Index.
- Introduction.
- Installing Squid.
- Setup wpad.dat.
- Download.
29-Jul-2011: initial release. 08-Dec-2011: changed wpad.dat to use FQDN for proxy. 29-Dec-2011: decreased the cache size. 27-Dec-2012: adjusted for Slackware.
Introduction.
Quote from the Squid web site:
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator.
How useful Squid is on a home network depends on various things:
- How fast/slow is your Internet connection.
- How fast/slow is your server running Squid.
- Do you want to access IPv6 sites for old clients (XP and older).
Even in my situation where Squid runs on a dual 2,5 MHz with a 20 MB Internet connection I still have advantages using Squid, but it is not a big win.
Installing Squid.
Slackware doesn’t have squid in the distribution, so you need to build it yourself. In this article version 3.2.5 is used. After you have build and installed the package, configure Squid in /etc/squid/squid.conf:
# Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.126.160.0/21 # Our private IPv4 range acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl localnet src 2001:1af8:fecf::/48 # Our private IPv6 range acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_Ports port 81 # 80+1 acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # # Recommended minimum Access Permission configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 http_port 3128 # We recommend you to use at least the following line. hierarchy_stoplist cgi-bin ? # Uncomment and adjust the following to add a disk cache directory. cache_dir ufs /var/cache/squid 128 16 128 cache_mem 64 MB # Disable logrotate, use cron logfile_rotate 0 # Leave coredumps in the first cache dir coredump_dir /var/cache/squid # FTP user for anonymous login ftp_user squid@wpl.uk # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # Cache manager email cache_mgr admin@wpl.uk # Snmp options acl snmppublic snmp_community public snmp_port 3401 snmp_access allow snmppublic localhost snmp_access deny all snmp_incoming_address 0.0.0.0 snmp_outgoing_address 255.255.255.255 memory_pools off
A few remarks. The default installation uses a memory cache, in this setup I use a disk cache with memory cache. A disk cache is slower, but “remembers” all cached objects between reboots. It is just a personal choice what you like best. I also lowered the disk cache from 256 to 128 MB and the memory cache from 256 to 64 MB. The default setup is for medium size intra net proxies, for home use you probably don’t need the default size. Try and experiment what works best for you.
Second, I have snmp enabled. If you don’t want to use that, you can leave it off.
Now you may start Squid:
root@homsrv:~# /etc/rc.d/init.d/squid start Building squid cache in /var/cache/squid Starting Squid /usr/sbin/squid -F root@homsrv:~
Only the very first time you will see that Swap directories are created. To make it so that squid is started every time when the server boots, run pkgtool -> setup -> squid to enable squid at boot. You can now change your browser settings to use a proxy on homsrv.wpl.ym port 3128.
Setup wpad.dat
The Web Proxy Autodiscovery Protocol is used to tell the client machines where our Squid web proxy is and which port it uses. We need to add an alias to our DNS so that we can resolve wpad.wpl.ym. If you use the bind nameserver then In /srv/named/int/db.wpl.ym add:
wpad CNAME homsrv
Before you add this line, do a rndc freeze, then edit and increase the serial number, and finish with the rndc thaw command. If you use dnsmasq, then add the wpad name to the homsrv addresses in the file /etc/dnsmasq.hosts.
Then create a /srv/http/htdocs/wpad.dat file:
function FindProxyForURL(url, host)
{
// variable strings to return
var proxy_yes = "PROXY homsrv.wpl.ym:3128";
var proxy_no = "DIRECT";
if (shExpMatch(url, "*//localhost*")) { return proxy_no; }
if (shExpMatch(url, "*.ym*")) { return proxy_no; }
if (shExpMatch(url, "*.wpl.ym*")) { return proxy_no; }
if (shExpMatch(url, "*.wpl.uk*")) { return proxy_no; }
if (shExpMatch(url, "*.local*")) { return proxy_no; }
if (shExpMatch(url, "http://10.*")) { return proxy_no; }
if (shExpMatch(url, "https://10.*")) { return proxy_no; }
// Proxy if PC is on local LAN
if (isInNet(myIpAddress(), "10.126.160.0", "255.255.248.0"))
return "PROXY homsrv.wpl.ym:3128";
else
return "DIRECT";
}
For the proxy server the Full Qualified Domain Name is used so that it will be found for IPv4 and IPv6. This works for Firefox. Microsoft made another extension to the wpad.dat file that I haven’t tested.
In /etc/nginx/mime.types add the line:
application/x-ns-proxy-autoconfig dat;
Then restart the webserver. Test it from the management workstation with wget:
root@homsrv:~# /etc/rc.d/rc.httpd restart Shutdown Nginx gracefully... Starting Nginx server daemon... root@homsrv:~# exit logout Connection to homsrv closed. mbroek@mgmtws:~$ wget http://wpad.wpl.ym/wpad.dat --2011-07-29 15:03:47-- http://wpad.wpl.ym/wpad.dat Resolving wpad.wpl.ym... 2001:1af8:fecf:7ea0::fd, 10.126.160.253 Connecting to wpad.wpl.ym|2001:1af8:fecf:7ea0::fd|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 698 [application/x-ns-proxy-autoconfig] Saving to: “wpad.dat” 100%[======================================>] 698 --.-K/s in 0s 2011-07-29 15:03:47 (16.3 MB/s) - “wpad.dat” saved [698/698] mbroek@mgmtws:~$
The received wpad.dat file should be exactly the same as the one you placed on the web server. All clients should now automatic find your proxy settings if the browser network connection settings are set to auto detect. The usage of Squid can be followed in /var/log/squid/access.log.
It seems that Firefox 4.xx on Windows XP doesn’t automatic pickup the system’s proxy settings, you need to manually set the proxy server address and port in the network connections setup. Internet Explorer 6 does it right and is even able to pass all tests at http://test-ipv6.com.
Download.
See the download page for the script and configuration files.