Setting up Explicit Squid Proxy - Revision history

Fturco: replace http:// with https://

2026-05-03T08:57:01Z

replace http:// with https://

← Older revision		Revision as of 08:57, 3 May 2026
Line 1:		Line 1:
	[~~http~~://www.squid-cache.org/ Squid]~~{{insecure url\|https loads an entirely different site unrelated to squid}}~~ is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It is licensed under the [https://gnu.org/licenses/gpl.html GNU GPL].		[https://www.squid-cache.org/ Squid] is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It is licensed under the [https://gnu.org/licenses/gpl.html GNU GPL].

	If you are looking to setup a transparent squid proxy, see [[Setting up Transparent Squid Proxy\|this page]]		If you are looking to setup a transparent squid proxy, see [[Setting up Transparent Squid Proxy\|this page]]
Line 231:		Line 231:

	== SSL interception or SSL bumping ==		== SSL interception or SSL bumping ==
	The offical squid documentation appears to prefer the term ''SSL interception'' for [[Setting up Transparent Squid Proxy\|transparent]] squid deployments and ''SSL bumping'' for explicit proxy deployments. Nonetheless, both environments use the [~~http~~://www.squid-cache.org/Doc/config/ssl_bump/ ssl_bump configuration directive] (and some others) in <code>/etc/squid/squid.conf</code> for their configuration.		The offical squid documentation appears to prefer the term ''SSL interception'' for [[Setting up Transparent Squid Proxy\|transparent]] squid deployments and ''SSL bumping'' for explicit proxy deployments. Nonetheless, both environments use the [https://www.squid-cache.org/Doc/config/ssl_bump/ ssl_bump configuration directive] (and some others) in <code>/etc/squid/squid.conf</code> for their configuration.
	In general terminology, ''SSL interception'' is generally used to describe both deployments and that will be the term used here. We are, of course, dealing with an ''explicit forward proxy'' configuration here.		In general terminology, ''SSL interception'' is generally used to describe both deployments and that will be the term used here. We are, of course, dealing with an ''explicit forward proxy'' configuration here.

Line 426:		Line 426:
	== More information ==		== More information ==

	[~~http~~://www.squid-cache.org/Doc/config/ Squid configuration directives]{{insecure url\|https loads an entirely different site unrelated to squid}}		[https://www.squid-cache.org/Doc/config/ Squid configuration directives]{{insecure url\|https loads an entirely different site unrelated to squid}}

	[https://linux.die.net/man/8/squid Squid man page]		[https://linux.die.net/man/8/squid Squid man page]

Zcrayfish: Fixed a dead link.

2023-08-30T22:14:34Z

Fixed a dead link.

← Older revision		Revision as of 22:14, 30 August 2023
Line 41:		Line 41:

	=== More information ===		=== More information ===
	You may also wish to review https://~~devcentral~~.f5.com/articles/the-concise-guide-to-proxies which provides further information on various proxy types.		You may also wish to review https://community.f5.com/t5/technical-articles/the-concise-guide-to-proxies/ta-p/285459 which provides further information on various proxy types.

	== Installation ==		== Installation ==

Zcrayfish: /* Configure the client */ Rescued a link.

2023-08-26T06:26:29Z

Configure the client: Rescued a link.

← Older revision		Revision as of 06:26, 26 August 2023
Line 218:		Line 218:
	* Click '''OK''' to save the changes.		* Click '''OK''' to save the changes.

	The [https://wiki.archlinux.org/index.php/~~Proxy_settings~~ system proxy settings]~~{{dead link}}~~ themselves vary from system to system but on an Alpine install you can simply run the [[Alpine Setup Scripts#setup-proxy\|setup-proxy]] script.		The [https://wiki.archlinux.org/index.php/Proxy_server system proxy settings] themselves vary from system to system but on an Alpine install you can simply run the [[Alpine Setup Scripts#setup-proxy\|setup-proxy]] script.

	It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).		It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).

