Mission
To configure squid for simple proxying without caching anything.
Use Cases
- When you want to have control on what people browse on your lan.
- When number of machine is more than the number of IP addresses you can afford to buy.
- When you want to help this holy world in saving some IPV4 addresses
Assumptions
- You have a machine connected directly to internet that you are going to use as a proxy server for other machines on your network.
- The machines on your network are using 192.168.0.0/16 as private address space. You can use anyone/multiple address spaces of the available but for this howto we assume 192.168.0.0/16 as the local network.
- The local IP address of the machine which will run squid proxy server is 192.168.36.204. You can have any IP, but for this howto we assume this.
How to proceed
First of all ensure that you have squid installed. After installing squid, you need to set access control in squid configuration file which resides in /etc/squid by default. Open /etc/squid/squid.conf and add/edit following lines according to your preferences. Few lines already exist in the configuration file, you can add the rest.
# The port on which squid will listen for requests http_port 8080 # If 'cgi-bin' or '?' is in query, squid should not check with neighbours'/parents' cache # and should go to target web-server. hierarchy_stoplist cgi-bin ? # If url contains 'cgi-bin' or '?', then it must not be cached acl QUERY urlpath_regex cgi-bin \? cache deny QUERY acl apache rep_header Server ^Apache broken_vary_encoding allow apache # Absolute path to squid access log. access_log /var/log/squid/access.log squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 # Access control list to control every IP address acl all src 0.0.0.0/0.0.0.0 # Access control list for source machine in LAN acl lan_src src 192.168.0.0/16 # Access control list for destination machine in LAN acl lan_dst dst 192.168.0.0/16 # Access control list to manage squid cache acl manager proto cache_object # Access control list to define IP address allowed for source localhost acl localhost src 127.0.0.1/255.255.255.255 # Access control list to define IP addresses allowed for localhost as destination acl to_localhost dst 127.0.0.0/8 # Access control list to define Safe ports that should be allowed by default acl SSL_ports port 443 563 1863 5190 5222 5050 6667 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Allow cache management only from localhost http_access allow manager localhost # Deny cache management from remote hosts http_access deny manager # Deny http access via all the ports which are not listed as safe http_access deny !Safe_ports # Deny all connections via all ports which are not listed as safe http_access deny CONNECT !SSL_ports # Allow http access from localhost http_access allow localhost # Allow http access from machines on LAN http_access allow lan_src http_access deny all http_reply_access allow all icp_access allow all # Deny caching for everyone so that there is not caching at all cache deny all coredump_dir /var/spool/squid # Never allow direct connection to machines on the internet prefer_direct off never_direct allow all # Allow direct connetion if the destination machine is on LAN always_direct allow lan_dst # Delete this line if you don't have /etc/hosts file hosts_file /etc/hosts # Allow AIM connections # Delete the following 9 lines if you don't want people to connect to AIM acl AIM_ports port 5190 9898 6667 acl AIM_domains dstdomain .oscar.aol.com .blue.aol.com .freenode.net acl AIM_domains dstdomain .messaging.aol.com .aim.com acl AIM_hosts dstdomain login.oscar.aol.com login.glogin.messaging.aol.com toc.oscar.aol.com irc.freenode.net acl AIM_nets dst 64.12.0.0/255.255.0.0 acl AIM_methods method CONNECT http_access allow AIM_methods AIM_ports AIM_nets http_access allow AIM_methods AIM_ports AIM_hosts http_access allow AIM_methods AIM_ports AIM_domains # Allow connections to Yahoo Messenger # Delete the following 6 lines if you don't want people to connect to Yahoo Messenger acl YIM_ports port 5050 acl YIM_domains dstdomain .yahoo.com .yahoo.co.jp acl YIM_hosts dstdomain scs.msg.yahoo.com cs.yahoo.co.jp acl YIM_methods method CONNECT http_access allow YIM_methods YIM_ports YIM_hosts http_access allow YIM_methods YIM_ports YIM_domains # Allow connections to Google Talk # Delete the following 6 lines if you don't want people to connect to Google Talk acl GTALK_ports port 5222 5050 acl GTALK_domains dstdomain .google.com acl GTALK_hosts dstdomain talk.google.com acl GTALK_methods method CONNECT http_access allow GTALK_methods GTALK_ports GTALK_hosts http_access allow GTALK_methods GTALK_ports GTALK_domains # Allow connections to MSN # Delete the following 6 lines if you don't want people to connect to Google Talk acl MSN_ports port 1863 443 1503 acl MSN_domains dstdomain .microsoft.com .hotmail.com .live.com .msft.net .msn.com .passport.com acl MSN_hosts dstdomain messenger.hotmail.com acl MSN_nets dst 207.46.111.0/255.255.255.0 acl MSN_methods method CONNECT http_access allow MSN_methods MSN_ports MSN_hosts
Now, start the squid proxy server as
service squid start
Also, if you want squid to be started every time you boot the machine, execute the following command
chkconfig --level 345 squid on
You have a squid proxy server running now. You can ask clients to configure there browsers to use 192.168.36.204 as a proxy server with 8080 as proxy port. Command line utilities like elinks, lynx, yum, wget etc. can be asked to use proxy by exporting http_proxy variable as below. Users can also add these lines to ~/.bashrc file to avoid exporting every-time.
