internal proxy server and web filter

EmCee09 · 01-31-2009, 10:35 PM

Hi there,

Looking for the best solution for an internal proxy server and webfilter for home use. I was using IPCOP which was great, but it fell over far too regularly, which after some detailed reading appears to occur due to my red and green interfaces being on the same subnet and IPCOP just shutting down the red after a certain amount of traffic. Anyway, I want to continue to use my Billion Router as the gateway (192.168.1.254), and have the squid/dansguardian(?) sit on the inside (192.168.1.20?) and then my home PC's in the DHCP range of 192.168.1.100-192.168.1.199, and just set their Firefox proxy settings to point to 192.168.1.20 which will then either grab the page from its cache, or decide whether to go fetch from the internet. I know this is basic squid stuff but I'm just unable to find information about using squid without doing routing (ie: router IP 192.168.0.xxx external interface, and 192.168.1.xxx internal.) Also being able to cache any windows or ubuntu updates would be a bonus, to save five PC's going out and grabbing the same data five times, where it would be better being cached after the first dl.

Thanks!!

Mark

PS: have also tried smoothwall, another good product but didn't seem to like the WAN and LAN nic's being same subnet.

PPS: Preferred platform either Ubuntu or Debian, but if another distro is required, happy to learn it's subtleties.

fotoguy · 02-01-2009, 01:50 AM

Hi and welcome to LQ, for me I use Squid and SquidGuard for my home use, I currently run this on KirraMail (slackware 12.1 box), but you can do this on any distro that you are currently using.

The box I use only has one network card in it, so it doesn't do any routing, squid itself does this for you since it's the man in the middle so to speak, as long as the squid box knows the gateway address there shouldn't be a problem.

Be happy to post my squid.conf file if you need it to get started, it's only a basic one, but does the job well.

EmCee09 · 02-01-2009, 07:12 AM

thanks for the response. With a bit of googling and helpful linux forums I've managed to get squid running nicely on Ubuntu Server 8.10 (an old P4 2ghz machine, 1.5gb ram and an 80gb hdd, and a gigabit nic). Where I am stuck now is getting squid to redirect to squidGuard, so yes if you could post your squid.conf for me to compare mine with, that would be much appreciated.

Mark

fotoguy · 02-02-2009, 07:52 AM

Here it is, hope this helps.

Code:

http_port 3128
visible_hostname proxy.myhost.com

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl manager proto cache_object

http_access allow localhost
http_access allow localnet
http_access deny to_localhost
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all

htcp_access allow localnet
htcp_access deny all

icp_port 0
icp_access allow localnet
icp_access deny all

#cache_peer proxy.myisp.com parent 8080 8080
#cache_peer proxy.anotherproxy.com parent 8080 8080 no-query default

cache_dir ufs /var/spool/squid 100 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_mgr squid-admin@mydomain.com
cache_effective_user squid
cache_effective_group squid

pid_filename /var/run/squid.pid

hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

forwarded_for off

# Sending to squidguard will block all sites listed in the squidguard database
redirect_program /usr/local/squidGuard/bin/squidGuard -c /usr/local/squidGuard/squidGuard.conf