Zcrayfish: /* More information */ Marked a URL that we don't want to rewrite as HTTPS

2023-08-26T06:18:27Z

More information: Marked a URL that we don't want to rewrite as HTTPS

← Older revision		Revision as of 06:18, 26 August 2023
Line 426:		Line 426:
	== More information ==		== More information ==

	[http://www.squid-cache.org/Doc/config/ Squid configuration directives]		[http://www.squid-cache.org/Doc/config/ Squid configuration directives]{{insecure url\|https loads an entirely different site unrelated to squid}}

	[https://linux.die.net/man/8/squid Squid man page]		[https://linux.die.net/man/8/squid Squid man page]

Zcrayfish: /* More information */ Rescued a dead link.

2023-08-26T06:17:10Z

More information: Rescued a dead link.

← Older revision		Revision as of 06:17, 26 August 2023
Line 430:		Line 430:
	[https://linux.die.net/man/8/squid Squid man page]		[https://linux.die.net/man/8/squid Squid man page]

	[https://wiki.archlinux.org/~~index.php~~/Squid Squid Arch linux wiki page]~~{{dead link}}~~		[https://wiki.archlinux.org/title/Squid Squid Arch linux wiki page]

	[[Category:Server]]		[[Category:Server]]

Sertonix: update links

2023-08-25T11:45:43Z

update links

← Older revision		Revision as of 11:45, 25 August 2023
Line 235:		Line 235:

	==== Behaviour without SSL interception ====		==== Behaviour without SSL interception ====
	Clients behind an explicit proxy use the [https://~~tools~~.~~ietf~~.org/rfc/rfc2817 'CONNECT'] HTTP method. The first connection to the proxy port uses HTTP and specifies the destination server (often termed the Origin Content Server, or OCS). After this the proxy simply acts as a [https://~~tools~~.ietf.org/id/draft-luotonen-web-proxy-tunneling-01.txt tunnel], and blindly proxies the connection without inspecting the traffic.		Clients behind an explicit proxy use the [https://www.rfc-editor.org/rfc/rfc2817 'CONNECT'] HTTP method. The first connection to the proxy port uses HTTP and specifies the destination server (often termed the Origin Content Server, or OCS). After this the proxy simply acts as a [https://datatracker.ietf.org/doc/id/draft-luotonen-web-proxy-tunneling-01.txt tunnel], and blindly proxies the connection without inspecting the traffic.

	==== Behaviour with SSL interception ====		==== Behaviour with SSL interception ====
	Using this method, clients still use the [https://~~tools~~.~~ietf~~.org/rfc/rfc2817 CONNECT] method. Typically the server-side connection is established first, using the information available in the CONNECT request from the client (such as the destination server and port) which allows Squid to spoof a certificate. The Common Name (CN) will reflect the destination server and the Squid certificate will be used to sign it. This spoofed certificate is then presented to the client when they access a site via the proxy.		Using this method, clients still use the [https://www.rfc-editor.org/rfc/rfc2817 CONNECT] method. Typically the server-side connection is established first, using the information available in the CONNECT request from the client (such as the destination server and port) which allows Squid to spoof a certificate. The Common Name (CN) will reflect the destination server and the Squid certificate will be used to sign it. This spoofed certificate is then presented to the client when they access a site via the proxy.

	==== Configuration ====		==== Configuration ====

Zcrayfish: Marked some dead links.

2023-08-25T02:39:59Z

Marked some dead links.

← Older revision		Revision as of 02:39, 25 August 2023
Line 218:		Line 218:
	* Click '''OK''' to save the changes.		* Click '''OK''' to save the changes.

	The [https://wiki.archlinux.org/index.php/Proxy_settings system proxy settings] themselves vary from system to system but on an Alpine install you can simply run the [[Alpine Setup Scripts#setup-proxy\|setup-proxy]] script.		The [https://wiki.archlinux.org/index.php/Proxy_settings system proxy settings]{{dead link}} themselves vary from system to system but on an Alpine install you can simply run the [[Alpine Setup Scripts#setup-proxy\|setup-proxy]] script.

