Добрый день!

Я использую локальный прокси сервер для туннелирования трафика от браузера через различние openvpn каналы (в зависимости от порта).

Сейчас появилась необходимость не "палить" локальный адрес за прокси как и само использование прокси.

В связи с этим вопрос - что мне нужно поменять в squid.conf для этого? Какие строки с 'reply_header_access' раскоментить для этого?

# AUTOGENERATED LINES
http_port 3131 name=3131
acl tasty3131 myportname 3131 src 10.12.0.58
http_access allow tasty3131
tcp_outgoing_address 10.12.0.58 tasty3131
http_port 3129 name=3129
acl tasty3129 myportname 3129 src 10.200.1.7
http_access allow tasty3129
tcp_outgoing_address 10.200.1.7 tasty3129
http_port 3128 name=3128
acl tasty3128 myportname 3128 src 10.44.0.7
http_access allow tasty3128
tcp_outgoing_address 10.44.0.7 tasty3128
http_port 3130 name=3130
acl tasty3130 myportname 3130 src 10.44.0.6
http_access allow tasty3130
tcp_outgoing_address 10.44.0.6 tasty3130
# AUTOGENERATED LINES

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
# example lin deb packages
#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
refresh_pattern .        0    20%    4320

#  TAG: request_header_access
#    Usage: request_header_access header_name allow|deny [!]aclname ...
#
#    WARNING: Doing this VIOLATES the HTTP standard.  Enabling
#    this feature could make you liable for problems which it
#    causes.
#
#    This option replaces the old 'anonymize_headers' and the
#    older 'http_anonymizer' option with something that is much
#    more configurable. This new method creates a list of ACLs
#    for each header, allowing you very fine-tuned header
#    mangling.
#
#    This option only applies to request headers, i.e., from the
#    client to the server.
#
#    You can only specify known headers for the header name.
#    Other headers are reclassified as 'Other'. You can also
#    refer to all the headers with 'All'.
#
#    For example, to achieve the same behavior as the old
#    'http_anonymizer standard' option, you should use:
#
#        request_header_access From deny all
#        request_header_access Referer deny all
#        request_header_access Server deny all
#        request_header_access User-Agent deny all
#        request_header_access WWW-Authenticate deny all
#        request_header_access Link deny all
#
#    Or, to reproduce the old 'http_anonymizer paranoid' feature
#    you should use:
#
#        request_header_access Allow allow all
#        request_header_access Authorization allow all
#        request_header_access WWW-Authenticate allow all
#        request_header_access Proxy-Authorization allow all
#        request_header_access Proxy-Authenticate allow all
#        request_header_access Cache-Control allow all
#        request_header_access Content-Encoding allow all
#        request_header_access Content-Length allow all
#        request_header_access Content-Type allow all
#        request_header_access Date allow all
#        request_header_access Expires allow all
#        request_header_access Host allow all
#        request_header_access If-Modified-Since allow all
#        request_header_access Last-Modified allow all
#        request_header_access Location allow all
#        request_header_access Pragma allow all
#        request_header_access Accept allow all
#        request_header_access Accept-Charset allow all
#        request_header_access Accept-Encoding allow all
#        request_header_access Accept-Language allow all
#        request_header_access Content-Language allow all
#        request_header_access Mime-Version allow all
#        request_header_access Retry-After allow all
#        request_header_access Title allow all
#        request_header_access Connection allow all
#        request_header_access All deny all
#
#    although many of those are HTTP reply headers, and so should be
#    controlled with the reply_header_access directive.
#
#    By default, all headers are allowed (no anonymizing is
#    performed).
#Default:
# none

#  TAG: reply_header_access
#    Usage: reply_header_access header_name allow|deny [!]aclname ...
#
#    WARNING: Doing this VIOLATES the HTTP standard.  Enabling
#    this feature could make you liable for problems which it
#    causes.
#
#    This option only applies to reply headers, i.e., from the
#    server to the client.
#
#    This is the same as request_header_access, but in the other
#    direction.
#
#    This option replaces the old 'anonymize_headers' and the
#    older 'http_anonymizer' option with something that is much
#    more configurable. This new method creates a list of ACLs
#    for each header, allowing you very fine-tuned header
#    mangling.
#
#    You can only specify known headers for the header name.
#    Other headers are reclassified as 'Other'. You can also
#    refer to all the headers with 'All'.
#
#    For example, to achieve the same behavior as the old
#    'http_anonymizer standard' option, you should use:
#
#        reply_header_access From deny all
#        reply_header_access Referer deny all
#        reply_header_access Server deny all
#        reply_header_access User-Agent deny all
#        reply_header_access WWW-Authenticate deny all
#        reply_header_access Link deny all
#
#    Or, to reproduce the old 'http_anonymizer paranoid' feature
#    you should use:
#
#        reply_header_access Allow allow all
#        reply_header_access Authorization allow all
#        reply_header_access WWW-Authenticate allow all
#        reply_header_access Proxy-Authorization allow all
#        reply_header_access Proxy-Authenticate allow all
#        reply_header_access Cache-Control allow all
#        reply_header_access Content-Encoding allow all
#        reply_header_access Content-Length allow all
#        reply_header_access Content-Type allow all
#        reply_header_access Date allow all
#        reply_header_access Expires allow all
#        reply_header_access Host allow all
#        reply_header_access If-Modified-Since allow all
#        reply_header_access Last-Modified allow all
#        reply_header_access Location allow all
#        reply_header_access Pragma allow all
#        reply_header_access Accept allow all
#        reply_header_access Accept-Charset allow all
#        reply_header_access Accept-Encoding allow all
#        reply_header_access Accept-Language allow all
#        reply_header_access Content-Language allow all
#        reply_header_access Mime-Version allow all
#        reply_header_access Retry-After allow all
#        reply_header_access Title allow all
#        reply_header_access Connection allow all
#        reply_header_access All deny all
#
#    although the HTTP request headers won't be usefully controlled
#    by this directive -- see request_header_access for details.
#
#    By default, all headers are allowed (no anonymizing is
#    performed).
#Default:
# none