{"id":18397,"date":"2023-09-19T15:32:53","date_gmt":"2023-09-19T15:32:53","guid":{"rendered":"https:\/\/webhostinggeeks.com\/howto\/?p=18397"},"modified":"2023-09-19T15:40:12","modified_gmt":"2023-09-19T15:40:12","slug":"how-to-install-squid-proxy-on-ubuntu","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/howto\/how-to-install-squid-proxy-on-ubuntu\/","title":{"rendered":"How to Install Squid Proxy on Ubuntu"},"content":{"rendered":"

\"How<\/p>\n

In web hosting, system administrators often face challenges related to managing internet traffic and ensuring optimal web server<\/a> performance. One such challenge is efficiently handling the flow of data packets<\/a> between users and the internet.<\/p>\n

This is where proxy servers<\/a> come into play. A proxy server acts as an intermediary between a user’s computer and the internet, providing various benefits such as improved performance, security, and content filtering.<\/p>\n

Squid<\/a> is a renowned proxy server software that has gained immense popularity<\/a> among server administrators and webmasters. It’s not just any proxy server; it’s a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. By deploying Squid on your server, you can cache requested web content, reducing bandwidth<\/a> usage and speeding up access for users by serving cached content when a request is made.<\/p>\n

This tutorial will guide you through the process of installing Squid on an Ubuntu<\/a> server. By the end of this guide, you’ll have it up and running on your Ubuntu machine.<\/p>\n

Let’s get started!<\/p>\n

Step 1: Update Your System<\/h2>\n

Before installing any new software, it’s always a good practice to update your system’s package list. This ensures you get the latest version of the software and its dependencies.<\/p>\n