	It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).		It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).
Line 430:		Line 430:
	[https://linux.die.net/man/8/squid Squid man page]		[https://linux.die.net/man/8/squid Squid man page]

	[https://wiki.archlinux.org/index.php/Squid Squid Arch linux wiki page]		[https://wiki.archlinux.org/index.php/Squid Squid Arch linux wiki page]{{dead link}}

	[[Category:Server]]		[[Category:Server]]

Zcrayfish: hyperlink cleanup. wip.

2023-07-29T06:56:34Z

hyperlink cleanup. wip.

Zcrayfish: Removed a hyperlink to a hypothetical URL. Used path template on a filepath that I saw. Other minor changes.

2021-12-20T22:16:48Z

Removed a hyperlink to a hypothetical URL. Used path template on a filepath that I saw. Other minor changes.

← Older revision		Revision as of 22:16, 20 December 2021
Line 49:		Line 49:
	If you wish to use the Alpine Configuration Framework (ACF) front-end for squid, install the {{Pkg\|acf-squid}} package:		If you wish to use the Alpine Configuration Framework (ACF) front-end for squid, install the {{Pkg\|acf-squid}} package:
	{{Cmd\|apk add acf-squid}}		{{Cmd\|apk add acf-squid}}
	You can then logon to the device over https://x.x.x.x (replace x.x.x.x with the IP of your server of course) and manage the squid configuration files and stop/start/restart the daemon etc.		You can then logon to the device over <nowiki>https://x.x.x.x</nowiki> (replace x.x.x.x with the IPv4 address of your server of course) and manage the squid configuration files and stop/start/restart the daemon etc.

	== Basic configuration ==		== Basic configuration ==
	=== Config file ===		=== Config file ===
	The main configuration file is ~~<code>~~/etc/squid/squid.conf~~</code>~~. Lines beginning with a '#' are comments.		The main configuration file is {{path\|/etc/squid/squid.conf}}. Lines beginning with a '#' are comments.
	squid should already come with a basic working configuration file but an example configuration file is shown below, which will get you up and running quickly and is well commented but please change the localnet definition for a more restrictive one:		squid should already come with a basic working configuration file but an example configuration file is shown below, which will get you up and running quickly and is well commented but please change the localnet definition for a more restrictive one:

Zcrayfish: Marked a dead link.

2021-12-20T19:51:03Z

Marked a dead link.

← Older revision		Revision as of 19:51, 20 December 2021
Line 270:		Line 270:
	You then need to supply the CSR (Certificate Signing Request) to your Certificate Authority (CA). '''Do not send them, or anyone else, your private key. It should remain private!'''		You then need to supply the CSR (Certificate Signing Request) to your Certificate Authority (CA). '''Do not send them, or anyone else, your private key. It should remain private!'''

	Some CA's (such as [http://www.thawte.nl/en/support/test+your+csr/ Thawte] and [https://ssl-tools.verisign.com/checker/ Verisign]) provide an online CSR checker, so you can ensure the CSR is valid before providing it to them.		Some CA's (such as [http://www.thawte.nl/en/support/test+your+csr/ Thawte]{{dead link}} and [https://ssl-tools.verisign.com/checker/ Verisign]) provide an online CSR checker, so you can ensure the CSR is valid before providing it to them.

	Once the CA receive the CSR and do their thing they should send you back the CA signed public key. Request it in .pem format if possible (it's a widely used standard for certs). You then need to copy this back onto the Squid proxy, to {{Path\|/etc/squid/}} if you are following the example here.		Once the CA receive the CSR and do their thing they should send you back the CA signed public key. Request it in .pem format if possible (it's a widely used standard for certs). You then need to copy this back onto the Squid proxy, to {{Path\|/etc/squid/}} if you are following the example here.

