squid ACL 限制上班时间访问某些网站为什么这样写啊

lcx9035

acl NotWorkRelated dstdomain  
"/usr/local/squid/etc/not-work-related-sites"  
      
acl WorkingHours time D 08:00-17:30  
      
http_access deny !WorkingHours NotWorkRelated  
刚学squid最后这句不是很明白，特别是这个！，有明白的给解释一下吧

ulovko

1. 
   
2. 小弟以前的笔记 希望对兄弟有所帮助 ^_^
   
3. 
   
4. > more ~/squid/squid.txt
   
5. # Squid Web Proxy Cache (3128port)
   
6. yum install squid -y
   
7. /etc/init.d/squid restart
   
8. 
   
9. acl love src 192.168.0.0/255.255.255.0
   
10. http_access allow love
    
11. 
    
12. #1. Whitelist Control
    
13. acl whitelist src 192.168.0.12 192.168.0.1
    
14. http_access allow whitelist
    
15. http_access deny ! whitelist
    
16. 
    
17. acl myclients src 192.168.0.0/24
    
18. acl myclients src example.com
    
19. acl all src 0.0.0.0/0.0.0.0
    
20. acl myfriends src "/etc/squid/myfriends.lst"
    
21. http_access allow myfriends
    
22. http_access allow myclients
    
23. http_access deny all
    
24. 
    
25. #1.2 vim /etc/squid/myfriends.lst
    
26. 192.168.0.39
    
27. 192.168.0.49
    
28. 192.168.0.59
    
29. 
    
30. #1.3 Domain Control
    
31. acl all src 0.0.0.0/0.0.0.0
    
32. http_access allow myclients
    
33. http_access deny all
    
34. 
    
35. 
    
36. 
    
37. #1.4 Contents Control
    
38. acl ICQ_domain dst "/etc/squid/acl/ICQ_domain"
    
39. acl sex_domain dst "/etc/squid/acl/sex_domain
    
40. acl violence_domain dst "/etc/squid/acl/violence_domain
    
41. http_access deny ICQ_domain
    
42. http_access deny sex_domain
    
43. http_access deny violence_domain
    
44. 
    
45. #   acl aclname src      ip-address/netmask ... (clients IP address)
    
46. #   acl aclname src      addr1-addr2/netmask ... (range of addresses)
    
47. #   acl aclname dst      ip-address/netmask ... (URL host's IP address)
    
48. #   acl aclname myip     ip-address/netmask ... (local socket IP address)
    
49. #   acl aclname arp      mac-address ... (xx:xx:xx:xx:xx:xx notation)
    
50. #   acl aclname urllogin [-i] [^a-zA-Z0-9] ...      # regex matching on URL login field
    
51. 
    
52. #1.5 Regular Expression
    
53. acl movie_site1 url_regex ^http://www.youku.com
    
54. acl movie_site2 url_regex ^http://www.tudou.com
    
55. acl movie_site3 url_regex ^http://www.ku6.com
    
56. acl games_site url_regex -i 3721
    
57. acl download_file urlpath_regex -i \.swf$ \.gif$ \.jpg$ \.png$ \.wmv$ \.exe$ \.rmvb$ \.flv$
    
58. http_access deny movie_site1
    
59. http_access deny movie_site2
    
60. http_access deny movie_site3
    
61. http_access deny games_site
    
62. http_access deny download_file
    
63. 
    
64. # 1.6 Boss Control
    
65. acl special_user src 192.168.0.8
    
66. http_access allow special_user
    
67. 
    
68. # 1.7 Time Control
    
69. # acl aclname time     [day-abbrevs]  [h1:m1-h2:m2]
    
70. # day-abbrevs:
    
71. #      S - Sunday
    
72. #      M - Monday
    
73. #      T - Tuesday
    
74. #      W - Wednesday
    
75. #      H - Thursday
    
76. #      F - Friday
    
77. #      A - Saturday
    
78. #      h1:m1 must be less than h2:m2
    
79. 
    
80. acl admin src 192.168.0.254
    
81. acl allowed_clients src 192.168.0.0/24
    
82. acl all src 0.0.0.0/0.0.0.0
    
83. acl maintain_time time S 0:00-3:00
    
84. acl working_time time MTWHF 8:30-20:30
    
85. http_access allow admin maintain_time
    
86. http_access allow allowed_clients working_time
    
87. http_access deny all
    
88. 
    
89. #    acl aclname port     80 70 21 ...
    
90. #    acl aclname port     0-1024 ...         # ranges allowed
    
91. #    acl aclname myport   3128 ...           # (local socket TCP port)
    
92. #    acl aclname proto    HTTP FTP ...
    
93. #    acl aclname method   GET POST ...
    
94. 
    
95. 
    
96. # 1.8 Security Control
    
97. acl Safe_ports port 80 21 443 1025-65535
    
98. acl ftp proto FTP
    
99. acl allowed_clients src 192.168.0.0/24
    
100. acl all src 0.0.0.0/0.0.0.0
     
101. http_access allow allowed_clients
     
102. http_access deny ! Safe_ports
     
103. http_access deny ftp
     
104. http_access deny all
     
105. 
     
106. # 2. Transparence Proxy
     
107. # 2.1 Enable ip_forward
     
108. echo "1" > /proc/sys/net/ipv4/ip_forward
     
109. 
     
110. # 2.2 vim /etc/squid/squid.conf
     
111. httpd_accel_host virtual
     
112. httpd_accel_port 80
     
113. httpd_accel_with_proxy on
     
114. httpd_accel_user_host_header on
     
115. 
     
116. # 2.3 Firewall Configure
     
117. iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
     
118. iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
     

复制代码

lcx9035

你把你笔记给我，我还是不明白啊，给我解释一下最后一句就行了，为什么加！啊

ulovko

回复 3# lcx9035


    就是取反的意思！ O_o

lcx9035

我知道是取反，我是问为什么取反

lcx9035

我终于知道为什么加！了，因为那资料上写错了，我说我怎么想不明白呢