🦑 Setting Up Squid Proxy Server on AlmaLinux: Control and Secure Your Network Traffic Like a Security Expert

Hey there, network guardian! 🛡️ Ever wanted to control exactly what websites your network users can access? Or maybe speed up internet browsing by caching frequently visited sites? Well, get ready to meet Squid - your new best friend for managing network traffic!

I still remember setting up my first Squid proxy… it was like becoming the gatekeeper of the internet for my entire office! 🚪 Suddenly, I could block time-wasting sites, cache important resources, and even see what was eating up our bandwidth. By the end of this guide, you’ll have your own Squid proxy running, and honestly, you’ll feel like the master of your network domain! 👑

🤔 Why is Squid Proxy Important?

Squid is like having a smart traffic controller for your internet! 🚦 Let me show you why it’s essential:

The Power of Squid:

• 🚀 Bandwidth Savings - Cache frequently accessed content locally
• 🔐 Access Control - Decide who accesses what and when
• 🛡️ Security Gateway - Filter malicious content before it reaches users
• 📊 Usage Monitoring - Track who’s using bandwidth for what
• 🌍 Anonymous Browsing - Hide internal network structure
• ⚡ Faster Browsing - Serve cached content at LAN speeds
• 💰 Cost Reduction - Reduce internet bandwidth consumption
• 🔧 Content Filtering - Block inappropriate or dangerous websites

🎯 What You Need

Before we become proxy masters, let’s check our equipment! 🛠️ Here’s what you’ll need:

Prerequisites:

• ✅ AlmaLinux 8 or 9 installed and running
• ✅ Root or sudo access (admin powers required!)
• ✅ At least 2GB RAM (4GB+ recommended for caching)
• ✅ 20GB+ disk space for cache storage
• ✅ Two network interfaces (optional but ideal)
• ✅ Basic networking knowledge
• ✅ About 60 minutes of your time
• ✅ Excitement to control your network! 🎉

📝 Step 1: Installing Squid Proxy

Let’s get Squid installed and swimming! 🏊 This is where your proxy journey begins.

Install Squid Package:

# Update your system first - always start fresh!
sudo dnf update -y

# Install Squid proxy server
sudo dnf install squid -y

# Install additional tools for monitoring
sudo dnf install squid-helpers httpd-tools -y

# Check installed version
squid -v
# Output: Squid Cache: Version 4.x - Perfect! ✅

# Enable Squid to start on boot
sudo systemctl enable squid

# Don't start yet - we need to configure first!

# Backup original configuration
sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.backup

echo "Squid installed successfully! 🦑"

Prepare Cache Directories:

# Create cache directory structure
sudo mkdir -p /var/spool/squid
sudo chown -R squid:squid /var/spool/squid

# Create log directory
sudo mkdir -p /var/log/squid
sudo chown -R squid:squid /var/log/squid

# Set proper SELinux contexts
sudo semanage fcontext -a -t squid_cache_t "/var/spool/squid(/.*)?"
sudo restorecon -Rv /var/spool/squid

# Initialize cache directories (important!)
sudo squid -z
# Wait for "Initializing cache directories... done" message

🔧 Step 2: Basic Squid Configuration

Time to configure Squid for your network! 🌐 This is where we define the rules.

Configure Basic Settings:

# Edit Squid configuration
sudo nano /etc/squid/squid.conf

Replace with this optimized configuration:

# Squid Configuration for AlmaLinux
# =================================

# Network Settings
# ----------------
# Define your local network
acl localnet src 192.168.1.0/24    # Your LAN subnet
acl localnet src 10.0.0.0/8        # RFC1918 possible internal network
acl localnet src 172.16.0.0/12     # RFC1918 possible internal network

# Safe ports that are allowed
acl SSL_ports port 443              # HTTPS
acl Safe_ports port 80              # HTTP
acl Safe_ports port 21              # FTP
acl Safe_ports port 443             # HTTPS
acl Safe_ports port 70              # Gopher
acl Safe_ports port 210             # WAIS
acl Safe_ports port 1025-65535      # Unregistered ports
acl Safe_ports port 280             # HTTP-mgmt
acl Safe_ports port 488             # GSS-HTTP
acl Safe_ports port 591             # Filemaker
acl Safe_ports port 777             # Multiling HTTP

# Define CONNECT method
acl CONNECT method CONNECT

# Access Control Rules
# --------------------
# Deny requests to unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to non-SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# Allow localhost
http_access allow localhost