← Older revision		Revision as of 06:56, 29 July 2023
Line 1:		Line 1:
	[http://www.squid-cache.org/ Squid] is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It is licensed under the [https://gnu.org/licenses/gpl.html GNU GPL].		[http://www.squid-cache.org/ Squid]{{insecure url\|https loads an entirely different site unrelated to squid}} is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator. It is licensed under the [https://gnu.org/licenses/gpl.html GNU GPL].

	If you are looking to setup a transparent squid proxy, see [[Setting up Transparent Squid Proxy\|this page]]		If you are looking to setup a transparent squid proxy, see [[Setting up Transparent Squid Proxy\|this page]]
Line 9:		Line 9:

	=== proxy ===		=== proxy ===
	A [https://en.wikipedia.org/wiki/Proxy_server proxy] is a device which makes connections on behalf of clients. If we consider a common [~~http~~://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] connection, there is one ~~[http://en.wikipedia.org/wiki/Transmission_Control_Protocol~~ TCP] connection between the client (source) and the proxy, and a separate TCP connection between the proxy and the server (destination). Consider this beautiful diagram:		A [https://en.wikipedia.org/wiki/Proxy_server proxy] is a device which makes connections on behalf of clients. If we consider a common [https://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] connection, there is one TCP connection between the client (source) and the proxy, and a separate TCP connection between the proxy and the server (destination). Consider this beautiful diagram:
	<pre>		<pre>
	Client<---------->\|PROXY\|<------------>Server		Client<---------->\|PROXY\|<------------>Server
Line 222:		Line 222:
	It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).		It is also possible to configure the browser to use a [https://en.wikipedia.org/wiki/Proxy_auto-config PAC file]. This file is usually hosted on a webserver (which may also be the proxy, but doesn't have to be) and it tells the browser what requests to send to the proxy and which ones to send direct (bypassing the proxy).

	The [~~http~~://wiki.squid-cache.org/SquidFaq/ConfiguringBrowsers Squid FAQ on configuring browsers] offers more information on this topic.		The [https://wiki.squid-cache.org/SquidFaq/ConfiguringBrowsers Squid FAQ on configuring browsers] offers more information on this topic.

	==== Logs ====		==== Logs ====
Line 235:		Line 235:

	==== Behaviour without SSL interception ====		==== Behaviour without SSL interception ====
	Clients behind an explicit proxy use the [~~http~~://tools.ietf.org/rfc/rfc2817 'CONNECT'] HTTP method. The first connection to the proxy port uses HTTP and specifies the destination server (often termed the Origin Content Server, or OCS). After this the proxy simply acts as a [~~http~~://tools.ietf.org/id/draft-luotonen-web-proxy-tunneling-01.txt tunnel], and blindly proxies the connection without inspecting the traffic.		Clients behind an explicit proxy use the [https://tools.ietf.org/rfc/rfc2817 'CONNECT'] HTTP method. The first connection to the proxy port uses HTTP and specifies the destination server (often termed the Origin Content Server, or OCS). After this the proxy simply acts as a [https://tools.ietf.org/id/draft-luotonen-web-proxy-tunneling-01.txt tunnel], and blindly proxies the connection without inspecting the traffic.

	==== Behaviour with SSL interception ====		==== Behaviour with SSL interception ====
	Using this method, clients still use the [~~http~~://tools.ietf.org/rfc/rfc2817 CONNECT] method. Typically the server-side connection is established first, using the information available in the CONNECT request from the client (such as the destination server and port) which allows Squid to spoof a certificate. The Common Name (CN) will reflect the destination server and the Squid certificate will be used to sign it. This spoofed certificate is then presented to the client when they access a site via the proxy.		Using this method, clients still use the [https://tools.ietf.org/rfc/rfc2817 CONNECT] method. Typically the server-side connection is established first, using the information available in the CONNECT request from the client (such as the destination server and port) which allows Squid to spoof a certificate. The Common Name (CN) will reflect the destination server and the Squid certificate will be used to sign it. This spoofed certificate is then presented to the client when they access a site via the proxy.

