July 12, 2009 by Ivan Kristianto

[HowTo] Install and Configure Squid as Transparent Proxy

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator.

An intercepting proxy (also known as a “transparent proxy“) combines a proxy server with a gateway. Connections made by client browsers through the gateway are redirected through the proxy without client-side configuration (or often knowledge). So the client never realize and don’t have to configure the client machine to use the proxy, but they are using it.

Squid Cache Proxy Installation

1. Open up your shell and type this command:

sudo apt-get install squid

2. Finish.
For other OS you can download the binary package here.

Configure Squid Cache Proxy as Transparent Proxy

To configure squid proxy as transparent proxy you need to edit squid.conf file in /etc/squid/squid.conf as follow:

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localnet src 192.168.1.0/24
 
acl SSL_ports port 443 563
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443      # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210      # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
 
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
 
http_access allow localnet
http_access allow localhost
http_access deny all
 
http_reply_access allow localnet
http_reply_access deny all
 
icp_access allow localnet
icp_access deny all
 
http_port 8080 transparent
 
hierarchy_stoplist cgi-bin ?
 
cache_mem 256 MB
cache_dir ufs /var/spool/squid 2048 16 256
cache_mgr admin@email.com
cache_effective_user squid
cache_effective_group squid
 
access_log /var/log/squid/access.log squid
 
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern (cgi-bin|\?)    0    0%    0
refresh_pattern .        0    20%    4320
 
visible_hostname yourdomain.com
 
icp_port 3130
 
always_direct    allow    all
 
forwarded_for off
 
coredump_dir /var/spool/squid

The most important line is
“http_port 8080 transparent” : This line means, Squid proxy run as transparent proxy at port 8080 (by default 3128). Later you need to edit the iptables to bypass every request/response connection through this port.
Note: That setting is for Squid v2.6 or v2.7. For later version like Squid v3.1, “transparent” option is being deprecated, you need to use option “intercept” instead.

There are many things that squid can do, like limiting download speed for certain ip, denied some “time wasting” sites, denied some ports, denied download some files in certain hours, and many more case that you can name. So take your time to read their documentation guide here.

Note: Squid Web Proxy installation steps above only for Ubuntu/Debian. For others it might working but need adjustment.

Iptables Configurations

To make Squid as the transparent proxy (“man in the middle”), you need to configure the iptables.
I got this script to help you:

#!/bin/sh
# ------------------------------------------------------------------------------------
# See URL: http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html
# (c) 2006, nixCraft under GNU/GPL v2.0+
# -------------------------------------------------------------------------------------
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
 
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Okay, that’s all of it. If you like it please leave me a comment.

What people search:

Article by Ivan Kristianto

Ivan Kristianto is a profesional web developer and blogger. Very interest with free and open source software. Follow my Twitter: @ivankrisdotcom or Facebook profile IvanKristiantoBlog or Email me at ivan@ivankristianto.com

Category: Ubuntu
Tags: centos squid web proxy, faster internet, how to, linux, permission denied on terminal bash when i tried to configure squid, proxy, squid, squid transparent proxy client iptables, squid transparent proxy howto, transparent proxy, web cache, web proxy

199 comments 4 people listening

Comment help
Get Livefyre

Sort: Newest | Oldest

Ivan Kristianto

do you have dns server in your local network? if yes in your dns server (usually bind9) configure proxy.server.com to correct address of your proxy server.

Ivan Kristianto Blog

[HowTo] Install and Configure Squid as Transparent Proxy

Squid Cache Proxy Installation

Configure Squid Cache Proxy as Transparent Proxy

Iptables Configurations

What people search:

Other Interesting Articles:

Article by Ivan Kristianto

About Author

Popular Posts

Categories

Archives

TagClouds

Blogroll