Mailing-List: contact users-help@trafficserver.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@trafficserver.apache.org
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Subject: Re: forward proxy - Restricting domains.
From: James Peach <jpeach@apache.org>
In-Reply-To: <BC62E39D-95A5-42AD-BE22-450A83429EC3@collectivei.com>
Date: Fri, 9 Jan 2015 08:22:02 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <FE87123C-C400-4015-A0FB-9CDD34B72F19@apache.org>
References: <A2294A53-C8EF-4286-8A1D-B141D0518EC6@collectivei.com>
 <7C85D88C-A69C-4C11-943D-52746AA1BF59@apache.org>
 <WM!fa12dae57ec9bf8eb029af626d109f5ca5cf356aa9e178ea5f5cd0291b7a0b6271295c1f248e4cc8f00423d9058238b6!@asav-1.01.com>
 <BC62E39D-95A5-42AD-BE22-450A83429EC3@collectivei.com>
To: users@trafficserver.apache.org


> On Jan 9, 2015, at 8:00 AM, Paul Tader <ptader@collectivei.com> wrote:
>=20
> Hmm, I didn=E2=80=99t think about a DNS blackhole.  For now I=E2=80=99m =
looking into additional remap files using the =E2=80=9C.include=E2=80=9D =
directive in remap.config but I get these errors after running =
traffic_line -x
>=20
> [Jan  9 15:57:04.270] Server {47752783210240} WARNING: Could not add =
rule at line #126; Aborting!
> [Jan  9 15:57:04.270] Server {47752783210240} WARNING: [ReverseProxy] =
Unknown directive ".include" at line 126
> [Jan  9 15:57:04.270] Server {47752783210240} WARNING: something =
failed during BuildTable() -- check your remap plugins!
> [Jan  9 15:57:04.270] Server {47752783210240} WARNING: failed to =
reload remap.config, not replacing!
>=20
> My remap.conf has these two lines:
>=20
> .include /etc/trafficserver/filters.config
> .include /etc/trafficserver/set1.remap.config
>=20
> =E2=80=A6which is odd because the documentation states:
>=20
> "The .include directive allows mapping rules to be spread across =
multiple files. The argument to the .include directive is a list of file =
names to be parsed for additional mapping rules. "
>=20
> =
http://trafficserver.readthedocs.org/en/latest/reference/configuration/rem=
ap.config.en.html

Does your version of ATS match the version of the docs?

>=20
>=20
>=20
>=20
>> On Jan 8, 2015, at 8:56 PM, Leif Hedstrom <zwoop@apache.org> wrote:
>>=20
>>=20
>>> On Jan 8, 2015, at 10:53 AM, Paul Tader <ptader@collectivei.com> =
wrote:
>>>=20
>>> We have a forward only proxy server configured. How can I restrict a =
internal IP address or IP address range to only be able to proxy certain =
top level domains (ie google.com, yahoo.com, etc)?  I=E2=80=99ve read a =
lot on remapping, but I don=E2=80=99t think that is the correct =
approach.
>>=20
>>=20
>> DNS blackholing as suggested seems like a reasonable solution. If =
your list of domains is smallish, then something in remap.config might =
work as well. I=E2=80=99ve done this in the past, blocking all but a few =
HTTPS sites (via setting remap.required to 1 in records.config). The =
other option is to allow all sites, but list the ones that you intend to =
block (map them to some nonexistent domain or IP, e.g. 10.0.0.0).
>>=20
>> Fwiw, remap rules like this with CONNECT methods only works in 5.0.0 =
and later.
>>=20
>> =E2=80=94 Leif
>>=20
>=20