Squid is a convenient open-source proxy server that provides caching and proxy services for HTTP, HTTPS, FTP, and other network protocols. It is widely used in corporate networks for traffic optimization, security enhancement, and access control to web resources.

The main advantages of Squid are its high performance, configuration flexibility, and the ability to significantly reduce bandwidth load through caching. This makes it an excellent choice for both small offices and large organizations.

Over the years of development, Squid has become the de facto standard for Linux systems, offering rich functionality for content filtering, user authentication, and network traffic monitoring.

Installation Procedure

sudo apt update
sudo apt upgrade -y

sudo apt install squid -y

sudo systemctl status squid

sudo yum update -y

sudo yum install squid -y

sudo systemctl status squid

Basic Configuration

1. Open the configuration file:

sudo nano /etc/squid/squid.conf

2. Basic settings:

http_port 3128
acl localnet src 192.168.1.0/24
http_access allow localnet
http_access deny all

3. Restart the service:

sudo systemctl restart squid

Authentication Configuration Setup

Creating Password File

1. Create a user using digest authentication:

sudo htdigest -c /etc/squid/passwords proxy newuser

Adding subsequent users (without the -c option):

sudo htdigest /etc/squid/passwords proxy seconduser

2. Set correct permissions:

sudo chown -R proxy:proxy /etc/squid/passwords
sudo chmod -R 640 /etc/squid/passwords

Authentication Configuration Setup

Edit the /etc/squid/squid.conf file:

# Digest authentication setup
auth_param digest program /usr/lib/squid/digest_file_auth -c /etc/squid/passwords
auth_param digest realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_port 3128
dns_v4_first on

Additional Authentication Security Settings

1. Limiting simultaneous connections:

acl user1 proxy_auth username1
tcp_outgoing_connection_limit user1 10

2. Speed limiting:

delay_pools 1
delay_class 1 2
delay_parameters 1 -1/-1 10000/20000
delay_access 1 allow authenticated

3. Time-based access restrictions:

acl working_hours time MTWHF 9:00-18:00
http_access allow authenticated working_hours

User Access Monitoring

To view user activity, use:

sudo tail -f /var/log/squid/access.log | grep username

Firewall Configuration

Iptables Configuration

sudo iptables-save > /root/iptables.backup

sudo iptables-restore < /root/iptables.backup

Basic Rules for Squid:

# Allow incoming connections to proxy port
sudo iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

# Allow outgoing connections for proxy
sudo iptables -A OUTPUT -p tcp --sport 3128 -j ACCEPT

# Allow NAT for proxy clients
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Advanced Security Rules:

# Restrict proxy access to local network only
sudo iptables -A INPUT -p tcp --dport 3128 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3128 -j DROP

# Log rejected connection attempts
sudo iptables -A INPUT -p tcp --dport 3128 -j LOG --log-prefix "SQUID_DENIED: "

Port Forwarding Configuration:

# Redirect HTTP traffic to Squid
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

# Redirect HTTPS traffic
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3128

sudo apt install iptables-persistent
sudo netfilter-persistent save

sudo service iptables save

sudo ufw allow 3128/tcp

sudo firewall-cmd --permanent --add-port=3128/tcp
sudo firewall-cmd --reload

Automating Iptables Configuration

Create a file setup_squid_iptables.sh, this can be done with the command: sudo nano setup_squid_iptables.sh;

#!/bin/bash

# Clear existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# Set base policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow local traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Rules for Squid
iptables -A INPUT -p tcp --dport 3128 -s 192.168.1.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Save rules
if [ -f /etc/debian_version ]; then
    netfilter-persistent save
else
    service iptables save
fi

Operation Check.

To check the proxy server operation, you can use the command:

curl -x http://localhost:3128 http://www.example.com

Additional Settings

Cache Configuration:

cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 4096 KB

Logging Configuration:

access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log