
# cache_store_log /usr/local/squid/logs/store.log
# Se hace muy grande y no tiene informacion util, mejor desabilitarlo con:
cache_store_log none

#  TAG: mime_table
#	Pathname to Squid's MIME table. You shouldn't need to change
#	this, but the default file contains examples and formatting
#	information if you do.
#
#Default:
#mime_table /usr/local/etc/squid/mime.conf


# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------
# NOTA:
# Solo se puede hacer redireccion a un solo programa (squidGuard o squidclam)
#
# Opcion para enlazar Squid-cache + squidGuard
# Archivo de configuracion en /usr/local/etc/squid/squidGuard.conf
#redirect_program  /usr/local/bin/squidGuard
#
# Opcion para enlazar Squid-cache + ClamAV mediante squidclam
# Archivo de configuracion en /etc/squidclam.conf
#redirect_program /usr/local/bin/squidclam


# OPTIONS FOR TUNING THE CACHE
# -----------------------------------------------------------------------------
#Suggested default:
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern .		0	20%	4320


# TIMEOUTS
# -----------------------------------------------------------------------------


# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443		# https
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

####################################################################################################
# Aqui inician mis reglas

#############################
##### Mis listas            #
#############################

# Declaro mis redes
acl RedclaseC src 192.168.1.0/24

# Bloqueo algunos sitios
acl deny_sites url_regex "/usr/local/etc/squid/deny_sites.conf"

# Bloqueo algunos mimes
#acl NO_MIMES rep_mime_type -i "/usr/local/etc/squid/mimes_prohibidos.conf"

# MSN Messenger
# MAC Address de los que pueden usar MSN Messenger
#                      Carlos D          Jaime S           Gerencia
acl MSN_Permitidos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:13:E8:72:B8:53
acl msn_url url_regex -i gateway.dll
acl msnmessenger req_mime_type -i ^application/x-msn-messenger$
acl msn_port port 1863
acl msn_method method POST
acl MSN_Messenger browser ^Mozilla.compatible;.MSN Messenger.
acl msn_overhttp url_regex -i "/usr/local/etc/squid/msn_overhttp.conf"
acl msn_domains dstdom_regex -i "/usr/local/etc/squid/msn_domains.conf"

# Yahoo Messenger
# MAC Address de los que pueden usar Yahoo! Messenger
#                                  Carlos D
acl Yahoo_Messenger_Permitidos arp 00:1B:78:81:14:CC
acl yahoo url_regex -i http.pager.yahoo.com
acl yahoo url_regex -i http.msg.yahoo.com
acl yahoo url_regex -i messenger.yahoo.com

# Google Talk (Gtalk)
# Bloquear el chat integrado en Gmail sin bloquear el correo
#acl gtalk url_regex -i mail.google.com/mail/channel/bind

# Youtube
# MAC Address de los que pueden ver video en youtube
#                          Gallo             Alejo             Gerencia          Ingenieria1       Ingenieria2       Wifi DELL         wife compaq
#acl youtube_permitidos arp 00:14:51:64:D1:E3 00:0A:95:A8:24:94 00:13:E8:72:B8:53 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:12:F0:7E:7E:F5 00:16:B6:4A:2E:67
#
#acl horariocapicua time MTWHF 16:00-18:00
#acl compucapicua arp 00:16:B6:4A:2E:67
#acl youtube url_regex youtube.com/get_video\?video_id

# Skype
# UDP source port 1247 is the initial control channel.
# Once the connection is established, the rest of the
# communications is done in TCP over non-default source ports with ranges
# sweeping from 2940-3000.
#
# Your acl definitions
#acl numeric_IPs urlpath_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
#acl connect method CONNECT

# BLOQUEO INTERNET EXPLORER
# (User-Agent strings):
# Test: http://www.clavister.com/support/kb/10026/httprequestinfo/
# Listado http://www.useragentstring.com/pages/Internet%20Explorer/
#
# Las MAC Address de los que pueden usar IE sin restricciones
#                 Carlos Duque      Jaime S           Juan D            Tesorera          Gerencia          GPabon
acl ieadictos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:1B:78:40:6C:3A 00:15:60:5A:6C:0A 00:13:E8:72:B8:53 00:15:60:5A:95:5C
#
# Portatil Dell (temporalmente)
#acl ieadictos arp 00:12:F0:7E:7E:F5
#
# Otros cacharros que se identifican como IE
#           Jaime S PDA
acl pda arp 00:0B:6C:51:F2:A6
#
# Algunas paginas web y dominios problematicos que solo funcionan con IE
#
acl accept_sites url_regex "/usr/local/etc/squid/accept_sites.conf"
always_direct allow accept_sites
#
acl accept_domains dstdomain "/usr/local/etc/squid/accept_domains.conf"
always_direct allow accept_domains
#
# Deny access to MS Internet Explorer
acl MSIE browser MSIE