\r\nsudo apt update\r\nsudo apt upgrade\r\n<\/pre>\n
Step 2: Install Squid<\/h2>\n
With your system updated, you can now install Squid directly from the Ubuntu repositories.<\/p>\n
\r\nsudo apt install squid\r\n<\/pre>\n
Step 3: Configure Squid<\/h2>\n
Once installed, you’ll need to configure Squid according to your needs. The main configuration file for Squid is located at \/etc\/squid\/squid.conf.<\/p>\n
\r\nsudo nano \/etc\/squid\/squid.conf\r\n<\/pre>\n
Inside this file, you can set various parameters like ACLs, cache size, and allowed IP ranges. Make sure to read the comments in the configuration file to understand each setting.<\/p>\n
Squid Basic Configuration File<\/strong><\/p>\n
\r\n# Squid Default Configuration File\r\n\r\n# HTTP and HTTPS ports\r\nhttp_port 3128\r\n\r\n# Define the disk cache settings\r\ncache_dir ufs \/var\/spool\/squid 100 16 256\r\n\r\n# Access Control Lists (ACLs)\r\nacl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 \"this\" network (LAN)\r\nacl localnet src 10.0.0.0\/8             # RFC 1918 local private network (LAN)\r\nacl localnet src 100.64.0.0\/10          # RFC 6598 shared address space (CGN)\r\nacl localnet src 169.254.0.0\/16         # RFC 3927 link-local (directly plugged) machines\r\nacl localnet src 172.16.0.0\/12          # RFC 1918 local private network (LAN)\r\nacl localnet src 192.168.0.0\/16         # RFC 1918 local private network (LAN)\r\nacl localnet src fc00::\/7               # RFC 4193 local private network range\r\nacl localnet src fe80::\/10              # RFC 4291 link-local (directly plugged) machines\r\n\r\n# Safe ports and SSL ports\r\nacl Safe_ports port 80          # http\r\nacl Safe_ports port 21          # ftp\r\nacl Safe_ports port 443         # https\r\nacl Safe_ports port 70          # gopher\r\nacl Safe_ports port 210         # wais\r\nacl Safe_ports port 1025-65535  # unregistered ports\r\nacl Safe_ports port 280         # http-mgmt\r\nacl Safe_ports port 488         # gss-http\r\nacl Safe_ports port 591         # filemaker\r\nacl Safe_ports port 777         # multiling http\r\nacl SSL_ports port 443          # https\r\n\r\n# Deny requests to certain unsafe ports\r\nhttp_access deny !Safe_ports\r\n\r\n# Deny CONNECT to other than secure SSL ports\r\nhttp_access deny CONNECT !SSL_ports\r\n\r\n# Only allow cachemgr access from localhost\r\nhttp_access allow localhost manager\r\nhttp_access deny manager\r\n\r\n# We strongly recommend the following be uncommented to protect innocent\r\n# web applications running on the proxy server who think the only\r\n# one who can access services on \"localhost\" is a local user\r\nhttp_access deny to_localhost\r\n\r\n# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS\r\n\r\n# Example rule allowing access from your local networks.\r\n# Adapt localnet in the ACL section to list your (internal) IP networks\r\n# from where browsing should be allowed\r\nhttp_access allow localnet\r\nhttp_access allow localhost\r\n\r\n# And finally deny all other access to this proxy\r\nhttp_access deny all\r\n\r\n# Logging settings\r\naccess_log \/var\/log\/squid\/access.log squid\r\n\r\n# Refresh patterns to determine how frequently Squid checks objects in its cache\r\nrefresh_pattern ^ftp:           1440    20%     10080\r\nrefresh_pattern ^gopher:        1440    0%      1440\r\nrefresh_pattern -i (\/cgi-bin\/|\\?) 0     0%      0\r\nrefresh_pattern .               0       20%     4320\r\n\r\n# Squid normally listens to port 3128\r\nhttp_port 3128\r\n\r\n# Uncomment and adjust the following to add a disk cache directory.\r\n#cache_dir ufs \/var\/spool\/squid 100 16 256\r\n\r\n# Leave coredumps in the first cache dir\r\ncoredump_dir \/var\/spool\/squid\r\n\r\n# Add any of your own refresh_pattern entries above these.\r\nrefresh_pattern ^ftp:           1440    20%     10080\r\nrefresh_pattern ^gopher:        1440    0%      1440\r\nrefresh_pattern -i (\/cgi-bin\/|\\?) 0     0%      0\r\nrefresh_pattern .               0       20%     4320\r\n<\/pre>\n
Step 4: Start and Enable Squid Service<\/h2>\n
After configuring, start the Squid service and enable it to launch at boot.<\/p>\n
\r\nsudo systemctl start squid\r\nsudo systemctl enable squid\r\n<\/pre>\n
Step 5: Verify Squid Installation<\/h2>\n
To ensure that Squid is running correctly, you can check its status.<\/p>\n
\r\nsudo systemctl status squid\r\n<\/pre>\n
Step 6: Set Up Access Control<\/h2>\n
