Re: domain-based restrictions

} >Nice, but I prefer this way:
} >
} >acl localnet .my.domain.com
} >http_acces allow localnet
} >
} >so sorry it's not supported :(
}
} I think I agree with Alexander about this one, we (as a University) have
} approx. 25 class 'C' nets, so I would have to list a lot of nets, whilst a
} single 'acl domain' could cover all eventualities, even sub-domains.

Can't you aggregate any of these C's?

The problem is that 'acl domain' would require a reverse DNS lookup
on each incoming request, and that can be painful speedwise for
something like squid! I guess it could be coded in in a reasonably
fast method but it would cost for all incoming requests (not just
those in the mentioned domains).

        Nigel.

-- 
[ Nigel.Metheringham@theplanet.net   - Unix Applications Engineer ]
[ *Views expressed here are personal and not supported by PLAnet* ]
[ PLAnet Online : The White House          Tel : +44 113 251 6012 ]
[ Melbourne Street, Leeds LS2 7PS UK.      Fax : +44 113 2345656  ]