Squid as Transparent Proxy Server

sudhirmhrj · 06-30-2010, 08:06 PM

Hi to everyone.

I am trying to install Squid 2.6 as Transparent proxy server.
Can anyone provide the step by step configuration details

thank you
BGRDS

GlennsPref · 06-30-2010, 08:21 PM

Hi, I have found the squid tutorials here useful,

http://www.linuxhomenetworking.com/w...ess_with_Squid

Also check out the links from this page to ensure you have portforwarding and iptables setup to work with squid.

(cross reference here...)
http://wiki.squid-cache.org/ConfigExamples/
http://www.squid-cache.org/Doc/config/
http://www.visolve.com/squid/
http://www.squid-cache.org/

Another tute...
http://www.visolve.com/squid/Squid_tutorial.php
http://www.deckle.co.za/squid-users-guide/

Cheers, Glenn

GlennsPref · 06-30-2010, 09:46 PM

Hi, since that above post, I came across this page, quite good, and easy to use...

http://www.cyberciti.biz/tips/linux-...uid-howto.html

cheers, Glenn

sudhirmhrj · 06-30-2010, 10:32 PM

Thank you GlennsPref for your post. but according to squid-cache

/*
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan
*/

are not used in squid 2.6 or later version.

So how can we setup squid as transparent proxy server...

GlennsPref · 06-30-2010, 11:09 PM

find this line and add the info...
/etc/squid.conf...
http_port...

Code:

http_port 192.168.0.2:3128 transparent

use lines like this at the end of your firewall script.

Code:

#
## --- NAT --- ##
#

	# Enable masquerade

	$IPTABLES -A POSTROUTING -t nat -o $EXT_IF -j MASQUERADE

#
## -- Transparent proxy to Squid --- ##
#
# Squid transparent proxy
	$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
	$IPTABLES -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
	$IPTABLES -A PREROUTING -t nat -i ppp0 -p tcp --dport 80 -j REDIRECT --to-port 3128
	$IPTABLES -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to-port 3128

set port forwarding in /etc/sysctl.conf

Code:

net.ipv4.conf.all.forwarding = 1

There are a lot of setting that may be applied to the kernel from here.

restart the firewall and squid server, to see the effects...

Cheers, and regards Glenn

GlennsPref · 06-30-2010, 11:13 PM

check the log,

Code:

locate access.log | grep squid
/var/log/squid/access.log
/var/log/squid/access.log.1
/var/log/squid/access.log.2.gz

then...

Code:

sudo tail -f /var/log/squid/access.log

GlennsPref · 06-30-2010, 11:25 PM

In newer versions of squid,

Quote:

/*
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan
*/

http_access, squid is supposed to be for a lan,
this is default and does not need to be stated in .conf. Is built-in!

acl lan src, lan source ip, same as above.

httpd_accel, default and does not need to be stated in .conf. Is built-in!

regards Glenn.

sudhirmhrj · 07-01-2010, 08:34 AM

Thank you for your support

Now I want to configure squid to block facebook and some social sites with squid.

But i want to allow using facebook to few hosts. how do i do that

like i want to block facebook from 192.168.0.2 - 192.168.0.200
and want to allow facebook from 192.168.0.201-192.168.0.254

Thanks
BGRDS

GlennsPref · 07-01-2010, 09:13 AM

A quick google search reveals...

Block MSN Messenger with Squid
http://blogs.techrepublic.com.com/networking/?p=308

squid-for-blocking-yahoo-and-msn
http://www.linuxquestions.org/questi...4/#post3075722

some people say snort http://freshmeat.net/projects/snort/
can be configured to do this job, I've never heard of it, nor do I need to block instant messengers like msn icq, etc.

cheers, Glenn