Squid proxy server

Posted by drag0ner on Sat, 19 Feb 2022 00:39:23 +0100

1, Squid overview

1. Working mechanism of agency

2. Type of Squid agent

2, Install squid

Link: Squid package
Extraction code: ug49

systemctl stop firewalld
systemctl disable firewalld
setenforce 0

1. Compile and install Squid

yum -y install gcc gcc-c++ make
cd /opt
tar zxvf squid-3.5.28.tar.gz
cd /opt/squid-3.5.28

./configure --prefix=/usr/local/squid \
--sysconfdir=/etc \
--enable-arp-acl \
--enable-linux-netfilter \
--enable-linux-tproxy \
--enable-async-io=100 \
--enable-err-language="Simplify_Chinese" \
--enable-underscore \
--disable-poll \
--enable-epoll \

make && make install

#--------Module interpretation--------------------------------------------------
--prefix=/usr/local/squid                  #Specify the installation directory path
--sysconfdir=/etc                          #Specify the configuration file path
--enable-arp-acl                           #MAC address control to prevent clients from using ip spoofing
--enable-linux-netfilter                   #Using kernel filtering
--enable-linux-tproxy                      #Support transparent mode
--enable-async-io=100                      #Asynchronous 1o to improve storage performance
--enable-err-language="Simplify_Chinese"   #Display language of error message
--enable-underscore                        #Allow underscores in URL s
--disable-poll \                           #Turn off the poll mode used by default
--enable-epoll \                           #Enable epoll mode to improve performance
--enable-gnuregex                          #Using GNU regular expressions

ln -s /usr/local/squid/sbin/* /usr/local/sbin/
useradd -M -s /sbin/nologin squid
chown -R squid:squid /usr/local/squid/var/
#/usr/local/squid/var / this directory is used to store cache files

2. Modify Squid's configuration file

vim /etc/squid.conf
#---------Line 56, insert----------------
http_access allow all   #Put on HTTP_ Before access deny all, any client is allowed to use the proxy service to control the top-down matching of rules
http_access deny all
http_port 3128          #Used to specify the address and port that the proxy service listens to (the default port number is 3128)
#---------61 line insertion-----------------
cache_effective_user squid	 #Add, specify the program user, which is used to set the account of initialization and runtime cache. Otherwise, the startup will not succeed
cache_effective_group squid	 #Add, specify account basic group

coredump_dir /usr/local/squid/var/cache/squid	#Specify cache file directory

3. Squid operation control

Check whether the configuration file syntax is correct

squid -k parse
 start-up Squid,First start squid The cache directory is automatically initialized when the service is
squid -z 					#-The z option is used to initialize the cache directory
squid						#Start squid service
netstat -anpt | grep "squid"

4. Create Squid service script

vim /etc/init.d/squid
#chkconfig: 2345 90 25

case "$1" in
     netstat -natp | grep squid &> /dev/null
     if [ $? -eq 0 ]
       echo "squid is running"
       echo "Starting squid..."
     $CMD -k kill &> /dev/null
     rm -rf $PID &> /dev/null
     [ -f $PID ] &> /dev/null
        if [ $? -eq 0 ]
            netstat -natp | grep squid
            echo "squid is not running"
      $0 stop &> /dev/null
      echo "Closing squid..."
         $0 start &> /dev/null
      echo "Starting squid..."
      $CMD -k reconfigure
      $CMD -k parse
      echo "Usage: $0{start|stop|status|reload|check|restart}"

2345 Is the default self start level, if yes-It means that no level will start automatically; 90 is the start priority, 25 is the stop priority, and the priority range is 0-100,The higher the number, the lower the priority.

chmod +x /etc/init.d/squid
chkconfig --add squid
chkconfig --level 35 squid on

chkconfig --list squid

3, Building traditional proxy server


1. First compile and install squid, and then modify the configuration file

vim /etc/squid.conf
http_access allow all
http_access deny all
http_port 3128
cache_effective_user squid
cache_effective_group squid
#---------63 line insertion-----------------------------------------------
cache_mem 64 MB
reply_body_max_size 10 MB
maximum_object_size 4096 KB

