How to Install and Configure Proxy Server with Squid3 on Ubuntu Server 12.04 LTS

Squid is a popular appliaction that used as web proxy cache server which provides proxy and cache services for HTTP, HTTPS, FTP, gopher and other popular network protocols. Squid can implement caching of Domain Name Server (DNS) lookups and caching and proxying Secure Sockets Layer (SSL) requests, and perform transparent caching.in addition, Squid also supports a wide variety of caching protocols, such as Internet Cache Protocol (ICP), the Hyper Text Caching Protocol (HTCP), the Cache Array Routing Protocol (CARP), and the Web Cache Coordination Protocol (WCCP)

The Squid proxy cache server is an excellent solution to a variety of proxy and caching server needs, and scales from the branch office to enterprise level networks while providing extensive, granular access control mechanisms and monitoring of critical parameters via the Simple Network Management Protocol (SNMP). When selecting a computer system for use as a dedicated Squid proxy, or caching servers, ensure your system is configured with a large amount of physical memory, as Squid maintains an in-memory cache for increased performance

On This tutorial I will demonstrate how to installing and configure Proxy server with Squid3 on Ubuntu server 12.04. Here’s basic features squid3 :

  • Connection Pinning (for NTLM Auth Passthrough)
  • Native IPv6
  • Quality of Service (QoS) Flow support
  • Native Memory Cache
  • SSL Bump (for HTTPS Filtering and Adaptation)
  • TProxy v4.1+ support
  • eCAP Adaptation Module support
  • Error Page Localization
  • Follow X-Forwarded-For support
  • X-Forwarded-For options extended (truncate, delete, transparent)
  • Peer-Name ACL
  • Reply headers to external ACL.
  • ICAP and eCAP Logging
  • ICAP Service Sets and Chains
  • ICY (SHOUTcast) streaming protocol support
  • HTTP/1.1 support on connections to web servers and peers.
  • More feature here

Installing Squid3

Log in on Ubuntu Server, then type command below to Install squid2 in ubuntu server 12.04:

sudo apt-get install squid3 ccze

Configure Squid3

Create directory for Cache, on this case cache directory placed on directory /home/precise/cache/. Then change the permissions cache directory to 777 and owner proxy:proxy

sudo mkdir -p /home/precise/cache/
sudo chmod 777 /home/precise/cache/
sudo chown proxy:proxy /home/precise/cache/

Before editing squid configuration, Make a backup of your /etc/squid3/squid.conf file for future reference. Squid.conf has nearly all the options listed and it is recommended to go through that file to know more about squid options.

sudo cp /etc/squid3/squid.conf /etc/squid3/squid.conf.origin
sudo chmod a-w /etc/squid3/squid.conf.origin

Now edit /etc/squid3/squid.conf file, delete all options in /etc/squid3/squid.conf then replace with squid3 configuration below

sudo nano /etc/squid3/squid.conf

Squid3 configuration:

# ACCESS CONTROLS OPTIONS
# ====================
#
acl QUERY urlpath_regex -i cgi-bin \? \.php$ \.asp$ \.shtml$ \.cfm$ \.cfml$ \.phtml$ \.php3$ localhost
acl all src
acl localnet src 10.0.0.0/8
acl localnet src 192.168.1.0/24 # Your network here
acl localhost src 127.0.0.1/32
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535
acl sslports port 443 563 81 2087 10000
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
acl ym dstdomain .messenger.yahoo.com .psq.yahoo.com
acl ym dstdomain .us.il.yimg.com .msg.yahoo.com .pager.yahoo.com
acl ym dstdomain .rareedge.com .ytunnelpro.com .chat.yahoo.com
acl ym dstdomain .voice.yahoo.com
acl ymregex url_regex yupdater.yim ymsgr myspaceim
#
http_access deny ym
http_access deny ymregex
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports
http_access allow localhost
http_access allow localnet
http_access deny all
#
# NETWORK OPTIONS
# —————
#
http_port 3128
#
# OPTIONS WHICH AFFECT THE CACHE SIZE
# ==============================
#
cache_mem 8 MB
maximum_object_size_in_memory 32 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir aufs /home/precise/cache 10000 14 256
maximum_object_size 128000 KB
cache_swap_low 95
cache_swap_high 99
#
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
# ==================================
#
access_log /var/log/squid3/access.log
cache_log /cache/cache.log
#cache_log /dev/null
cache_store_log none
logfile_rotate 5
log_icp_queries off
#
# OPTIONS FOR TUNING THE CACHE
# ========================
#
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080 reload-into-ims
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i \.(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i \.(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i \.(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i \.(html|htm|css|js)$ 1440 75% 40320
refresh_pattern -i \.index.(html|htm)$ 0 75% 10080
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 1440 90% 10080
#
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
store_avg_object_size 13 KB
#
# HTTP OPTIONS
# ===========
vary_ignore_expire on
#
# ANONIMITY OPTIONS
# ===============
#
request_header_access From deny all
request_header_access Server deny all
request_header_access Link deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
#
# TIMEOUTS
# =======
#
forward_timeout 240 second
connect_timeout 30 second
peer_connect_timeout 5 second
read_timeout 600 second
request_timeout 60 second
shutdown_lifetime 10 second
#
# ADMINISTRATIVE PARAMETERS
# =====================
#
cache_mgr ninja
cache_effective_user proxy
cache_effective_group proxy
httpd_suppress_version_string on
visible_hostname ninja
#
ftp_list_width 32
ftp_passive on
ftp_sanitycheck on
#
# DNS OPTIONS
# ==========
#
dns_timeout 10 seconds
dns_nameservers 192.168.1.1 8.8.8.8 8.8.4.4 # DNS Server
#
# MISCELLANEOUS
# ===========
#
memory_pools off
client_db off
reload_into_ims on
coredump_dir /cache
pipeline_prefetch on
offline_mode off
#
#Marking ZPH
#==========
zph_mode tos
zph_local 0x04
zph_parent 0
zph_option 136
### END CONFIGURATION ###