# Allow local network
http_access allow localnet

# Deny all other access
http_access deny all

# Proxy Port Configuration
# ------------------------
# Squid listening port (change if needed)
http_port 3128

# Cache Configuration
# -------------------
# Cache directory: 10GB cache
cache_dir ufs /var/spool/squid 10000 16 256

# Maximum object size to cache
maximum_object_size 100 MB

# Minimum object size to cache
minimum_object_size 0 KB

# Cache memory settings
cache_mem 256 MB
maximum_object_size_in_memory 10 MB

# Cache replacement policy
cache_replacement_policy lru
memory_replacement_policy lru

# How long to keep cached objects
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%      0
refresh_pattern .               0       20%     4320

# Logging Configuration
# ---------------------
# Access log format and location
access_log daemon:/var/log/squid/access.log squid

# Cache log
cache_log /var/log/squid/cache.log

# Store ID log
cache_store_log daemon:/var/log/squid/store.log

# Log rotation
logfile_rotate 10

# Performance Tuning
# ------------------
# DNS settings
dns_nameservers 8.8.8.8 8.8.4.4

# Number of DNS IP addresses to use
dns_v4_first on

# Forwarded for header
forwarded_for on

# Admin Contact
# -------------
cache_mgr [email protected]

# Hostname
visible_hostname proxy.example.com

# Error Page Language
error_default_language en

# Core dumps
coredump_dir /var/spool/squid

Start and Test Squid:

# Check configuration syntax
sudo squid -k parse
# Should show no errors

# Start Squid service
sudo systemctl start squid

# Check status
sudo systemctl status squid
# Should show: Active (running) 🎉

# Open firewall port
sudo firewall-cmd --permanent --add-port=3128/tcp
sudo firewall-cmd --reload

# Test proxy locally
curl -x http://localhost:3128 http://www.google.com
# Should return Google's HTML

🌟 Step 3: Advanced Access Control

Let’s create sophisticated access rules! 🎯 Control exactly who accesses what.

Time-Based Access Control:

# Create time-based ACLs
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Time-based access control
# Work hours definition
acl work_hours time MTWHF 09:00-17:00
acl lunch_break time MTWHF 12:00-13:00
acl weekends time SA

# Allow social media only during lunch and weekends
acl social_media dstdomain .facebook.com .twitter.com .instagram.com
http_access allow social_media lunch_break
http_access allow social_media weekends
http_access deny social_media

# Block streaming during work hours (except lunch)
acl streaming dstdomain .youtube.com .netflix.com .twitch.tv
http_access deny streaming work_hours !lunch_break
EOF

# Reload Squid
sudo systemctl reload squid

User Authentication:

# Create password file for basic authentication
sudo htpasswd -c /etc/squid/passwd user1
# Enter password when prompted

# Add more users
sudo htpasswd /etc/squid/passwd user2
sudo htpasswd /etc/squid/passwd admin

# Configure authentication in Squid
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Authentication configuration
auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Proxy Authentication
auth_param basic credentialsttl 2 hours

# Create ACL for authenticated users
acl authenticated_users proxy_auth REQUIRED

# Require authentication for internet access
http_access deny !authenticated_users
http_access allow authenticated_users localnet
EOF

# Set proper permissions
sudo chmod 640 /etc/squid/passwd
sudo chown squid:squid /etc/squid/passwd

# Restart Squid
sudo systemctl restart squid

Website Filtering:

# Create blocked sites list
sudo tee /etc/squid/blocked_sites.txt << 'EOF'
.gambling.com
.adult-site.com
.malware-site.com
.phishing-example.com
EOF

# Create allowed sites list (whitelist)
sudo tee /etc/squid/allowed_sites.txt << 'EOF'
.company.com
.educational-site.edu
.required-tool.com
EOF

# Add to Squid configuration
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Website filtering
acl blocked_sites dstdomain "/etc/squid/blocked_sites.txt"
acl allowed_sites dstdomain "/etc/squid/allowed_sites.txt"

