diff --git a/ansible/roles/win_proxy/vars/rules.yml b/ansible/roles/win_proxy/vars/rules.yml
index 37f5266..238c6e8 100644
--- a/ansible/roles/win_proxy/vars/rules.yml
+++ b/ansible/roles/win_proxy/vars/rules.yml
@@ -1,4 +1,13 @@
 squid_acls:
+  - name: Safe_ports
+    classifier: port
+    value: 80
+  - name: Safe_ports
+    classifier: port
+    value: 443
+  - name: SSL_ports
+    classifier: port
+    value: 443
   - name: os_external
     classifier: src
     value: "10.24.0.0/16"
@@ -10,6 +19,10 @@ squid_acls:
     value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\""
 
 squid_rules:
+  - acl: "!Safe_ports"
+    decision: deny
+  - acl: "CONNECT !SSL_ports"
+    decision: deny
   - acl: to_localhost
     decision: deny
   - acl: os_external allowed_domains