Create swap directory,

squid3 -z

Restart squid3:

sudo /etc/init.d/squid3 restart

Reference:

Tags: #Cache #Proxy Server #Squid3 #Ubuntu Server 12.04

How to Upgrade Ubuntu Server 12.04 to Ubuntu Server 14.04 LTS
How to Upgrade Ubuntu Server 12.04 to Ubuntu Server 14.04 LTS
This tutorial will describes how to upgrade
  • Pingback: Links 2/6/2012: SolusOS 1.1 Released, Fedora 17 Reviews | Techrights()

  • dhaval

    Thank you Very Much……..>!

  • johan

    hi,
    thanks for your tuts
    unfortunately it’s not work :(
    i do exactly what you write here (copy & paste) but it’s not work (access.log was empty)
    any suggestion ?

  • http://www.facebook.com/Nikita.M.Bogdanov Nikita Bogdanov

    Thank you – this is great! Just what I was looking for :)

    Quick question though: When editing the Squid3 configuration (“Now edit /etc/squid3/squid.conf file, delete all options in /etc/squid3/squid.conf then replace with…”) can we simply delete all 5000+ lines of configuration file – most of which seem to be comments – already there and replace with the options you mention above, or do we need to selectively replace particular options sections?

    • ubuntusg

      sudo cp /etc/squid3/squid.conf /etc/squid3/squid.conf.origin
      sudo chmod a-w /etc/squid3/squid.conf.origin

      create new file with file name squid.conf
      —————————————-
      sudo touch /etc/squid3/squid.conf
      sudo nano /etc/squid3/squid.conf

      copy and paste the configuration then save and exit..

  • d2

    Best tutorial I’ve seen so far. Question tho, it seems that thru 127.0.0.1:3128 its running good.. but if I test it with my public ip address (wich is the goal of this server) I get connection refused. On my router I have tcp 80, 8080 and 3128 allowed. Also SSL 443. Any suggestions? Thanks!

  • louis c

    I am trying to create cluster out of some old pcs so I can tinker and experiment. The master has 2 net cards and one (eth1) is connected to net through dhcp to home network and the other (eth0) is static 10.0.0.1. The other pcs are connected to master with a switch. I need to be able to install software via apt-get on slave machines. I followed the instructions in detail with one exception: I commented out “acl localnet src 192.168.1.0/24 # Your network here” as the router for the home network is 192.168.1.1. The slave pcs do not connect. Any suggestions

  • Ismail

    hello you added a zph marking .but is not supported in squid3 and it give me a error so can you tell how i can use it in squid3 ..thanks you

  • mrmac

    hi, best guide so far but you didn’t tell what does the configuration do? eg. you block yahoo messenger etc…

  • Diego Xirinachs

    This no longer works, ZPH options are obsolete and ubuntu complains about some regular expressions both on the first acl QUERY and on some refresh_pattern directives. You can get this to work by removing those lines squid complains about.

  • Teoma

    The config works if you comment out the ‘zph’ options it complains about and also change the line where it says “#Your network here” to match your own network e.g. 192.168.0.0/24
    The acl/ym settings etc are optional and some of that may need altering to suit your own needs.

    PS: thanks for the config! got my server running in minutes

  • http://twitter.com/KegRaider Troy Starkey

    Thankyou, after commenting out ZPH bits and fixing the log directory, it works great. “squid3 -k reconfigure” will tell you the failed lines

  • Purna Irawan

    All master saya mau nanya kenapa ya proxy saya kok saat play video hasilnya gag sama dengan yang may di play ,,<!!
    TOlong pencerahanya

  • TELO TELO

    great tuts

    unfortunately i always get TCP_DENIED/403
    any suggestion ??

  • TJ

    For some reason I have no https access

  • GrandMaster

    Any had any success getting https working???

  • dhrgam

    hi i get error in facebook.com https site error how can i solve it

  • Dhoni G. Daradjat

    hi.. im already build proxy based on your tutorial.. question is why i never see a HIT in the access list..
    it will be a waste if i build proxy but it can cache anything…

    FYI, when im using minimal conf (only acl and log setup), i can see some MEM_HIT.
    could you give some sollution for that?

    thx

  • Giovanni

    Hi, he realizado la configuración y va de maravilla… lo único que miro raro… es que apenas mando a cargar una página se demora unos cuantos segundos… es algún parámetro de congifuración??? Gracias

  • Rambabu Saini

    Hello friends…
    i have installed ubuntu 13.10 and squid 3.3.8. when i starts squid, it is blocking all websites.
    plz send squid.conf file with minimum settings.

  • Blog-IT-KB

    Step-By-Step (10 parts) – Install and configure Squid 3.3 on Ubuntu Server 14.04 LTS (in Hyper-V Gen2 VM) with Kerberos and NTLM Auth via Active Directory.
    Link to part 1 – http://blog.it-kb.ru/2014/06/16/forward-proxy-squid-3-3-on-ubuntu-server-14-04-lts-part-1-install-os-on-hyper-v-generation-2-vm/

  • Unomi Dontu

    after type squid3 -z message” ALERT: setgid: (1) Operation not permitted
    WARNING: cannot write log file: /cache/cache.log
    /cache/cache.log: no such file or directory”

    can you also show how to test if proxy is working?

    thanks

Must read×

Top