# Always allow whitelisted sites
http_access allow allowed_sites

# Block blacklisted sites
http_access deny blocked_sites

# Custom error message for blocked sites
deny_info ERR_BLOCKED_SITE blocked_sites
EOF

# Create custom error page
sudo tee /usr/share/squid/errors/en/ERR_BLOCKED_SITE << 'EOF'
<!DOCTYPE html>
<html>
<head>
<title>🚫 Website Blocked</title>
<style>
body { font-family: Arial; text-align: center; margin-top: 100px; }
.error { color: red; font-size: 24px; }
</style>
</head>
<body>
<h1 class="error">🚫 Access Denied</h1>
<p>This website has been blocked by company policy.</p>
<p>If you believe this is an error, contact IT support.</p>
<hr>
<p>Proxy Server: %h | Time: %T</p>
</body>
</html>
EOF

# Reload configuration
sudo systemctl reload squid

✅ Step 4: Monitoring and Optimization

Let’s set up monitoring to see what’s happening! 📊

Enable Cache Manager:

# Configure cache manager access
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Cache Manager Configuration
acl manager_admin src 192.168.1.100/32  # Admin workstation
http_access allow manager_admin manager
cache_mgr [email protected]
EOF

# Install web interface for cache manager
sudo dnf install squid-cachemgr -y

# Configure Apache for cache manager
sudo tee /etc/httpd/conf.d/squid-cachemgr.conf << 'EOF'
ScriptAlias /squid-reports /usr/lib64/squid/cachemgr.cgi

<Location /squid-reports>
    Require ip 192.168.1.0/24
</Location>
EOF

# Restart Apache
sudo systemctl restart httpd

# Access at: http://YOUR_SERVER/squid-reports

Set Up Log Analysis:

# Install SARG (Squid Analysis Report Generator)
sudo dnf install sarg -y

# Configure SARG
sudo nano /etc/sarg/sarg.conf

# Key settings to modify:
# access_log /var/log/squid/access.log
# output_dir /var/www/html/squid-reports
# date_format e
# overwrite_report yes

# Create report directory
sudo mkdir -p /var/www/html/squid-reports

# Generate first report
sudo sarg

# Set up daily report generation
sudo tee /etc/cron.daily/sarg << 'EOF'
#!/bin/bash
/usr/bin/sarg -d day-1
EOF

sudo chmod +x /etc/cron.daily/sarg

echo "Reports available at: http://YOUR_SERVER/squid-reports"

🎮 Quick Examples

Let’s see Squid in action with real scenarios! 🚀

Example 1: Bandwidth Management

# Create bandwidth pools
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Bandwidth Management
# Create delay pools
delay_pools 3

# Pool 1: Management (unlimited)
delay_class 1 1
delay_parameters 1 -1/-1
acl management src 192.168.1.10-192.168.1.20
delay_access 1 allow management
delay_access 1 deny all

# Pool 2: Staff (5 Mbps)
delay_class 2 1
delay_parameters 2 640000/640000
acl staff src 192.168.1.21-192.168.1.100
delay_access 2 allow staff
delay_access 2 deny all

# Pool 3: Guests (1 Mbps)
delay_class 3 1
delay_parameters 3 128000/128000
acl guests src 192.168.1.101-192.168.1.200
delay_access 3 allow guests
delay_access 3 deny all
EOF

# Reload Squid
sudo systemctl reload squid

echo "Bandwidth management configured! 📊"

Example 2: Transparent Proxy Setup

# Configure iptables for transparent proxy
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
    -j REDIRECT --to-port 3128

# Make iptables rules persistent
sudo dnf install iptables-services -y
sudo service iptables save

# Modify Squid for transparent mode
sudo tee -a /etc/squid/squid.conf << 'EOF'

# Transparent proxy configuration
http_port 3128 transparent
EOF

# Enable IP forwarding
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Restart Squid
sudo systemctl restart squid

echo "Transparent proxy active! 👻"

Example 3: SSL Bump (HTTPS Inspection)

# Generate SSL certificates for SSL bumping
sudo mkdir -p /etc/squid/ssl_cert
cd /etc/squid/ssl_cert

# Generate private key and certificate
sudo openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
    -subj "/C=US/ST=State/L=City/O=Company/CN=Squid CA" \
    -keyout squid-ca-key.pem -out squid-ca-cert.pem

# Generate DH parameters
sudo openssl dhparam -out dhparam.pem 2048

# Configure SSL bumping
sudo tee -a /etc/squid/squid.conf << 'EOF'

# SSL Bump Configuration
http_port 3129 ssl-bump \
    cert=/etc/squid/ssl_cert/squid-ca-cert.pem \
    key=/etc/squid/ssl_cert/squid-ca-key.pem \
    generate-host-certificates=on \
    dynamic_cert_mem_cache_size=4MB

