Home Server Squid Web Proxy Cache


29-Jul-2011: initial release.
08-Dec-2011: changed wpad.dat to use FQDN for proxy.
29-Dec-2011: decreased the cache size.
27-Dec-2012: adjusted for Slackware.



Quote from the Squid web site:

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator.

How useful Squid is on a home network depends on various things:

  1. How fast/slow is your Internet connection.
  2. How fast/slow is your server running Squid.
  3. Do you want to access IPv6 sites for old clients (XP and older).

Even in my situation where Squid runs on a dual 2,5 MHz with a 20 MB Internet connection I still have advantages using Squid, but it is not a big win.


Installing Squid.

Slackware doesn’t have squid in the distribution, so you need to build it yourself. In this article version 3.2.5 is used. After you have build and installed the package, configure Squid in /etc/squid/squid.conf:

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src        # Our private IPv4 range
acl localnet src fc00::/7     # RFC 4193 local private network range
acl localnet src fe80::/10    # RFC 4291 link-local (directly plugged) machines
acl localnet src 2001:1af8:fecf::/48    # Our private IPv6 range

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_Ports port 81          # 80+1
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http

# Recommended minimum Access Permission configuration:
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost


# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/cache/squid 128 16 128
cache_mem 64 MB

# Disable logrotate, use cron
logfile_rotate 0

# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

# FTP user for anonymous login
ftp_user squid@wpl.uk

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

# Cache manager email
cache_mgr admin@wpl.uk

# Snmp options
acl snmppublic snmp_community public
snmp_port 3401
snmp_access allow snmppublic localhost
snmp_access deny all

memory_pools off


A few remarks. The default installation uses a memory cache, in this setup I use a disk cache with memory cache. A disk cache is slower, but “remembers” all cached objects between reboots. It is just a personal choice what you like best. I also lowered the disk cache from 256 to 128 MB and the memory cache from 256 to 64 MB. The default setup is for medium size intra net proxies, for home use you probably don’t need the default size. Try and experiment what works best for you.

Second, I have snmp enabled. If you don’t want to use that, you can leave it off.

Now you may start Squid:

root@homsrv:~# /etc/rc.d/init.d/squid start
Building squid cache in /var/cache/squid Starting Squid /usr/sbin/squid -F


Only the very first time you will see that Swap directories are created. To make it so that squid is started every time when the server boots, run pkgtool -> setup -> squid to enable squid at boot. You can now change your browser settings to use a proxy on homsrv.wpl.ym port 3128.


Setup wpad.dat

The Web Proxy Autodiscovery Protocol is used to tell the client machines where our Squid web proxy is and which port it uses. We need to add an alias to our DNS so that we can resolve wpad.wpl.ym. If you use the bind nameserver then In /srv/named/int/db.wpl.ym add:

wpad           CNAME   homsrv


Before you add this line, do a rndc freeze, then edit and increase the serial number, and finish with the rndc thaw command. If you use dnsmasq, then add the wpad name to the homsrv addresses in the file /etc/dnsmasq.hosts.

Then create a /srv/http/htdocs/wpad.dat file:

function FindProxyForURL(url, host)
        // variable strings to return
        var proxy_yes = "PROXY homsrv.wpl.ym:3128";
        var proxy_no = "DIRECT";
        if (shExpMatch(url, "*//localhost*")) { return proxy_no; }
        if (shExpMatch(url, "*.ym*")) { return proxy_no; }
        if (shExpMatch(url, "*.wpl.ym*")) { return proxy_no; }
        if (shExpMatch(url, "*.wpl.uk*")) { return proxy_no; }
        if (shExpMatch(url, "*.local*")) { return proxy_no; }
        if (shExpMatch(url, "http://10.*")) { return proxy_no; }
        if (shExpMatch(url, "https://10.*")) { return proxy_no; }

        // Proxy if PC is on local LAN
        if (isInNet(myIpAddress(), "", ""))
                return "PROXY homsrv.wpl.ym:3128";
                return "DIRECT";


For the proxy server the Full Qualified Domain Name is used so that it will be found for IPv4 and IPv6. This works for Firefox. Microsoft made another extension to the wpad.dat file that I haven’t tested.

In /etc/nginx/mime.types add the line:

application/x-ns-proxy-autoconfig               dat;


Then restart the webserver. Test it from the management workstation with wget:

root@homsrv:~# /etc/rc.d/rc.httpd restart
Shutdown Nginx gracefully...
Starting Nginx server daemon...
root@homsrv:~# exit
Connection to homsrv closed.
mbroek@mgmtws:~$ wget http://wpad.wpl.ym/wpad.dat
--2011-07-29 15:03:47--  http://wpad.wpl.ym/wpad.dat
Resolving wpad.wpl.ym... 2001:1af8:fecf:7ea0::fd,
Connecting to wpad.wpl.ym|2001:1af8:fecf:7ea0::fd|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 698 [application/x-ns-proxy-autoconfig]
Saving to: “wpad.dat”

100%[======================================>] 698         --.-K/s   in 0s      

2011-07-29 15:03:47 (16.3 MB/s) - “wpad.dat” saved [698/698]



The received wpad.dat file should be exactly the same as the one you placed on the web server. All clients should now automatic find your proxy settings if the browser network connection settings are set to auto detect. The usage of Squid can be followed in /var/log/squid/access.log.

It seems that Firefox 4.xx on Windows XP doesn’t automatic pickup the system’s proxy settings, you need to manually set the proxy server address and port in the network connections setup. Internet Explorer 6 does it right and is even able to pass all tests at http://test-ipv6.com.



See the download page for the script and configuration files.