Squid 3: How to make Transparent proxy with Authentication
Source: squid-cache.org
Squid is a caching proxy supports HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. In this tutorial we are going to make a transparent proxy with basic HTTP authentication using Squid 3. Transparent proxy means websites will not know we are using a proxy server to access it and basic authentication will prevent abuse.
Previous Steemit and Utopian article on this:
If there is already 2 and many other not mentioned in this post, why are you writing another?
Because first one doesn't make transparent proxy, second one is not in English, also my configuration is different from their's and I am using it for 3 years without any problem.
Lets Get Started:
Requirements:
- A Ubuntu 16.04 VPS (Squid can be installed in other distributions, but I am using Ubuntu)
- Terminal
- Basic command and text editing skill in terminal
Skill Level
Beginner
Step 01: Installing the Packages
Connect to the VPS using Terminal and update the repository using following commands.
ssh root@YOUR_VPS_IP enter your root password. After login type apt update && apt dist-upgrade to update repositories and packages. If you are not root, use sudo in front of each command.
Install Squid3 and Apache Utills using following command. apache2-utils provides htpasswd command for generating basic authentication file with usernames and passwords.
apt install squid3 apache2-utils -y
Step 02: Squid3 Configuration
First create a backup of current configuration file using mv /etc/squid/squid.conf /etc/squid/squid.conf.bak command.
Create a new configuration file typing nano /etc/squid/squid.conf command. it will open up a black file in nano text editor. Copy and paste following codes. You can paste into the text file using Shift + Ctrl + V, then type Ctrl + X to exit. It will prompt you to save or cancel. Type Shift + Y and press enter to save as squid.conf.
# Enabling basic authentication
auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid/users
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users
# Defining Access Control List (ACL) rule set for local IPs
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
# Defining ACL SSL port
acl SSL_ports port 443
# Defining some other commonly used ports as Safe ports
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# Denying connection which are not to localnet, Safe ports or SSL port
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access allow all
# Setting Squid port
http_port 3128
via off
forwarded_for off
# These request headers make Proxy connection transparent
request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access WWW-Authenticate allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
refresh_pattern . 0 20% 4320
You can change the port from 3128 to whatever empty port you like. But before changing port you need to open up that post to receive traffic.
When UFW available: ufw allow PORT_NUMBER
With iptables: iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport PORT_NUMBER -j ACCEPT
We have added /etc/squid/users as our auth file at the top of the configuration. So, let make one and add a username and password combination.
htpasswd -c /etc/squid/users YOUR_USERNAME
This will prompt for your password. Enter password and confirm it, press Enter to save. Thats about it.
Restart using service squid3 restart command. If it fails use service squid restart. New configuration will take effect after restart.
Configuring Client
Firefox
Go to Preference (about:preferences). At the bottom of the page find Network Proxy click Setting button beside it. This will open up Connection Settings popup. Select Manual proxy configuration and enter your VPS IP, click OK to save configuration. When you will try to connect to Internet, it will ask for username and password once per session.
Chrome
Chrome doesn't have built in proxy settings at least in Linux. It uses Desktop's proxy configuration. Go to Desktop's Network settings then Network proxy, set Manual and put VPS's IP and port 3128. When you will try to connect to Internet, it will ask for username and password once per session.
Posted on Utopian.io - Rewarding Open Source Contributors