Никак не могу заставить работать squid с фильтрацией по определенным ip адресам в сети.
Т.е. чтобы определенные ip могли ходить в интернет.Имею следующий конфиг squid:
visible_hostname gate
dns_nameservers 192.168.1.1
dns_v4_first on
shutdown_lifetime 1 seconds
debug_options ALL,1 28,9
acl localnet1 src 192.168.1.0/24
acl full_access src 192.169.1.124
http_access allow full_access
http_access allow localnet1
http_access deny all
http_port 192.168.1.1:3128
http_port 127.0.0.1:3128
cache_dir ufs /var/squid/cache 100 16 256
coredump_dir /var/squid/cache
refresh_pattern ^ftp: &n... 1440 20% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
В логах вот такая картина:
2018/11/19 11:15:21.692 kid1| 28,4| Eui48.cc(438) lookup: Got address 74:27:ea:00:59:bd
2018/11/19 11:15:21.693 kid1| 28,3| Checklist.cc(70) preCheck: 0x8033aa418 checking slow rules
2018/11/19 11:15:21.693 kid1| 28,5| Acl.cc(124) matches: checking http_access
2018/11/19 11:15:21.693 kid1| 28,5| Checklist.cc(397) bannedAction: Action 'ALLOWED/0' is not banned
2018/11/19 11:15:21.693 kid1| 28,5| Acl.cc(124) matches: checking http_access#1
2018/11/19 11:15:21.693 kid1| 28,5| Acl.cc(124) matches: checking full_access
2018/11/19 11:15:21.693 kid1| 28,9| Ip.cc(96) aclIpAddrNetworkCompare: aclIpAddrNetworkCompare: compare: 192.168.1.124:41924/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff] (192.168.1.124:41924) vs 192.169.1.124-[::]/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]
2018/11/19 11:15:21.693 kid1| 28,3| Ip.cc(538) match: aclIpMatchIp: '192.168.1.124:41924' NOT found
2018/11/19 11:15:21.693 kid1| 28,3| Acl.cc(151) matches: checked: full_access = 0
2018/11/19 11:15:21.693 kid1| 28,3| Acl.cc(151) matches: checked: http_access#1 = 0
2018/11/19 11:15:21.693 kid1| 28,5| Checklist.cc(397) bannedAction: Action 'ALLOWED/0' is not banned
2018/11/19 11:15:21.693 kid1| 28,5| Acl.cc(124) matches: checking http_access#2
2018/11/19 11:15:21.693 kid1| 28,5| Acl.cc(124) matches: checking localnet1
2018/11/19 11:15:21.693 kid1| 28,9| Ip.cc(96) aclIpAddrNetworkCompare: aclIpAddrNetworkCompare: compare: 192.168.1.124:41924/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00] (192.168.1.0:41924) vs 192.168.1.0-[::]/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ff00]
2018/11/19 11:15:21.693 kid1| 28,3| Ip.cc(538) match: aclIpMatchIp: '192.168.1.124:41924' found
2018/11/19 11:15:21.693 kid1| 28,3| Acl.cc(151) matches: checked: localnet1 = 1
2018/11/19 11:15:21.693 kid1| 28,3| Acl.cc(151) matches: checked: http_access#2 = 1
2018/11/19 11:15:21.693 kid1| 28,3| Acl.cc(151) matches: checked: http_access = 1
2018/11/19 11:15:21.693 kid1| 28,3| Checklist.cc(63) markFinished: 0x8033aa418 answer ALLOWED for match
Здесь интересно то, что фильтр находит совпадения ip с acl подсети,но не находит совпадения ip если указан конкретный ip адрес.
Если есть мудрые люди, подскажите, почему не срабатывает правило http_access allow full_access ?
И почему в логах вот это: 2018/11/19 11:15:21.693 kid1| 28,9| Ip.cc(96) aclIpAddrNetworkCompare: aclIpAddrNetworkCompare: compare: 192.168.1.124:41924/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff] (192.168.1.124:41924) vs 192.169.1.124-[::]/[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]
2018/11/19 11:15:21.693 kid1| 28,3| Ip.cc(538) match: aclIpMatchIp: '192.168.1.124:41924' NOT found
