Two Squid Ports Can Have Different Destination Allowlists

Combine localport with the relevant destination ACL on each allow rule, preserving earlier restrictions and the final deny rule.

Squid's localport ACL matches the port where Squid received the connection. Combine it with the appropriate destination ACL so each listener grants only its own list.

For a Squid 6 or 7 configuration with existing client and safe-port restrictions:

http_port 3128
http_port 3129

acl approved_clients src 192.0.2.0/24
acl main_listener localport 3128
acl alternate_listener localport 3129
acl main_sites dstdomain "/etc/squid/main-sites.txt"
acl alternate_sites dstdomain "/etc/squid/alternate-sites.txt"

http_access allow approved_clients main_listener main_sites
http_access allow approved_clients alternate_listener alternate_sites
http_access deny all

Replace the documentation client range with the actual authorized clients and prepare the two domain-list files. Place the paired allow rules after the installation's required deny checks and before its final deny. Preserve its unsafe-port, CONNECT and management restrictions.

ACL names on one access rule are combined with AND. Separate allow rules offer alternatives. Leaving the listener condition off the destination rules would permit either list through either port.

Check earlier rules too: a broad allow that matches first prevents these later restrictions from being evaluated. Test allowed and denied destinations through each listener to verify the boundary.

localport is not the website's port or the client's ephemeral source port. A destination-port condition uses the port ACL instead.

Ũhoro ũhĩtĩte