Squid provides a robust mechanism to control who can access the web through your proxy. By default, Squid denies access to all requests. You’ll need to set up access control lists (ACLs) to define who can access what.<\/p>\n
\r\nsudo nano \/etc\/squid\/squid.conf\r\n<\/pre>\n
Find the section on ACLs. To allow all machines on your local network to use the proxy, you might add:<\/p>\n
\r\nacl localnet src 192.168.0.0\/16\r\nhttp_access allow localnet\r\n<\/pre>\n
Remember to deny all other requests:<\/p>\n
\r\nhttp_access deny all\r\n<\/pre>\n
Step 7: Configure Cache Settings<\/h2>\n
Caching is one of the primary features of Squid. You can define how much disk space you want to allocate for caching and where the cache directory is located.<\/p>\n
\r\ncache_dir ufs \/var\/spool\/squid 100 16 256\r\n<\/pre>\n
This configuration sets up a cache directory at \/var\/spool\/squid with 100MB space.<\/p>\n
Example Configuration File:<\/strong><\/p>\n
\r\n# Define the port Squid listens on\r\nhttp_port 3128\r\n\r\n# Define the disk cache settings\r\ncache_dir ufs \/var\/spool\/squid 100 16 256\r\n\r\n# Access Control Lists (ACLs)\r\n# Define local network\r\nacl localnet src 192.168.0.0\/16\r\n\r\n# Allow local network to use the proxy\r\nhttp_access allow localnet\r\n\r\n# Deny all other access\r\nhttp_access deny all\r\n\r\n# Define the name of the machine (change 'your_hostname' to your machine's hostname)\r\nvisible_hostname your_hostname\r\n\r\n# Logging settings\r\naccess_log \/var\/log\/squid\/access.log squid\r\ncache_log \/var\/log\/squid\/cache.log\r\n\r\n# Refresh patterns to determine how frequently Squid checks objects in its cache\r\nrefresh_pattern ^ftp:           1440    20%     10080\r\nrefresh_pattern ^gopher:        1440    0%      1440\r\nrefresh_pattern -i (\/cgi-bin\/|\\?) 0     0%      0\r\nrefresh_pattern .               0       20%     4320\r\n<\/pre>\n
Step 8: Restart Squid to Apply Changes<\/h2>\n
After making all the necessary configurations, restart Squid to apply the changes.<\/p>\n
\r\nsudo systemctl restart squid\r\n<\/pre>\n
Step 9: Monitor and Maintain Squid<\/h2>\n
Regularly check Squid’s logs to ensure it’s operating correctly and efficiently. The logs can be found at \/var\/log\/squid\/. Regular maintenance, like clearing the cache or rotating logs, ensures optimal performance.<\/p>\n
\r\nsudo tail -f \/var\/log\/squid\/access.log\r\n<\/pre>\n
Step 10: Set Up Squid as a Transparent Proxy (Optional)<\/h2>\n
Setting up Squid as a transparent proxy means that the clients in your network will not need to configure their browsers or applications to use the proxy server. Instead, all web traffic will be automatically redirected through the Squid proxy without the client’s knowledge. This is particularly useful in large networks where configuring each client individually would be cumbersome.<\/p>\n
Here’s how to set up Squid as a transparent proxy:<\/p>\n
1. Configure Squid for Transparent Proxying<\/h3>\n
Edit the Squid configuration file:<\/p>\n
\r\nsudo nano \/etc\/squid\/squid.conf\r\n<\/pre>\n
Add or modify the following line to enable transparent proxying:<\/p>\n
\r\nhttp_port 3128 intercept\r\n<\/pre>\n
2. Redirect Traffic Using iptables<\/h3>\n
You’ll need to set up `iptables` rules to redirect all web traffic (port 80) to Squid (port 3128). <\/p>\n
\r\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128\r\n<\/pre>\n
Replace eth0 with the name of your network interface if it’s different.<\/p>\n
3. Save iptables Rules<\/h3>\n
To ensure that the `iptables` rules persist after a reboot, save them:<\/p>\n
\r\nsudo sh -c \"iptables-save > \/etc\/iptables.rules\"\r\n<\/pre>\n
4. Adjust Squid ACLs<\/h3>\n
By default, Squid denies all traffic and you need to allow the local network. Add or modify the following lines in the Squid configuration:<\/p>\n
\r\nacl localnet src 192.168.0.0\/16\r\nhttp_access allow localnet\r\n<\/pre>\n
Adjust the IP range (192.168.0.0\/16) to match your local network.<\/p>\n
5. Restart Squid<\/h3>\n
After making the necessary changes, restart Squid to apply them:<\/p>\n
\r\nsudo systemctl restart squid\r\n<\/pre>\n
6. Test the Configuration<\/h3>\n
From a client machine, try accessing a website. If everything is set up correctly, the website should load as expected, and the traffic will pass through the Squid proxy transparently.<\/p>\n
7. Monitor Squid Logs<\/h3>\n
To ensure that the transparent proxy is working correctly, monitor the Squid access logs:<\/p>\n
\r\nsudo tail -f \/var\/log\/squid\/access.log\r\n<\/pre>\n
Commands Mentioned:<\/h2>\n