# SSL bump rules
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

# Initialize SSL database
sslcrtd_program /usr/lib64/squid/security_file_certgen \
    -s /var/lib/squid/ssl_db -M 4MB
EOF

# Initialize SSL certificate database
sudo /usr/lib64/squid/security_file_certgen -c -s /var/lib/squid/ssl_db
sudo chown -R squid:squid /var/lib/squid/ssl_db

echo "SSL inspection configured! 🔐"

🚨 Fix Common Problems

Don’t worry if something isn’t working! Here are solutions:

Problem 1: Access Denied Errors

# Check ACL order (order matters!)
sudo nano /etc/squid/squid.conf
# Make sure 'allow' rules come before 'deny all'

# Test ACL matching
sudo squid -k parse
# Look for ACL warnings

# Check client IP is in allowed range
ip addr show
# Verify client IP matches ACL

# Debug with access log
sudo tail -f /var/log/squid/access.log
# Look for DENIED entries

Problem 2: Slow Performance

# Increase cache memory
sudo nano /etc/squid/squid.conf
# Increase: cache_mem 512 MB

# Check cache hit ratio
squidclient -h localhost mgr:info | grep "Request Hit Ratios"

# Optimize DNS
# Add faster DNS servers
# dns_nameservers 1.1.1.1 1.0.0.1

# Check disk I/O
iostat -x 5
# If disk is bottleneck, consider SSD for cache

# Restart Squid
sudo systemctl restart squid

Problem 3: Authentication Not Working

# Test password file
/usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
# Type: username password
# Should return: OK

# Check SELinux
sudo setenforce 0  # Temporarily disable
# If this fixes it:
sudo setsebool -P httpd_can_network_connect on
sudo setenforce 1

# Check authentication helper
ps aux | grep ncsa_auth
# Should see helper processes

# Increase auth children if needed
# auth_param basic children 10

📋 Simple Commands Summary

Your Squid command toolkit! 📚 Keep this handy:

💡 Tips for Success

Here are my pro tips for Squid mastery! 🎯

Security Best Practices:

• 🔐 Always use authentication - Know who’s using your proxy
• 🛡️ Regular ACL reviews - Keep access rules current
• 📝 Monitor logs daily - Spot suspicious activity
• 🔒 Use HTTPS inspection carefully - Legal implications
• 🚫 Block known malware sites - Use threat feeds
• 🎯 Implement fail2ban - Prevent brute force
• 💾 Backup configurations - Before major changes
• 🔧 Keep Squid updated - Security patches matter

Performance Optimization:

• ⚡ Size cache appropriately - 10-20% of disk
• 🚀 Use SSD for cache - Dramatic speed improvement
• 📊 Monitor hit ratios - Above 30% is good
• 🎯 Tune memory usage - Based on available RAM
• 💡 Use delay pools - Fair bandwidth distribution
• 🔄 Regular cache maintenance - Clean old objects

🏆 What You Learned

Fantastic work! Look at what you’ve achieved! 🎊

Your Achievements:

• ✅ Installed and configured Squid proxy
• ✅ Set up access control lists
• ✅ Implemented user authentication
• ✅ Configured content filtering
• ✅ Enabled caching for performance
• ✅ Set up monitoring and reporting
• ✅ Configured bandwidth management
• ✅ Learned transparent proxy setup
• ✅ Mastered troubleshooting techniques
• ✅ Became a proxy administrator!

🎯 Why This Matters

Your Squid proxy isn’t just a filter - it’s your network control center! 🌟

With Squid mastery, you can now:

• 🛡️ Protect your network - Filter malicious content
• 💰 Save bandwidth costs - Cache reduces usage
• 📊 Monitor usage patterns - Know what’s happening
• 🚀 Speed up browsing - Cached content loads instantly
• 🔐 Enforce policies - Control access professionally
• 👥 Manage users - Individual access control
• 🎯 Optimize resources - Fair bandwidth sharing
• 🌍 Provide safe internet - Filter inappropriate content

Remember when you had no control over internet usage? Now you’re the guardian of your network, ensuring fast, safe, and efficient internet access for everyone! You’ve transformed from network user to network administrator. That’s absolutely amazing! 🌟

Keep filtering, keep optimizing, and most importantly, enjoy your network control superpowers! 🦸‍♂️

Happy proxying, and welcome to the world of network traffic management! 🙌

P.S. - Don’t forget to review logs regularly. They tell interesting stories about network usage! ⭐