Linux – Squid: how to block websites for a particular IP address

Configure your firewall to default deny for all office traffic unless specifically allowed.

Require all Web traffic to route through your proxy.

If your users are unable to access the Internet directly, it will be substantially more difficult for them to use advanced protocols like BitTorrent.

While using SQUID acls will be substantially more limited in scope and be easily circumvented, you could use something like:

acl extensiondeny url_regex -i "/etc/squid/extensiondeny"
acl download method GET
http_access deny extensiondeny download
http_access deny extensiondeny

Within "/etc/squid/extensiondeny":

\.torrent$

For more information see:

http://www.squid-cache.org/Doc/config/acl/

If you want to AVOID completely squid, adding exceptions to the transparent proxy iptables redirect rule is way.

You can, however, create an acl in squid for the always_direct directive. From the squid docs:

acl local-servers dstdomain my.domain.net
always_direct allow local-servers

It doesn't work in all cases, sometimes just avoiding the proxy completely will do.

EDIT: If you use something like shorewall you can create lists that make the exception for the redirect rule easier to manage, but it may be too overkill.