NethServer 6

• returning back a 302 HTTP code, the client than takes care to do the new request
• faking the client and loading the block page then returning it back to the client

See this document for more info: http://wiki.squid-cache.org/Features/Redirectors

First scenario has one major drawback: the client must always be allowed to access the block page. This isn't true if the block page has the IP address of the green interface and the client does requests from the blue network. Beside this, if the client can't access sites with IP addresses (squidGuard ip-addr acl), the browser is forced to an infinite loop.
The second scenario addresses above problems, but it doesn't work correctly with TPROXY because part of the TCP connection is made by the proxy itself, so the client can't display the block page.

The best solution is to switch to a transparent proxy implementation based on DNAT and use the second scenario for squidGuard configuration.

• nethserver-squidguard-1.0.5-36.0gitef146c2d.ns6.noarch.rpm
• nethserver-squid-1.2.0-18.0gitcfbd3944.ns6.noarch.rpm

• On a clean enable the proxy in transparent mode (or manual, but remember to configure the client)
• Configure a domain inside the black list and one inside the white list
• Check the client can access the one in white list and not the one in black list
• Check the client can't access sites using the IP address (blocked for default)

• Create a host with the IP address of the client you will use for tests
• Create a custom category with some domains
• Create a new filter and select the new category
• Select "Block all, allow selected content* option
• Create a new profile with the new host and the new filter
• Check the client can browse only sites inside the selected category

• Create a host with the IP address of the client you will use for tests
• Create a custom category with some domains
• Create a new filter and select the new category
• Select "Allow all, block selected content* option
• Create a new profile with the new host and the new filter
• Check the client can't browse sites inside the selected category

• Repeat test 3 enabling and disabling global white/black lists

• Configure the proxy as authenticated
• Repeat tests 2 and 3
• Remember to edit the profile and select a user in the "Who" field

• Free your imagination and try obscure and uncommon option combinations

Fragment for default profile in sguidguard configuration is missing.

test case 1 : ok
test case 2 : ok but blocked sites are not logged on urlfilter.log (may be this is the normal behavior in this filtering mode)
test case 3 : ok
test case 4 : global whitelist override doesn't work (can't enable website access using the global whitelist)
test case 5: auth with local users: the authentications work, but I can't choose users when configuring profiles, just hosts and hosts groups

test case 2 : ok but blocked sites are not logged on urlfilter.log (may be this is the normal behavior in this filtering mode)

Yes, it is.

test case 4 : global whitelist override doesn't work (can't enable website access using the global whitelist)

What is the configuration? Can you paste the extract from squidGuard.conf and contentfilter db?

With this configuration, if a site is inside a blocked category and inside the whitelist, the site is still blocked. Should the whitelist always win? Even over custom categories?

[root@localhost ~]# db contentfilter show
blocked=category
    Description=
    Domains=www.nethesis.it
default=filter
    BlackList=enabled
    BlockAll=disabled
    BlockFileTypes=disabled
    BlockIpAccess=enabled
    Categories=blocked
    Description=Default filter
    Removable=no
    WhiteList=enabled
default_profile=profile
    Description=Default profile
    Filter=filter;default
    Removable=no

Extract from squidGuard.conf:

    default {
        pass !blocked  !in-addr  whitelist  !blacklist  all
        redirect     http://192.168.5.246/cgi-bin/nethserver-block.cgi?clientaddr=%a&clientname=%n&clientident=%i&srcclass=%s&targetgroup=%t&url=%u
    }

test case 5: auth with local users: the authentications work, but I can't choose users when configuring profiles, just hosts and hosts groups

I can't reproduce the problem. Have you used the latest package? Current web interface always displays hosts and users, no matter how the proxy is configured.

Applied in changeset nethserver-httpd-admin|abe4c0f7a037ec685daa8683089929ebada7e75f.

Implementation changed: now whitelist has priority over blacklist and custom categories.

• nethserver-squidguard-1.0.5-66.0git338d5945.ns6.noarch.rpm

Please, repeat test case 4.

The problem should now be fixed.

• nethserver-squidguard-1.0.5-67.0git7224113f.ns6.noarch.rpm

Again, repeat test case 4.

• nethserver-squidguard-1.1.0-1.ns6.noarch.rpm