How Squid ACLs work

For less experienced Squid administrators the concept of ACLs can be confusing at first. But they offer a great way of controlling who is allowed to access which web pages when.


First you need to define certain criteria like accesses from the marketing department or accesses to or need to authenticate. There are certain types of ACLs for that purpose. The complete list of ACLs can be found at

The syntax of an acl is:

acl name type definition1 definition2 definition3 ...


acl accesses_to_google dstdomain
acl accesses_to_search_engines dstdomain
acl accesses_from_marketing_department src
acl need_to_authenticate proxy_auth

You can also use lists of definitions that are stored in files on your hard disk. Let’s assume you have a list of search engines URLs that you want to allow:


Then the ACL for that file would look like:

acl accessess_to_search_engines dstdomain "/etc/squid/search-engines-urls.txt"

The quotes are important here to tell Squid it needs to look up definitions in that file.

Using the ACLs: http_access

Defining the ACLs alone does not actually block anything – it’s just a definition. ACLs can be used in various places of your squid.conf. The most useful feature is the http_access statement. It works similar to the way a firewall would handle rules. For each request that Squid receives it will look through all the http_access statements in order until it finds a line that matches. It then either accepts or denys depending on your setting. The remaining rules are ignored.

The general syntax of an http_access line is:

http_access (allow|deny) acl1 acl2 acl3 ...


http_access allow accesses_from_admins
http_access deny accesses_to_porn_urls
http_access allow accesses_during_lunchtime
http_access deny all

This would allow accessing from the admins (whatever that ACL looks like – probably a src ACL pointing to the subnet where the admin workstations are in). For everyone else it will deny accesses to porn URLs. Then it would allow accesses from everyone to every web site during lunch time. And finally all other accesses would be denied.

Combining ACLs (AND/OR)

Often you need to combine ACLs. Let’s say you want to allow access to only for the back office. This combines two ACLS with an AND. This would look like this:

http_access allow accesses_from_back_office

If you wanted to use an OR and say either accesses from the back office or accesses to are allowed then the line would look like this:

http_access allow
http_access allow accesses_from_back_office

To summarize: AND means putting the conditions in one line. OR means using seperate lines.

Custom error pages (deny_info)

By default when you deny access the user gets the error page that is stored in the ERR_ACCESS_DENIED file. But luckily you can define your own custom error pages and display them when you deny certain accesses. A simple example:

acl google dstdomain
deny_info error-google google
http_access deny google

Put an error page into the directory where the HTML files are stored (look for error_directory in your squid.conf) and name it error-google. If the user tries to access the access is denied and your error page is shown.

Careful when you combine ACLs on a http_access line. Example:

acl google dstdomain
acl admin src
deny_info google error-google
http_access deny admin google

This will deny access only for the user from the IP address when is accessed. As you can see I have combined the ACLs admin and google. In such a combination the last ACL in the line is taken into account for lookups of deny_info. So it’s important that you define a deny_info for the google ACL.

Re-Authentication control

Usually when a user is authenticated at the proxy you cannot “log out” and re-authenticate. The user has to close and re-open the browser windows to be able to re-login at the proxy. A simple configuration will probably look like this:

acl my_auth proxy_auth REQUIRED
http_access allow my_auth
http_access deny all

Now there is a tricky change that was introduced in Squid 2.5.10. It allows to control when the user is prompted to authenticate. Now it’s possible to force the user to re-authenticate although the username and password are still correct. Example configuration:

acl my_auth proxy_auth REQUIRED
acl google dstdomain
http_access allow my_auth
http_access deny google my_auth
http_access deny all

In this case if the user requests then the second http_access line matches and triggers re-authentication. Remember: it’s always the last ACL on a http_access line that “matches”. If the matching ACL has to do with authentication a re-authentication is triggered. If you didn’t want that you would need to switch the order of ACLs so that you get http_access deny my_auth google.

You might also run into an authentication loop if you are not careful. Assume that you use LDAP group lookups and want to deny access based on an LDAP group (e.g. only members of a certain LDAP group are allowed to reach certain web sites). In this case you may trigger re-authentication although you don’t intend to. This config is likely wrong for you:

acl ldap-auth proxy_auth REQUIRED
acl ldapgroup-allowed external LDAP_group PROXY_ALLOWED

http_access deny !ldap-auth
http_access deny !ldapgroup-allowed
http_access allow all

The second http_access line would force the user to re-authenticate time and again if he/she is not member of the PROXY_ALLOWED group. This is perhaps not what you want. You rather wanted to deny access to non-members. So you need to rewrite this http_access line so that an ACL matches that has nothing to do with authentication. This is the correct example:

acl ldap-auth proxy_auth REQUIRED
acl ldapgroup-allowed external LDAP_group PROXY_ALLOWED
acl dummy src

http_access deny !ldap-auth
http_access deny !ldapgroup-allowed dummy
http_access allow all

This way the second http_access line still matches. But it’s the dummy ACL which is now last in the line. Since dummy is a static ACL (that always matches) and has nothing to do with authentication you will find that the access is just denied.