# BLOQUEO STREAMING
#
# CDDB donde los players descargan info de los CD's
acl FreeDB dstdomain "/usr/local/etc/squid/FreeDB.conf"
always_direct allow FreeDB
#
## MAC Address de los que pueden
#
#                 Carlos Duque      Jaime S           Juan D            Gerencia          Dir Noticias     
acl LISTENERS arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:1B:78:40:6C:3A 00:13:E8:72:B8:53 00:1B:78:81:12:6E
#                 Graficacion Gallo Graficacion Alejo Graficacion Juan
acl LISTENERS arp 00:14:51:64:D1:E3 00:0A:95:A8:24:94 00:16:17:A7:6D:C3
# Portatil DELL (wireless y fija)
acl LISTENERS arp 00:12:F0:7E:7E:F5
#acl LISTENERS arp ??:??:??:??:??:??
# Portatil P (wireless y fija)
acl LISTENERS arp 00:16:B6:4A:2E:67
acl LISTENERS arp 00:0B:CD:31:9D:79
#
## Especifico por programa
acl player browser -i ^.*Windows-Media-Player.*
acl player browser -i ^.*NSPlayer.*
acl player browser -i ^.*MPlayer/*
acl player browser -i ^.*QuickTime*/*
acl player browser -i ^.*Winamp/*
acl player browser -i ^.*xmms/*
acl player browser -i ^.*gator/*
#
# Windows Media Player Herramientas / Opciones / Privacidad
# Desmarcar Recuperar informacion...
# Actualizar mis archivos de musica...
# Adquirir licencias...
# 
# Ya que esto hace peticiones constantes al proxy!
#
## Especifico por mime
acl STREAMING rep_mime_type ^video/* ^audio/*
#
## Especifico por extenciones
acl STREAMING_EXT url_regex -i \.(ra?m|mpe?g?|mov|m3u|pls|ivf|asf|asx|avi|wax|wma|wmv|wvx|wmp|wmx|m1v|mp2|mp3|mpa|mpe|mpv2)($|\?)

# CONFLICTIVOS O GRANDES
## MAC Address de los que pueden
#                          Carlos Duque      Jaime S           Bravo
acl abren_conflictivos arp 00:1B:78:81:14:CC 00:1B:78:40:6D:51 00:80:5F:95:88:A7
# Declaro conflictivos
acl conflictivos url_regex -i \.exe$ \.iso$ \.ccd$ \.cue$ \.img$ \.nrg$ \.sub$

# POTENCIALMENTE PELIGROSOS
## MAC Address de los que pueden PELIGRO!
#                         Carlos Duque
acl abren_peligrosos arp 00:1B:78:81:14:CC
#
## Declaro peligrosos
acl peligrosos url_regex -i \.scr$ \.reg$ \.vbs$ \.bat$ \.lnk$ \.pif$

# HORARIOS
#
acl morning time MTWHFA 05:30-12:00
#
acl lunch time MTWHFA 12:00-14:00
#
acl evening time MTWHF 14:00-21:00

# EQUIPOS A LOS QUE AFECTARA EL HORARIO
#
acl bravo arp 00:80:5F:95:88:A7

# EQUIPOS QUE NO PUEDEN NAVEGAR
#
# Ejemplo de como limitar equipos por IP
# Ejemplo limitar PC (BADPC)
# acl BADPC src 192.168.1.111
# Ejempo de como limitar equipos por MAC ADDRESS
# acl BADPC arp 00:80:5F:95:88:A7
# acl deny_srchost "/usr/local/etc/squid/deny_srchost.conf"
acl inscriberx arp 00:14:38:EB:E3:DA
acl nexio arp 00:0E:0C:A0:EB:4C

#############################
##### Permisos a mis listas #
#############################

# Bloqueo algunos sitios
http_access deny deny_sites
deny_info http://alpha.telemedellin.tv/mensaje.html deny_sites

# Bloqueo algunos mimes
#http_access deny NO_MIMES

# MSN MESSENGER
http_access allow msnmessenger MSN_Permitidos
http_access deny msnmessenger
http_access deny msn_method msn_url
http_access deny msn_port
http_access deny CONNECT msn_port
http_access deny MSN_Messenger
http_access deny msn_overhttp
deny_info http://alpha.telemedellin.tv/mensaje.html msn_overhttp
http_access deny msn_domains
deny_info http://alpha.telemedellin.tv/mensaje.html msn_domains

