I have a Cisco 871w router that provides my SOHO location internet access. I have a proxy/filtering solution as well (Dansguardian installed on an Ubuntu server). I want to require that all web-bound (port 80/443) traffic goes through the proxy, but need to provide some exceptions as certain OK sites don’t work via the proxy. I have created an access-list that successfully keeps non-proxy traffic from reaching the internet, but it doesn’t allow exceptions by domain name (maintaining individual destination IPs as exceptions would be highly unmanageable).
I’ve looked into Cisco IOS URL filtering, but it doesn’t seem to allow permits based on IP address and only blocks or allows entire web sites regardless of source address.
The access-list is below. Does anyone have any ideas on how to accomplish this? Thanks.
ip access-list extended proxy
permit tcp host 192.168.254.253 any eq 80
deny tcp any any eq 80
permit tcp host 192.168.254.253 any eq 443
deny tcp any any eq 443
permit ip any any
Obviously, the proxy server is 192.168.254.253.
IOS version: 12.4(15)T1
(c870-advipservicesk9-mz.124-15.T1.bin)