16 thoughts on “How Squid ACLs work

  • 2011-08-31 at 17:20

    im having troubles assigning ACL to ldap groups… i have this:

    external_acl_type gruposLDAP %LOGIN /usr/lib64/squid/squid_ldap_group -P -R -b OU=USUARIOS,DC=tierradelfuego,DC=gov,DC=ar -D proxyAuth -w password -f (&(objectClass=person)(sAMAccountName=%u)(memberOf=CN=%g,OU=GRUPOS,DC=tierradelfuego,DC=gov,DC=ar)) -h -s sub -v 3 -d

    acl ProxyA external gruposLDAP _GP_US_PROXY_A
    acl ProxyB external gruposLDAP _GP_US_PROXY_B

    acl ad_users proxy_auth REQUIRED

    http_access deny !ad_users
    http_access deny ProxyB
    http_access allow ProxyA

    http_access allow all

    but no matters if a user is in ProxyA or ProxyB … it falls into an authentation loop.. can anybody help me?

    • 2012-07-19 at 14:09

      Step by step ACL. It is very easy to get it.


  • 2013-05-02 at 09:02

    Hello I would like to ask in acl list.

    I downloaded a definition of list in One of the example I download is squid-torrent.acl, I rename it squid-torrent.txt….

    This is my squid.conf configuration
    acl squid-torrent dstdomain “/etc/squid/squid-torrent.txt”
    http_access deny squid-torrent

    after service squid restart command, ther’s an error….
    [root@rpidvoproxy squid]# service squid restart
    Stopping squid: 2013/05/02 14:49:39| WARNING: ‘’ is a subdomain of ‘’
    2013/05/02 14:49:39| WARNING: because of this ‘’ is ignored to keep splay tree searching predictable
    2013/05/02 14:49:39| WARNING: You should probably remove ‘’ from the ACL named ‘squid-torrent’
    2013/05/02 14:49:39| WARNING: ‘’ is a subdomain of ‘’
    2013/05/02 14:49:39| WARNING: because of this ‘’ is ignored to keep splay tree searching predictable

    Help, how to fix this error, I like using a list of definition, because its easy for me to download from the web for the list, instead of searching all torrent site and add-in to my blockesite list.

    • 2013-05-02 at 09:51

      Could it be that you are using the same ACL twice? (Two "http_access deny" lines.)

      Or does the domain appear twice in the ACL file?

      • 2013-05-03 at 03:33

        hello, can you please tell me if this is wrong declaration of my acl.

        # ACL squid-torrent
        #acl squid-torrent src “/etc/squid/squid-torrent.txt”
        #acl squid-torrent dst “/etc/squid/squid-torrent.txt”
        #acl squid-torrent srcdomain “/etc/squid/squid-torrent.txt”
        #acl squid-torrent dstdomain “/etc/squid/squid-torrent.txt”
        #acl squid-torrent srcdom_regex -i “/etc/squid/squid-torrent.txt”
        #acl squid-torrent dstdom_regex -i “/etc/squid/squid-torrent.txt”
        #acl squid-torrent url_regex -i “/etc/squid/squid-torrent.txt”
        #acl squid-torrent urlpath_regex -i “/etc/squid/squid-torrent.txt”

        # Deny access to squid-torrent
        #http_access deny squid-torrent

      • 2013-05-03 at 04:00

        I found the error, yes its duplicate domain in my acl squid-torrent.txt file.

        thanks for your help.

      • 2013-05-03 at 05:28

        Its very confusing about declaring of acl.

        After, checking and removing the duplicate of acl list in my squid-torrent.txt file… service squid restart is ok! no found error.

        [root@rpidvoproxy squid]# service squid restart
        Stopping squid: ……………. [ OK ]
        Starting squid: . [ OK ]
        [root@rpidvoproxy squid]#


        after testing my client xp for opening the torrent sites like,,, etc…
        still, my client xp can open the said torrent sites.

        ****exept the torrent site
        The following error was encountered while trying to retrieve the URL:

        Access Denied.

        Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.

        then its good for me, that my proxy block atleast

        but when I check my squid-torrent.txt content list (nano /etc/squid/squid-torrent.txt) those torrent site are included in my list. How come, isohunt, etc… are not denied on my proxy.

  • 2013-12-05 at 03:59

    Hey…. I have a task to configure external ACL… can you help me please… I don’t understand

  • 2014-02-04 at 00:02
    Permalink Blacklists Tailored For Squid Proxy.

    A higher level of Quality in a blacklist that trumps the competition, we carry multiple ports, including SquidGuard and DansGuardian compatible formats. We are the worlds leading publisher of blacklists tailored for Squid proxy. We also carry Squid Native ACL format for those whom do not wish to use third party plugins, upstream proxies or helpers to achieve filtering.

  • 2014-04-06 at 01:17

    Thanks for this info. it is of great help. I just recently installed squid on my Windows OS. I have created several ACL rules and it worked fine. However, I wanted to extensively filter the organization. I created several groups defined by their mac addresses. Whereas, level1 – can access all sites, level2 can access all sites except youtube and facebook, level3 – some sites defined on ACL and the rest not defined should not be allowed. I discovered that if someone changed their ip address manually, they can bypass web filtering. I need help on this one. Thanks in advance.

  • 2014-04-21 at 16:20

    I want to apply on cache_peer for selection the proxy on the basis of the user agent, how to do that?
    can you please help

  • 2015-01-09 at 15:34

    I have figured out how to remove referer from header for request going to a destination, as under

    acl referer_allowsrc dstdomain
    header_access Referer deny referer_allowsrc

    Is it possible to deny this selectively for sites originating the referer? I don’t want to do it for all sites using the proxy.
    Example – referrer should be stripped for and referring to, not other sites like etc.,


Leave a Reply

Your email address will not be published. Required fields are marked *