# Yahoo Messenger
http_access allow yahoo Yahoo_Messenger_Permitidos
http_access deny yahoo

# Google Talk
#http_access deny gtalk

# Youtube
################### YouTube Edit (1/2) #############
#http_access allow youtube youtube_permitidos
#http_access allow youtube compucapicua horariocapicua
#http_access deny youtube
################### End YouTube Edit (1/2) #############
#
################### YouTube Edit (2/2) #############
# EDIT THIS ---> this is where your replacement video lives
#deny_info http://alpha.telemedellin.tv/video/Transformer.flv youtube
################### End YouTube Edit (2/2) #############

# Skype
# Apply your acls
#http_access deny connect numeric_IPs all

# BLOQUEO STREAMING
http_access allow player LISTENERS
http_access allow STREAMING LISTENERS
http_access allow STREAMING_EXT LISTENERS
http_access allow FreeDB player
http_access allow accept_sites player 
http_access allow accept_domains player
http_access deny player
http_access deny STREAMING
http_access deny STREAMING_EXT
deny_info http://alpha.telemedellin.tv/mensaje3.html player
deny_info http://alpha.telemedellin.tv/mensaje3.html STREAMING
deny_info http://alpha.telemedellin.tv/mensaje3.html STREAMING_EXT

# CONFLICTIVOS O GRANDES
http_access allow conflictivos abren_conflictivos
http_access deny conflictivos
deny_info http://alpha.telemedellin.tv/mensaje2.html conflictivos

# POTENCIALMENTE PELIGROSOS
#http_access allow peligrosos abren_peligrosos  # PELIGRO! NO ACTIVAR 
http_access deny peligrosos
deny_info http://alpha.telemedellin.tv/mensaje2.html peligrosos

# EQUIPOS QUE NO PUEDEN NAVEGAR
# http_access deny BADPC
# http_access deny BADPC
# http_access deny deny_srchost
http_access deny inscriberx
http_access deny nexio

# BLOQUEO INTERNET EXPLORER
http_access allow MSIE player
http_access allow MSIE ieadictos
http_access allow MSIE pda
http_access allow MSIE accept_sites
http_access allow MSIE accept_domains
http_access deny MSIE
deny_info http://alpha.telemedellin.tv/mensaje4.html MSIE

# HORARIOS
# ADMINISTRACION HORARIO EQUIPOS
http_access allow bravo morning
http_access allow bravo lunch
http_access allow bravo evening

# OBLIGATORIO PERMITIR EL localhost
http_access allow localhost

# OBLIGATORIO PERMITIR NUESTRA RED
http_access allow RedclaseC

# Aqui terminan mis reglas
####################################################################################################

# And finally deny all other access to this proxy
http_access deny all

# and finally allow by default
http_reply_access allow all

#Allow ICP queries from everyone
icp_access allow all


# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
#Default:
# cache_mgr webmaster
cache_mgr ingenieria@telemedellin.com.co


# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------


# HTTPD-ACCELERATOR OPTIONS
# -----------------------------------------------------------------------------


# ICAP OPTIONS
# -----------------------------------------------------------------------------


# MISCELLANEOUS
# -----------------------------------------------------------------------------
#Default:
# error_directory /usr/local/etc/squid/errors/English

# Con esta linea muestra mensajes de error en espanol
error_directory /usr/local/etc/squid/errors/Spanish

#  TAG: logfile_rotate
#	Specifies the number of logfile rotations to make when you
#	type 'squid -k rotate'.  The default is 10, which will rotate
#	with extensions 0 through 9.
#logfile_rotate 10

#Todos los usuarios de nuestra LAN seran vistos por los servidores web
#externos como si usasen Mozilla en Linux. :)
# Viejo metodo
#anonymize_headers deny User-Agent
#fake_user_agent Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6+) Gecko/20011122
# Nuevo metodo
#header_access User-Agent deny all
#header_replace User-Agent Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.8.1.4) Gecko/20070531 Firefox/2.0.0.4


# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
# -----------------------------------------------------------------------------
#
# Ejemplo Inicio
# http://www.linux-club.de/ftopic23572.html
#
acl SlowFiles url_regex -i ftp .exe .iso .bin .ccd .cue .img .nrg .sub .mp3 .ogg .vqf .tar.gz .gz .ace .arj .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .raw .wav .mov .vivo .vob .divx .pdf
delay_pools 1
delay_class 1 1
# si supera los 60 MB bajara a 50 KB/s
delay_parameters 1 50000/60000000
delay_access 1 allow SlowFiles
delay_access 1 deny all
#
# Ejemplo Fin


# LEAVE COREDUMPS
# -----------------------------------------------------------------------------
#
# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/cache