Upload files to ''

Dockerfile

@@ -0,0 +1,12 @@
+FROM debian:buster
+
+RUN apt-get update -y && apt-get install squid nano -y
+
+ADD *.txt /etc/squid/
+ADD *.css /etc/squid/
+ADD *.conf /etc/squid/
+
+EXPOSE 3128/tcp
+EXPOSE 3128/udp
+
+CMD ["/usr/sbin/squid", "-NYCd1"]

README.md

@@ -1,3 +1,56 @@
-# squid-whitelist
+# Docker Squid Proxy - Strict Whitelist
 
-Squid Proxy server in Docker.
+## [Docker Hub Repository](https://hub.docker.com/r/signaln9ne/squidproxy-strict-whitelist)
+
+![GitHub last commit](https://img.shields.io/github/last-commit/signal-9/docker-squid-whitelist?color=blue&style=for-the-badge)
+![Docker Pulls](https://img.shields.io/docker/pulls/signaln9ne/squidproxy-strict-whitelist?style=for-the-badge)
+
+## docker-compose
+```
+---
+version: "3"
+services:
+  squidproxy:
+    image: signaln9ne/squidproxy-strict-whitelist:latest
+    container_name: squidproxy
+    volumes:
+      - squid-proxy:/config
+    ports:
+      - 3128:3128
+    restart: unless-stopped
+volumes:
+  squid-proxy:
+```
+
+## Build the image
+
+```
+git clone https://github.com/signal-9/docker-squid-whitelist.git
+cd docker-squid-whitelist
+```
+
+Edit ```/etc/squid/squid.conf```, changing the values for:
+```
+acl localnet src 192.168.1.0/24    # Change to your own network
+dns_nameservers 9.9.9.9            # DNS servers (change if you want)
+```
+
+and ```/etc/squid/whitelist.txt```, adding or removing domains as you wish.  Any domains in this list will be reachable, any that are not will be denied.
+
+Once the container is running, you can edit these documents in ```/etc/squid``` as needed.  ```whitelist.txt``` will need the most adjusting.
+
+## Run the container
+
+```
+sudo docker build -t signaln9nesquidproxy .
+docker volume create squid
+docker run -dit \
+    -p 3128:3128 \
+    --name=squidproxy \
+    --restart=always \
+    -v squid:/etc/squid \
+    signaln9nesquidproxy
+```
+Point your client machines to the container IP port 3128.  Only approved domains in the ```whitelist.txt``` file should be accessible.
+
+You can ```tail -f /var/log/squid/access.log``` to see what domains are being approved, denied, etc.

keywordblock.txt

@@ -0,0 +1 @@
+proxy

squid.conf

@@ -0,0 +1,39 @@
+acl localnet src 192.168.1.0/24		# Change to your own network
+
+acl SSL_ports port 443
+acl Safe_ports port 80		
+acl Safe_ports port 21		
+acl Safe_ports port 443		
+acl Safe_ports port 70		
+acl Safe_ports port 210		
+acl Safe_ports port 1025-65535	
+acl Safe_ports port 280		
+acl Safe_ports port 488		
+acl Safe_ports port 591		
+acl Safe_ports port 777		
+acl CONNECT method CONNECT
+http_access deny !Safe_ports
+http_access deny CONNECT !SSL_ports
+http_access allow localhost manager
+http_access deny manager
+acl whitelist dstdomain "/etc/squid/whitelist.txt"
+http_access allow whitelist
+http_access deny all
+http_access deny all
+acl keyword_block url_regex "/etc/squid/keywordblock.txt"
+http_access deny keyword_block
+http_access deny all
+http_access allow localhost
+http_access allow localnet
+http_access deny all
+
+http_port 3128				# Port to listen on
+
+coredump_dir /var/spool/squid
+refresh_pattern ^ftp:		1440	20%	10080
+refresh_pattern ^gopher:	1440	0%	1440
+refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
+refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
+refresh_pattern .		0	20%	4320
+
+dns_nameservers 9.9.9.9			# DNS servers (change if you want)

whitelist.txt

@@ -0,0 +1,19 @@
+.google.com
+.googleapis.com
+ocsp.pki.goog
+fonts.gstatic.com
+
+.duckduckgo.com
+.ddg.gg
+
+.ecs.office.com
+.windowsupdate.com
+.events.data.microsoft.com
+assets.msn.com
+.windows.com
+.officeapps.live.com
+.officeclient.microsoft.com
+.login.live.com
+.msauth.net
+.azureedge.net
+.live.net