# cat squid.conf|egrep -v "^#|\$^"
acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10          # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12          # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10              # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl INTERNAL_METHODS method GET POST
acl fetched_certificate transaction_initiator certificate-fetching
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
acl tls_s1_connect at_step SslBump1
acl tls_s2_client_hello at_step SslBump2
acl tls_s3_server_hello at_step SslBump3
external_acl_type ytcontrol concurrency=1 children-max=20 children-startup=10 children-idle=5 ttl=10 %METHOD %URI %SRC %DST /opt/yt-classifier-lists/run-helper.sh
acl ythelper external ytcontrol
acl youtube_doms dstdomain .youtube.com .youtu.be .ytimg.com
acl YTMETHODS method GET POST PUT OPTIONS HEAD
acl dummy_dst_dom dstdomain .tz-home
external_acl_type ytcontrol_1 concurrency=1 children-max=20 children-startup=10 children-idle=5 ttl=10 %URI %METHOD  %SRC %DST /usr/bin/ruby /opt/filtering/bin/url-matcher-1.rb
acl ythelper_1 external ytcontrol_1
external_acl_type ytcounter concurrency=1 children-max=20 children-startup=10 children-idle=5 ttl=10 %METHOD %URI %SRC %DST /usr/bin/ruby /usr/local/bin/yt-counter-1.rb
acl ythelper_counter external ytcounter
external_acl_type sni_matcher concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=15 %SRC %ssl::>sni %METHOD %DST /usr/bin/socat - UNIX-CONNECT:/tmp/sni-dstdomain
acl sni_matcher_helper external sni_matcher
external_acl_type youtube_blacklist concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=15 %SRC %URI %METHOD /usr/bin/socat - UNIX-CONNECT:/tmp/youtube-filter
acl yt_blacklist_helper external youtube_blacklist
external_acl_type youtube_whitelist concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=15 %SRC %URI %METHOD /usr/bin/socat - UNIX-CONNECT:/tmp/youtube-filter-whitelist
acl yt_whitelist_helper external youtube_whitelist
acl yt_urls_blacklist_regex_list url_regex "/etc/squid/yt-urls-blacklist-regex.list"
acl yt_urls_whitelist_regex_list url_regex "/etc/squid/yt-urls-whitelist-regex.list"
acl blacklist_regex_list_1 url_regex "/etc/squid/regex-blacklist.list"
acl whitelist_regex_list_1 url_regex "/etc/squid/regex-whitelist.list"
acl blacklist_regex_list_2 url_regex "/etc/squid/urls-blacklist-regex.list"
acl whitelist_regex_list_2 url_regex "/etc/squid/urls-whitelist-regex.list"
acl blocked_connect_dests dst "/etc/squid/blocked-connect-dests-dst.list"
external_acl_type yandex_bl_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=15 %SRC %DST %METHOD %URI %ssl::>sni /usr/bin/socat - UNIX-CONNECT:/tmp/domains-filter
acl yandex_bl_checker_helper external yandex_bl_checker
external_acl_type internal_requests_validator concurrency=10 children-max=60 children-startup=5 children-idle=5 ttl=15 %SRC %DST %METHOD %URI %ssl::>sni  /usr/bin/ruby /opt/filtering/bin/allow-internally-generated-traffic.rb
acl internal_requests_validator_helper external internal_requests_validator
http_access allow fetched_certificate
http_access deny YTMETHODS yandex_bl_checker_helper
http_access deny !CONNECT blacklist_regex_list_2
http_access allow !CONNECT whitelist_regex_list_1
http_access allow !CONNECT whitelist_regex_list_2
http_access allow YTMETHODS youtube_doms yt_urls_whitelist_regex_list
http_access deny YTMETHODS youtube_doms yt_urls_blacklist_regex_list
http_access deny YTMETHODS youtube_doms yt_blacklist_helper
http_access deny CONNECT blocked_connect_dests
http_access deny !CONNECT blacklist_regex_list_1
http_access deny YTMETHODS youtube_doms ythelper_1
deny_info http://ngtech.home/blockPage/?url=%u blacklist_regex_list_1
deny_info http://ngtech.home/blockPage/?url=%u blacklist_regex_list_2
deny_info http://ngtech.home/blockPage/?url=%u yt_urls_blacklist_regex_list
deny_info http://ngtech.home/blockPage/?url?%u yt_blacklist_helper
deny_info http://ngtech.home/blockPage/?url?%u yandex_bl_checker_helper
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access allow localnet manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320
http_port 13129 intercept
https_port 13128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB  cert=/etc/squid/ssl_cert/myCA.pem
http_port 23128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB  cert=/etc/squid/ssl_cert/myCA.pem
sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/ssl_db -M 16MB
sslcrtd_children 10
acl NoBump_server_regex ssl::server_name_regex -i "/etc/squid/no-ssl-bump-regex.list"
acl NoBump_server_regex_by_urls_domain ssl::server_name_regex -i "/etc/squid/no-ssl-bump-urls-domains-regex.list"
acl NoBump_server_name ssl::server_name "/etc/squid/no-ssl-bump-server-name.list"
acl NoBump_dst dst "/etc/squid/no-ssl-bump-server-dst-addresses.list"
acl NoBump_certificate_fingerprint server_cert_fingerprint "/etc/squid/no-ssl-bump-server-fingerprint.list"
acl tls_to_splice any-of NoBump_server_name NoBump_server_regex_by_urls_domain NoBump_server_regex NoBump_dst NoBump_certificate_fingerprint
acl Bump_server_regex ssl::server_name_regex -i "/etc/squid/ssl-bump-regex.list"
acl Bump_server_regex_by_urls_domain ssl::server_name_regex -i "/etc/squid/ssl-bump-urls-domains-regex.list"
acl Bump_server_name ssl::server_name "/etc/squid/ssl-bump-server-name.list"
acl Bump_dst dst "/etc/squid/ssl-bump-server-dst-addresses.list"
acl tls_to_bump any-of Bump_server_name Bump_server_regex_by_urls_domain Bump_server_regex Bump_dst sni_matcher_helper yandex_bl_checker_helper
ssl_bump peek tls_s1_connect
ssl_bump splice tls_to_splice
ssl_bump stare tls_s2_client_hello
ssl_bump bump tls_to_bump
strip_query_terms off
logformat localsquid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt %ssl::>sni
access_log daemon:/var/log/squid/access.log localsquid