	==== Configuration ====		==== Configuration ====
Line 270:		Line 270:
	You then need to supply the CSR (Certificate Signing Request) to your Certificate Authority (CA). '''Do not send them, or anyone else, your private key. It should remain private!'''		You then need to supply the CSR (Certificate Signing Request) to your Certificate Authority (CA). '''Do not send them, or anyone else, your private key. It should remain private!'''

	Some CA's ~~(such as [http://www.thawte.nl/en/support/test+your+csr/ Thawte]{{dead link}} and [https://ssl-tools.verisign.com/checker/ Verisign])~~ provide an online CSR checker, so you can ensure the CSR is valid before providing it to them.		Some CA's provide an online CSR checker, so you can ensure the CSR is valid before providing it to them.

	Once the CA receive the CSR and do their thing they should send you back the CA signed public key. Request it in .pem format if possible (it's a widely used standard for certs). You then need to copy this back onto the Squid proxy, to {{Path\|/etc/squid/}} if you are following the example here.		Once the CA receive the CSR and do their thing they should send you back the CA signed public key. Request it in .pem format if possible (it's a widely used standard for certs). You then need to copy this back onto the Squid proxy, to {{Path\|/etc/squid/}} if you are following the example here.
Line 342:		Line 342:
	==== Further reading ====		==== Further reading ====

	[~~http~~://wiki.squid-cache.org/Features/HTTPS Squid HTTPS feature]		[https://wiki.squid-cache.org/Features/HTTPS Squid HTTPS feature]

	[~~http~~://wiki.squid-cache.org/Features/SslBump Squid SSL bump feature]		[https://wiki.squid-cache.org/Features/SslBump Squid SSL bump feature]

	[~~http~~://wiki.squid-cache.org/Features/BumpSslServerFirst Squid bump-server-first feature]		[https://wiki.squid-cache.org/Features/BumpSslServerFirst Squid bump-server-first feature]

	[~~http~~://wiki.squid-cache.org/Features/MimicSslServerCert Squid SSL cert mimic feature]		[https://wiki.squid-cache.org/Features/MimicSslServerCert Squid SSL cert mimic feature]

	[~~http~~://wiki.squid-cache.org/Features/DynamicSslCert Squid dynamic certificate generation page]		[https://wiki.squid-cache.org/Features/DynamicSslCert Squid dynamic certificate generation page]

	== Advert blocking ==		== Advert blocking ==
Line 358:		Line 358:
	Blocking ads will save bandwidth and should improve page load times. As a drawback, some pages may look untidy or odd without advertising in place.		Blocking ads will save bandwidth and should improve page load times. As a drawback, some pages may look untidy or odd without advertising in place.

	The first thing to do is either create a hosts file yourself or find a pre-configured one such as [~~http~~://winhelp2002.mvps.org/hosts.txt this one] (note that this file is free to use for personal use only, see the full license [~~http~~://creativecommons.org/licenses/by-nc-sa/3.0/ here].		The first thing to do is either create a hosts file yourself or find a pre-configured one such as [https://winhelp2002.mvps.org/hosts.txt this one] (note that this file is free to use for personal use only, see the full license [https://creativecommons.org/licenses/by-nc-sa/4.0/ here].

	Whichever method you choose, save the hosts file to the local filesystem, in our example to <code>/etc/squid/hosts.txt</code>		Whichever method you choose, save the hosts file to the local filesystem, in our example to <code>/etc/squid/hosts.txt</code>
Line 428:		Line 428:
	[http://www.squid-cache.org/Doc/config/ Squid configuration directives]		[http://www.squid-cache.org/Doc/config/ Squid configuration directives]

	[~~http~~://linux.die.net/man/8/squid Squid man page]		[https://linux.die.net/man/8/squid Squid man page]

	[https://wiki.archlinux.org/index.php/Squid Squid Arch linux wiki page]		[https://wiki.archlinux.org/index.php/Squid Squid Arch linux wiki page]

	[[Category:Server]]		[[Category:Server]]