#---------Add content explanation------------------------------------------
cache_mem 64 MB				 #Specify the size of the memory space used by the cache function to maintain the frequently accessed WEB objects. The capacity is preferably a multiple of 4, and the unit is MB. It is recommended to set it to 1 / 4 of the physical memory
reply_body_max_size 10 MB	 #The maximum file size that users are allowed to download, in bytes. When downloading a Web object that exceeds the specified size, a prompt of "request or access too large" will appear on the error page of the browser. The default setting is 0, which means no restriction
maximum_object_size 4096 KB	 #The maximum object size allowed to be saved to the cache space, in kilobytes. Files exceeding the size limit will not be cached, but will be forwarded directly to the user

service squid restart
#Or systemctl restart squid

2. Firewall rules also need to be modified in the production environment

iptables -F
iptables -I INPUT -p tcp --dport 3128 -j ACCEPT
iptables -L INPUT

3. Turn on the Web Server http service

systemctl stop firewalld.service
setenforce 0
yum -y install httpd
systemctl start httpd
netstat -natp | grep 80

4. Verify

Client (192).168.221.88)
(1)Configure the client first IP address

(2)see squid New record of access log
tail -f /usr/local/squid/var/logs/access.log

(3)see Web1 New record of access log
tail -f /var/log/httpd/access_log

Client (192).168.221.88)
(4)visit web The server

View again squid New record of access log
tail -f /usr/local/squid/var/logs/access.log
 View again web The new record of the server access log can be viewed at this time
tail -f /var/log/httpd/access_log

4, Build transparent proxy server

Squid-Server ens33:

1. Shut down and add a network card. Note that the two network cards are set on different virtual network cards

Squid server configuration (ens33:, ens36:

2. Then configure the dual network card with the corresponding IP address and subnet mask

cd /etc/sysconfig/network-scripts/
cp ifcfg-ens33 ifcfg-ens36 -p
 Modify the next configuration

systemctl restart network

3. The configuration file has been modified

vim /etc/squid.conf
http_access allow all
http_access deny all
#------In line 60, modify and add the IP address that provides intranet services, and support the transparent proxy option transparent
http_port transparent

systemctl restart squid
netstat -natp | grep 3128

4. Turn on routing forwarding to realize address forwarding of different network segments in the machine

echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p

5. Modify firewall rules

iptables -F
iptables -t nat -F
iptables -t nat -I PREROUTING -i ens33 -s -p tcp --dport 80 -j REDIRECT --to 3128
iptables -t nat -I PREROUTING -i ens33 -s -p tcp --dport 443 -j REDIRECT --to 3128
iptables -I INPUT -p tcp --dport 3128 -j ACCEPT

6. Modify Web (

systemctl stop firewalld.service
setenforce 0
vim /etc/sysconfig/network-scripts/ifcfg-ens33
systemctl restart network

yum -y install httpd
systemctl restart httpd.service 

7. Verify

 to configure ip,visit

see Squid New record of access log
tail -f /usr/local/squid/var/logs/access.log
#The log on Squid proxy server can detect the client ip and the target website ip visited
 see Web The new record of the access log shows that the external network port of the proxy server replaces the access of the client

tail -f /var/log/httpd/access_log
#It can be seen from the log content that the proxy server external network port accesses the web server

5, ACL access control

In the configuration file squid In conf, ACL access control is realized through the following two steps:
Step 1: use acl configuration item to define the conditions to be controlled;
Step 2: via http_ The access configuration item controls "allow" or "deny" access to the defined list.
1. Access control list format

Format: acl list name list type list content


Environment configuration (just use the example of the previous experiment directly)
Squid-Server ens33:


vim /etc/local.list

vim /etc/squid.conf
acl localhosttest src  "/etc/local.list"			#Call the contents of the list in the specified file
http_access deny localhosttest				#Note that if it is a rejection list, it needs to be placed in http_access allow all

systemctl restart squid
netstat -natp |grep squid

The previous experiment has been installed, so it won't be installed here

systemctl stop firewalld.service 
setenforce 0
yum -y install httpd
systemctl start httpd

browser( Web The server
 browser( Web The server

6, Squid log analysis

Link: Sarg package
Extraction code: q1mm

1. Install image processing software package

If an error is reported, the dns And gateway are modified back to the original
 Install online source
yum install -y pcre-devel gd gd-devel

mkdir /usr/local/sarg
tar zxvf sarg-2.3.7.tar.gz -C /opt/

cd /opt/sarg-2.3.7

./configure --prefix=/usr/local/sarg --sysconfdir=/etc/sarg --enable-extraprotection

make && make install

#---------./ Module interpretation in configure---------------------------------------
--sysconfdir=/etc/sarg   #The configuration file directory is / usr/local/etc by default
--enable-extraprotection #Additional safety protection

