There is very good documentation in the site squid.visolve.com - it answers everything. However, for a brief description, what you have to do is allow explicitly what you want to pass through and then deny everything else (its safer).
The squid.conf file itself contains many access control lines. What you do is define 'acl's and apply allow or deny rules on them (you already know this).
Here is an example for your office:
acl all src 0.0.0.0/0.0.0.0
# the above line will be there in squid.conf
# add these lines for more control
acl mynetwork src 192.168.1.0/24 # put yours
acl exes urlpath_regex -i \.zip$ \.exe$ \.dll$
# this acl defines files ending with .exe, .zip
# and .dll, normally windows downloads
acl fullaccess src"/etc/squid/goodips" # filename
#in the file, put ip addresses one per line for #each ones that you want to provide extra #privilege and apply rules like:
http_access allow fullaccess
http_access deny exes
http_access allow mynetwork
http_access deny all
this particular setup allows all access for the ip addresses falling within the "goodips" file, allows all access except for downloads for others (the ones in mynetwork) and denies all access to the proxy server from anyone outside your network.
hope this helps.
this