export http_proxy='http://192.168.36.204:8080' export ftp_proxy='http://192.168.36.204:8080'
I highly recommend the book “Squid Proxy Server 3.1: Beginner’s Guide (Paperback)” for further reading.
You can get our complete MB5-294 exam pass resources including our latest MB6-288 and MB7-227 training courses. Our 70-272 and 70-162 are also playing vital role in IT world.
{ 1 trackback }
{ 68 comments… read them below or add one }
← Previous Comments
how to cache for dinamic content like video from youtube
Hi ,
i have configured squid proxy server with two NIC in fedora 12.
Network configuration scenario:
Router-> proxy server-> switch -> clients(LAN)
where
Router = 172.15.0.1
Porxy server:
eth0:
ip= 172.15.0.2
mask=255.255.0.0
gateway=172.15.0.1
eth1:
ip= 172.16.1.1
mask=255.255.0.0
gateway= 172.15.0.2
clients:
ip= 172.16.1.10
mask=255.255.0.0
gateway= 172.16.1.1
proxy ip address= 172.16.1.1
port number= 8080
iptables:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT – [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
-A INPUT -j REJECT –reject-with icmp-host-prohibited
-A FORWARD -j REJECT –reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -m state –state NEW,ESTABLISHED,RELATED -m tcp -p tcp –dport 8080 -j ACCEPT
COMMIT
my problem is that i cannot open websites from Client. Did I miss something or wrong config? any idea?
thanks
How can I use a Proxy server to connect other people world wide with my internet connection on my ubuntu lucid 10.04 server.
hello,
My requirment is to use squid proxy for wireless sensor nodes, here squid should collect data from wireless sensor nodes and store it in cache and provide it to external internet world when requested, how do i do it???
I want to setup this configuration on blackfin BF537 STAMP BOARD… HOW TO DO THIS ANY HELP WILL BE GREATLY APPRICIATED
THANKS,,
PARASHURAM
how do i access messenger service (e.g msn and yahoo messenger) using squid server. i have running squid on my server, but the messengers cannot run on my clints.
i want to know about squid proxy installation in fedora 12 , also squid is working in 02 lan cards ? well may be it is 01 external for internet and 02 for internal network , through which i give my clients internet but what is the configuration and installation ? can anyone send me pleaseeeeeeeeeee ?
Dear all,
solution required for (104) connection reset by peer .
kindly note we are using squid 2.5 stable1
Vaibhav
My squid proxy not opening Skype and hotmails
dd u open the skype port in the firewall?
Hello,
I have configured in my network fedora 10 with squid proxy. I have configured url as well as content filtering in my squid. I have created two users one is sysadmin and another user student. In the client host if you open the browser it will ask the user name and password to login and surf the net. If you login into the student user you are not able to access the url filtering as well as content filtering access controls but in the same host you will login as sysadmin you can get all the access.
I am going to configure as a time based internet access for the student user.
How to configure this if any one has already configured this please give your configuration for the above said.
thanks,
PB.SENTHIL KUMAR.
dear ,
i have restricted some websites as company policy but my owner and general manager wants to access those blocked websites , how can it possible ? please i am in very bad condition at the moments.
m.usman khalid
well if anyone know about my users access (limited) and high management(full) access and also if i block any website then the blocked website open on my high management pc kindly please if anyone have solution then give me or e-mail me i am waiting for your replies friends
usman
good
why do you have to change the port squid use’s 3128?
how do you configure dhcp server on fedora 11
dear sir how to configuration VNC Server in linux and windos pc to linux pc how to desktop maneges….
reply me its urgent.
← Previous Comments