From 665eb6ec7cb073fecd291965b8b902616d40c815 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 13 Aug 2024 09:24:14 +0100 Subject: [PATCH] add new acl and rules to restrict ports --- ansible/roles/win_proxy/vars/rules.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ansible/roles/win_proxy/vars/rules.yml b/ansible/roles/win_proxy/vars/rules.yml index 37f5266..238c6e8 100644 --- a/ansible/roles/win_proxy/vars/rules.yml +++ b/ansible/roles/win_proxy/vars/rules.yml @@ -1,4 +1,13 @@ squid_acls: + - name: Safe_ports + classifier: port + value: 80 + - name: Safe_ports + classifier: port + value: 443 + - name: SSL_ports + classifier: port + value: 443 - name: os_external classifier: src value: "10.24.0.0/16" @@ -10,6 +19,10 @@ squid_acls: value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\"" squid_rules: + - acl: "!Safe_ports" + decision: deny + - acl: "CONNECT !SSL_ports" + decision: deny - acl: to_localhost decision: deny - acl: os_external allowed_domains