2. Modify profile

vim /etc/sarg/sarg.conf
#---------Line 7, uncomment---------------------------------------------
access_log /usr/local/squid/var/logs/access.log		#Specify access log file
#---------Line 25, uncomment--------------------------------------------
title "Squid User Access Reports"					#Page title
#---------Line 120, uncomment-------------------------------------------
output_dir /var/www/html/squid-reports				#Report output directory
#---------Line 178, uncomment-------------------------------------------
user_ip no											#Display with user name
#---------Line 184, uncomment, modify--------------------------------------
topuser_sort_field connect reverse					#In top sorting, the specified connection times are arranged in descending order, and the ascending order is normal
#---------Line 190, uncomment, modify--------------------------------------
user_sort_field connect reverse						#For user access records, the number of connections is sorted in descending order
#---------Line 206, uncomment, modify--------------------------------------
exclude_hosts /usr/local/sarg/noreport				#Specifies files that are not included in the sorted site list
#---------Line 257, uncomment-------------------------------------------
overwrite_report no									#Overwrite logs with the same name and date
#---------Line 289, uncomment, modify--------------------------------------
mail_utility mailq.postfix							#Send mail report command
#---------Line 434 uncomment and modify---------------------------------------
charset UTF-8										#Specifies the character set UTF-8
#---------Line 518, uncomment-------------------------------------------
weekdays 0-6										#Week cycle of top ranking
#---------Line 525, uncomment-------------------------------------------
hours 0-23											#Time period of top ranking
#---------Line 633, uncomment--------------------------------------------
www_document_root /var/www/html						#Specify page root

3. Add is not included in the site file, and the added domain name will not be displayed in the sorting

touch /usr/local/sarg/noreport

ln -s /usr/local/sarg/bin/sarg /usr/local/bin/
sarg --help

4. Run and verify

sarg				#Start a record

Install at this time web Server in squid On the server, other client machines cannot access the tested page
yum install httpd -y
systemctl start httpd
 Browser access reports, check the sarg report page

5. Add scheduled tasks, execute and generate reports every day

vim /usr/local/sarg/report.sh
#Get current date
TODAY=$(date +%d/%m/%Y)
#Get one week ago today
YESTERDAY=$(date -d "1 day ago" +%d/%m/%Y)
/usr/local/sarg/bin/sarg -l /usr/local/squid/var/logs/access.log -o /var/www/html/squid-reports -z -d $YESTERDAY-$TODAY &> /dev/null
exit 0

chmod +x /usr/local/sarg/report.sh

crontab -e
0 0 * * * /usr/local/sarg/report.sh

7, Squid reverse proxy


Environment configuration

1. Modify profile


vim /etc/squid.conf
#---------Line 60, modify, insert-------------------------------------------
http_port accel vhost vport
cache_peer parent 80 0 no-query originserver round-robin max_conn=30 weight=1 name=web1
cache_peer parent 80 0 no-query originserver round-robin max_conn=30 weight=1 name=web2
cache_peer_domain web1 web2 www.test.com

systemctl stop httpd
systemctl restart squid
http_port 80 accel vhost vport 
#Squid has changed from a cache to a web server, using the acceleration mode. At this time, squid listens to requests on port 80 and binds to the request port (vhost vport) of the web server. When a request arrives at squid, squid does not need to forward the request, but directly takes data from the cache or directly requests data from the bound port.
accel: Reverse proxy acceleration mode
vhost: Support domain name or host name to represent proxy node
vport: support ip And port to represent the proxy node

parent: Represents the parent node
no-query: Do not query, directly obtain data
originserver: Specify source server
round-robin: appoint squid The request is distributed to one of the parent nodes by polling
max_conn: Specify the maximum number of connections
weight: Specify weights
name: Set alias

2. Edit web1, 2 page content

systemctl stop firewalld.service 
setenforce 0
yum install -y httpd
systemctl start httpd

echo "this is web1" >> /var/www/html/index.html

echo "this is web2" >> /var/www/html/index.html

3. Verify

Client (192).168.221.88)
Modify the domain name mapping of the client
 If the prompt permission is insufficient, it needs to be modified hosts file right
 Right click hosts Files, properties–>security–>edit–>In group or user name( Users)–>Select allow permissions–>OK, the figure is below

#Modify the C:\Windows\System32\drivers\etc\hosts file www.test.com

3. Browser access http://www.test.com

Topics: squid