RSS

Secure Squid Proxy Server

Install and quick configure squid to make it securely

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages.

Installation

Install on Mac with brew

$ brew install squid
==> Downloading https://homebrew.bintray.com/bottles/squid-4.10.catalina.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/b3/b317cad793854ed6b0c3933ebec75194383d5c2b47e5f868027aaa9e9decb8f9?__gd
######################################################################## 100.0%
==> Pouring squid-4.10.catalina.bottle.tar.gz
==> Caveats
To have launchd start squid now and restart at login:
  brew services start squid
Or, if you don't want/need a background service you can just run:
  squid
==> Summary
🍺  /usr/local/Cellar/squid/4.10: 2,111 files, 9.8MB

Start the squid:

$ brew services start squid

Configuration

Configure file on Mac:

/usr/local/etc/squid.conf

acl: define source network

Define allowed source by acl:

acl zerotiernet src 10.247.110.0/24

http_access: Allow traffic from specific network source

Use http_access to allow traffic source:

#http_access allow localnet
http_access allow zerotiernet

http_port: Bind to ip:port

Limit the listen port on specific IP by http_port:

Usage: port [mode] [options]
       hostname:port [mode] [options]
       1.2.3.4:port [mode] [options]

The socket addresses where Squid will listen for HTTP client requests. You may specify multiple socket addresses.

There are three forms: port alone, hostname with port, and IP address with port. If you specify a hostname or IP address, Squid binds the socket to that specific address.

Most likely, you do not need to bind to a specific address, so you can use the port number alone.

If you run Squid on a dual-homed machine with an internal and an external interface we recommend you to specify the internal address:port in http_port. This way Squid will only be visible on the internal address.

#http_port 3128
http_port 10.247.110.135:3128  # Only listen on zerotier one network

forwarded_for: X-Forwarded-For header control

X-Forwarded-For header controlled by forwarded_for:

If set to “on”, Squid will append your client's IP address in the HTTP requests it forwards. By default it looks like:

X-Forwarded-For: 192.1.2.3

If set to “off”, it will appear as

X-Forwarded-For: unknown

If set to “transparent”, Squid will not alter the X-Forwarded-For header in any way.

If set to “delete”, Squid will delete the entire X-Forwarded-For header.

If set to “truncate”, Squid will remove all existing X-Forwarded-For entries, and place the client IP as the sole entry.

# Do not send X-Forwarded-For header
forwarded_for delete

A full recommend squid.conf

$ cat /usr/local/etc/squid.conf
#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 0.0.0.1-0.255.255.255    # RFC 1122 "this" network (LAN)
#acl localnet src 10.0.0.0/8        # RFC 1918 local private network (LAN)
#acl localnet src 100.64.0.0/10        # RFC 6598 shared address space (CGN)
#acl localnet src 169.254.0.0/16     # RFC 3927 link-local (directly plugged) machines
#acl localnet src 172.16.0.0/12        # RFC 1918 local private network (LAN)
#acl localnet src 192.168.0.0/16        # RFC 1918 local private network (LAN)
#acl localnet src fc00::/7           # RFC 4193 local private network range
#acl localnet src fe80::/10          # RFC 4291 link-local (directly plugged) machines
acl zerotiernet src 10.247.110.0/24      # ZeroTier One network

acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
http_access allow zerotiernet

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
#http_port 3128
http_port 10.247.110.135:3128  # Only listen on zerotier one network


# forwarded_for  X-Forwarded-For
# If set to "on", Squid will append your client's IP address
# in the HTTP requests it forwards. By default it looks like:
#
#   X-Forwarded-For: 192.1.2.3
#
# If set to "off", it will appear as
#
#   X-Forwarded-For: unknown
#
# If set to "transparent", Squid will not alter the
# X-Forwarded-For header in any way.
#
# If set to "delete", Squid will delete the entire
# X-Forwarded-For header.
#
# If set to "truncate", Squid will remove all existing
# X-Forwarded-For entries, and place the client IP as the sole entry.
# default forwarded_for on
#
# Do not send X-Forwarded-For header
forwarded_for delete

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /usr/local/var/cache/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /usr/local/var/cache/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
refresh_pattern .        0    20%    4320

References