SmartFilter blocking with ACLs

About this section

This section contains a few examples of how you might use ACL rules with SmartFilter.

Before setting ACLs for SmartFilter

Before setting ACLs for SmartFilter, you must configure basic SmartFilter options, as described in Basic SmartFilter options. If SmartFilter is not enabled, NetCache ignores SmartFilter ACLs. Additionally, if you specify a category in your ACL that is not applicable to the SmartFilter version selected on the SmartFilter page, NetCache will ignore the rule.

Ways of configuring ACLs for SmartFilter

Methods of configuring ACLs for SmartFilter are shown in the following table.

Method	Description
Create standard HTTP ACL rules on the Access Controls pages (manually entered ACL rules)	This method enables you to use a full suite of building blocks for creating ACLs. For example, you can allow some users access to specific URLs and deny other users; you can deny or allow access to specific URLs. This method requires sound knowledge of ACL building blocks and syntax.
Use the ACL wizard for SmartFilter	You can allow some URLs in SmartFilter categories that you have blocked globally. The ACL wizard can be used to allow only URLs containing phrases that you specify. This method is a simple way of creating ACLs because it does not require knowledge of ACL building blocks and syntax. The Exceptions to Full Category Blocking option on the SmartFilter page is the ACL wizard.

SmartFilter restrictions are checked after ACLs

NetCache invokes restrictions associated with SmartFilter in the following order:

Standard ACLs (that is, ACLs set on the Access Controls pages) or ACL rules set through the ACL wizard (that is, the Exceptions to Full Category Blocking option on the SmartFilter page).
NetCache evaluates the settings in the Exceptions to Full Category Blocking option after the standard ACLs.
Any category blocking that you might have set for user authentication groups.
Category restrictions set on the SmartFilter page.

Examples of when you might use a SmartFilter ACL

The benefit of NetCache invoking ACL rules before checking SmartFilter category restrictions is that you can set ACL rules to allow exceptions to the categories for which you have blocked access. For example, after you enable SmartFilter and specify content categories to be restricted, you could create an ACL rule to

Allow access to a specific URL that SmartFilter would block because it matches a category that you have blocked
For instructions on how to exclude a URL from SmartFilter blocking, see the Appliance Manager online Help.
Allow a specific user access to a content category that you have blocked. (This is not possible to set up with the ACL wizard.)
For instructions on how to allow a specific user access to a blocked SmartFilter category, see the Appliance Manager online Help.

Examples of ACL rules with the SmartFilter ACL wizard

Assume that you have blocked the category Travel, but you wanted to allow access to the Web site http://www.earthwatch.org. You could enter any of the following in the Exceptions to Full Category Blocking option on the SmartFilter page to allow access to the http://www.earthwatch.org Web site:

http://www.earthwatch.org
www.earthwatch.org
earthwatch.org

If you enter a phrase, it must be an exact match. The phrase "earth watch" does not return http://www.earthwatch.org because of the embedded white space. However, the phrase "earthwatch" returns http://www.earthwatch.org.

Examples of standard ACL rules with the SmartFilter ACL wizard

The following examples show ACL rules that exempt specific URLs from SmartFilter blocking.

Example 1:

The following rule shows how to specify either a URL string or a regular expression of a set of URLs to be exempted from SmartFilter blocking:

allow url-prefix http://www.corp.com

This rule explicitly allows access to a URL blocked by SmartFilter for all users of the NetCache service.

Example 2:

The following rule shows how to specify an IP address or range of IP addresses, in addition to a regular expression of a set of URLs, to be exempted from SmartFilter blocking:

allow client-ip 128.125.51 and url-prefix http://www.corp.com

This rule explicitly allows access to a URL only for specified clients.

See Chapter 2, Access Control, for details about ACLs.