my squid.conf for squidNT (ver 2.6 stable)

http_port 8080
cache_mem 64 MB
cache_swap_low 98
cache_swap_high 99
maximum_object_size 1024 MB
maximum_object_size_in_memory 7999 KB
ipcache_size 163780
ipcache_low 98
ipcache_high 99
cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF
cache_dir ufs C:\cache 10240 16 256
cache_access_log none
cache_log none
cache_store_log none
emulate_httpd_log off
mime_table C:\Squid/etc/mime.conf
pid_filename C:\Squid/log/squid.pid
log_fqdn off
ftp_user Squid@
ftp_passive on
ftp_sanitycheck on
dns_nameservers 202.188.0.133 202.188.1.5 192.168.0.1
diskd_program C:\Squid/libexec/diskd.exe
unlinkd_program C:\Squid/libexec/unlinkd.exe
request_header_max_size 20 KB
request_body_max_size 0 KB
refresh_pattern ftp: 1440 60% 10080
refresh_pattern gopher: 1440 60% 1440
refresh_pattern -i . 0 89% 129600000 override-lastmod reload-into-ims
refresh_pattern -i \.gif 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern -i \.jpg 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern -i \.tif 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern -i \.png 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern -i \.jpeg 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern -i \.bmp 999 99% 129600000 ignore-reload reload-into-ims
refresh_pattern ^ftp: 4320 98% 129600 override-lastmod reload-into-ims
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100%
negative_ttl 1 minutes
positive_dns_ttl 24 hours
negative_dns_ttl 1 minutes
range_offset_limit -1 KB
half_closed_clients off
shutdown_lifetime 10 seconds
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 5050 # yahoo msger
acl Safe_ports port 5100 # yahoo msger webcam 5101
acl Safe_ports port 5101 # yahoo
acl Safe_ports port 5000-5010 # yahoo
acl CONNECT method CONNECT
acl MYLAN src 127.0.0.1-127.0.0.1/255.255.255.255
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl our_networks src 192.168.0.0/255.255.255.0
http_access allow our_networks
http_access allow localhost
http_access deny all
http_reply_access allow all
icp_access allow MYLAN
icp_access allow all
reply_body_max_size 0 allow all
cache_mgr fingerpoppin@gmail.com
cache_effective_user proxy
cache_effective_group proxy
visible_hostname OctopusNT
dns_testnames google.com
logfile_rotate 3
memory_pools off
memory_pools_limit 0
log_icp_queries off
cachemgr_passwd none
store_avg_object_size 1024 KB
store_objects_per_bucket 100
client_db off
netdb_low 900
netdb_high 1000
netdb_ping_period 5 minutes
buffered_logs off
reload_into_ims on
header_access Accept-Encoding deny all
icon_directory C:\Squid/share/icons
offline_mode off
nonhierarchical_direct off
prefer_direct off
coredump_dir C:\Squid/cache
ignore_unknown_nameservers off
client_persistent_connections on
server_persistent_connections on
pipeline_prefetch on
ie_refresh on
vary_ignore_expire on

Transparent Proxy (Squid)

Setting up transparent proxy server

Hi all,

Today, while setting up ip for my internal network, i found out that i have run out of IPs and the internet access was very slow. I ran into a situation called "bottleneck". A situation where a road becomes narrow with heavy traffic. How to speed up this? The answer is proxy server.

On with the theory

Proxy server is a server that can cache visited web pages. Dynamic web pages are not cached. When a client access a website, the proxy server , on behalf of the client access the website and cache it. the next the client or other client wants to connect to the site, the proxy server just give the cached site to the client. Thus reducing the response time from the actual site.

Transparent proxy

In a normal proxy case, you have to set manually for each client to connect to outside. It is not a practical solution if you have a lot of workstations + many apps to connect to the internet. What is more practical solution? The answer is "transparent proxy" and now iptables comes into play.

What you have to do first?
1. Setup a server
OS : Linux (whatever flavor you want)
proxy server : Squid (install the latest one)
utilities : netfilter packages (for iptables)

Squid.conf

Your squid.conf location is dependent on how you install squid package. If u use source code and compile it without tweaking ./configure options, meaning it is in /usr/local/squid/etc. If you use your package manager, it is in /etc. Wherever it is, you have to edit it before you can use it as a transparent proxy.

What to edit
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan


Please change "lan" to suit your network environment. This file is heavily documented. Please read the comments before you change anything unless you know what you're doing.

I don't want to explain in detail on how to setup linux for your server. Please consult your spesific Linux distribution HOWTOs and FAQs. After you have complete setting up Linux, you should setup SQUID. More information on squid, pls visit http://www.squid-cache.org. squid usually readily packaged for your distro. You should check that first whether you can just install it from CD. If not, you have to download from the link above.

After you have edited squid.conf, this is the iptables command you should run on the proxy server.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

provided that your proxy server is using port 3128. If not, change it accordingly.
---------------------------------------------------------------------------------------
thanks to bro zamri

squid configuration

my squid.conf
it works well even on winXp platform.
i dont try this config on linux platform yet.

maybe next time i want to try squid3 devel.

Squid

Squid is...
a full-featured Web proxy cache
free, open-source software
the result of many contributions by unpaid (and paid) volunteers
Squid supports...
proxying and caching of HTTP, FTP, and other URLs
proxying for SSL
cache hierarchies
ICP, HTCP, CARP, Cache Digests
transparent caching
WCCP (Squid v2.3 and above)
extensive access controls
HTTP server acceleration
SNMP
caching of DNS lookups