squid+delay pools+dansguardian

[neomoto]

Настроил на прокси-сервере раздачу интернета через squid. Так как канал всего 128 кб/с, нашел как распределять канал, настроил delay pools так, что все файлы, которые начинает като-то качать, отдаются со скоростью 2 кб/с. Потом захотелось поставить dansguardian, т.к. учебное заведение, и не надо детишкам всякое смотреть. Настроил, все отлично, фильтруется, я рад, но! Если трафик идет squid+delay pools+dansguardian, то delay pools-ы работают совершенно непонятным образом, а точнее вообще не работают, юзеры качают все на максимальной скорости, забивая канал. Без dansguardian-а все отлично режется. Возможно, я что-то неправильно настроил, т.к. можно сказать новичок в этом деле.. Сразу признаюсь, конфигурил через webmin
Конфиги сквида и dansguardian-a:

(Нажмите, чтобы показать/скрыть)

# Squid normally listens to port 3128
http_port 3128
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8


acl kabinet19 src 192.168.0.21-192.168.0.30/255.255.255.255 # RFC1918 possible internal network
acl kabinet21 src 192.168.0.1-192.168.0.10/255.255.255.255 # RFC1918 possible internal network
acl admins src 192.168.0.12-192.168.0.20/255.255.255.255 # RFC1918 possible internal network
acl files urlpath_regex -i \.(exe|mp3|7z|pdf|djvu|ogg|zip|rar|avi|mpeg|mpe|mpg|qt|wmv|rm|iso|raw|wav|mov|jpg|jpeg|gif|png|jar|avi|doc|ppt|cab)$

acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

hierarchy_stoplist cgi-bin ?
access_log /var/log/squid/access.log squid

refresh_pattern ^ftp:      1440   20%   10080
refresh_pattern ^gopher:   1440   0%   1440
refresh_pattern -i (/cgi-bin/|\?) 0   0%   0
refresh_pattern (Release|Package(.gz)*)$   0   20%   2880
refresh_pattern .      0   20%   4320
refresh_pattern -i .gif$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .png$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .jpg$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .jpeg$ 43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .pdf$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .zip$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .tar$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .gz$   43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .tgz$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .exe$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .prz$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .ppt$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .inf$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .swf$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .mid$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .wav$  43200 100% 43200 override-lastmod override-expire
refresh_pattern -i .mp3$  43200 100% 43200 override-lastmod override-expire

acl shoutcast rep_header X-HTTP09-First-Line ^ICY\s[0-9]
upgrade_http0.9 deny shoutcast

acl apache rep_header Server ^Apache
acl other_school src 192.168.0.31-192.168.0.254/255.255.255.255
acl images url_regex -i .jpg .png .gif .tiff .raw
icp_access allow kabinet19
icp_access allow kabinet21
icp_access allow admins
icp_access allow other_school
icp_access deny all
http_access allow localhost
http_access allow admins
http_access allow other_school
http_access allow kabinet21
http_access allow kabinet19
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all
broken_vary_encoding allow apache

extension_methods REPORT MERGE MKACTIVITY CHECKOUT



delay_pools 1
delay_class 1 2

delay_access 1 deny admins
delay_access 1 allow files
delay_parameters 1 -1/-1 2000/4000
delay_initial_bucket_level 85


hosts_file /etc/hosts

coredump_dir /var/spool/squid
redirect_children 3

(Нажмите, чтобы показать/скрыть)

# DansGuardian config file for version 2.10.1.1

reportinglevel = 3

languagedir = '/etc/dansguardian/languages'

language = 'russian-1251'

loglevel = 2

logexceptionhits = 2

logfileformat = 1


filterip = 192.168.0.11

filterport = 8080

proxyip = 127.0.0.1

proxyport = 3128

accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'

nonstandarddelimiter = on

usecustombannedimage = on
custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'


filtergroups = 1
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'


bannediplist = '/etc/dansguardian/lists/bannediplist'
exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'

showweightedfound = on

weightedphrasemode = 2


urlcachenumber = 1000

urlcacheage = 900

scancleancache = on

phrasefiltermode = 2

preservecase = 2

hexdecodecontent = on

forcequicksearch = on

reverseaddresslookups = off

reverseclientiplookups = off

logclienthostnames = off

createlistcachefiles = on

maxuploadsize = -1

maxcontentfiltersize = 256

maxcontentramcachescansize = 2000

maxcontentfilecachescansize = 20000

filecachedir = '/tmp'

deletedownloadedtempfiles = on

initialtrickledelay = 20

trickledelay = 10

downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'

downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'

contentscannertimeout = 60

contentscanexceptions = off

recheckreplacedurls = off

forwardedfor = off

usexforwardedfor = off

logconnectionhandlingerrors = on

logchildprocesshandling = off

maxchildren = 120

minchildren = 8

minsparechildren = 4

preforkchildren = 6

maxsparechildren = 32

maxagechildren = 500

maxips = 0

ipcfilename = '/tmp/.dguardianipc'

urlipcfilename = '/tmp/.dguardianurlipc'

ipipcfilename = '/tmp/.dguardianipipc'

nodaemon = off

nologger = off

logadblocks = off

loguseragent = off

softrestart = off

mailer = '/usr/sbin/sendmail -t'

Чего хотел добиться - чтобы для всех, кроме группы admins, резалась скорость при acl files + чтобы работал dansguardian.
Пока получилось так: либо не режется трафик ни для кого вообще, либо, что странно, урезается как раз для админов, хотя в правиле пишу
delay_access 1 deny admins
delay_access 1 allow files
Я уже запутался, помогите!

[neomoto]

неужели никто с таким не сталкивался?

[arayakao]

не будет резаться трафик, так как squid получает запросы от dansguardian то бишь от localhost.