How to Install Squid Proxy Server on Ubuntu 16.04

Posted on April 10, 2019 by David Singer
Category: Tutorials, Uncategorized | Tags: caching, dns hosting, installation, port, timezone, web server

Reading Time: 6 minutes

A Squid Proxy Server is a feature rich web server application that provides both reverse proxy services and caching options for websites. This provides a noticeable speed up of sites and allows for reduced load times when being utilized.

Squids reverse proxy is a service that sits between the Internet and the web server (usually within a private network) that redirects inbound client requests to a server where data is stored for easier retrieval. If the caching server (proxy) does not have the cached data, it then forwards the request on to the web server where the data is actually stored. This type of caching allows for the collection of data and reproducing the original data values stored in a different location to provide for easier access. A reverse proxy typically provides an additional layer of control to smooth the flow of inbound network traffic between your clients and the web server.

Squid can be used as a caching service to SSL requests as well as DNS lookups. It can also provide a wide variety of support to multiple other types of caching protocols, such as ICP, HTCP, CARP, as well as WCCP. Squid is an excellent choice for many types of setups as it provides very granular controls by offering numerous system tools, as well as a monitoring framework using SNMP to provide a solid base for your caching needs.

When selecting a computer system for use as a dedicated Squid caching proxy server, many users ensure it is configured with a large amount of physical memory (RAM) as Squid maintains an in-memory cache for increased performance.

Installing Squid

Let’s start by ensuring our server is up to date:
[root@test ~]# apt-get update Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [109 kB]Hit:2 http://us.archive.ubuntu.com/ubuntu xenial InReleaseHit:3 http://ppa.launchpad.net/libreoffice/ppa/ubuntu xenial InReleaseGet:4 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease [109 kB]Get:5 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease [107 kB]Fetched 325 kB in 0s (567 kB/s)Reading package lists... Done
Next, at the terminal prompt, enter the following command to install the Squid server:
[root@test ~]# apt install squid Reading package lists... DoneBuilding dependency treeReading state information... DoneThe following packages were automatically installed and are no longer required:linux-headers-4.4.0-141 linux-headers-4.4.0-141-generic linux-image-4.4.0-141-genericUse 'apt autoremove' to remove them. The following additional packages will be installed: libecap3 squid-common squid-langpack ssl-cert Suggested packages: squidclient squid-cgi squid-purge smbclient ufw winbindd openssl-blacklist The following NEW packages will be installed: libecap3 squid squid-common squid-langpack ssl-cert 0 upgraded, 5 newly installed, 0 to remove and 64 not upgraded. Need to get 2,672 kB of archives. After this operation, 10.9 MB of additional disk space will be used. Do you want to continue? [Y/n] Y Fetched 2,672 kB in 0s (6,004 kB/s) Preconfiguring packages ... Selecting previously unselected package libecap3:amd64. (Reading database ... 160684 files and directories currently installed.) Preparing to unpack .../libecap3_1.0.1-3ubuntu3_amd64.deb ... Unpacking libecap3:amd64 (1.0.1-3ubuntu3) ... Selecting previously unselected package squid-langpack. Preparing to unpack .../squid-langpack_20150704-1_all.deb ... Unpacking squid-langpack (20150704-1) ... Selecting previously unselected package squid-common. Preparing to unpack .../squid-common_3.5.12-1ubuntu7.6_all.deb ... Unpacking squid-common (3.5.12-1ubuntu7.6) ... Selecting previously unselected package ssl-cert. Preparing to unpack .../ssl-cert_1.0.37_all.deb ... Unpacking ssl-cert (1.0.37) ... Selecting previously unselected package squid. Preparing to unpack .../squid_3.5.12-1ubuntu7.6_amd64.deb ... Unpacking squid (3.5.12-1ubuntu7.6) ... Processing triggers for libc-bin (2.23-0ubuntu10) ... Processing triggers for systemd (229-4ubuntu21.16) ... Processing triggers for ureadahead (0.100.0-19) ... Setting up libecap3:amd64 (1.0.1-3ubuntu3) ... Setting up squid-langpack (20150704-1) ... Setting up squid-common (3.5.12-1ubuntu7.6) ... Setting up ssl-cert (1.0.37) ... Setting up squid (3.5.12-1ubuntu7.6) ... Skipping profile in /etc/apparmor.d/disable: usr.sbin.squid Processing triggers for libc-bin (2.23-0ubuntu10) ... Processing triggers for systemd (229-4ubuntu21.16) ... Processing triggers for ureadahead (0.100.0-19) ...
That’s it! The install is complete!

Configuring Squid

The default Squid configuration file is located in the ‘/etc/squid/ directory, and the main configuration file is called “squid.conf”. This file contains the bulk of the configuration directives that can be modified to change the behavior of Squid. The lines that begin with a “#”, are commented out or not read by the file. These comments are provided to explain what the related configuration settings mean.

To edit the configuration file, let’s start by taking a backup of the original file, in case we need to revert any changes if something goes wrong or use it to compare the new file configurations.

[root@test ~]# cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

Change Squid’s Default Listening Port

Next, the Squid proxy servers default port is 3128. You can change or modify this setting to suit your needs should you wish to modify the port for a specific reason or necessity. To change the default Squid port, we will need to edit the Squid configuration file and change the “http_port” value (on line 1599) to a new port number.

[root@test ~]# vim /etc/squid/squid.conf http_port 2946

(Keep the file open for now…)

Change Squid’s Default HTTP Access Port

Next, to allow external access to the HTTP proxy server from all IP addresses, we need to edit the “http_access” directives. By default, the HTTP proxy server will not allow access to anyone at all unless we explicitly allow it!

Caution!:

Multiple settings mention http_access. We want to modify the last entry.

1164 # Deny requests to certain unsafe ports 1165 http_access deny !Safe_ports ... 1167 # Deny CONNECT to other than secure SSL ports 1168 http_access deny CONNECT !SSL_ports ... 1170 # Only allow cachemgr access from localhost 1171 http_access allow localhost manager 1172 http_access deny manager ... 1186 #http_access allow localnet 1187 http_access allow localhost ... 1189 # And finally deny all other access to this proxy 1190 http_access deny all # > change to “allow all” <

Now, let’s save and close the configuration file using vim’s :wq command.

Define the Default NIC Card Squid Listens On

If you would like Squid to listen on a specific NIC (in a server with multiple NIC cards), you can update the configuration file with the NIC’s IP address that Squid will listen on.

For example, we can change it to an internal IP of 10.1.1.5:3128

Define Who Can Access the Proxy Server

Next, we’ll setup who is allowed access to our Squid proxy. Locate the http_access section (which should begin around line 1860) and uncomment the following two lines:#acl our_networks src 10.1.1.0/16 10.1.2.0/16 #http_access allow our_networks -- VVV change to VVV -- acl our_networks src 10.1.1.0/16 10.1.2.0/16 http_access allow our_networks

You will need to modify the IP ranges (10.1.1.0/16 10.1.2.0/16) to your own internal IP’s to match what your network uses unless you have several subnets you can use. (Netmasks are further explained here.)

Define the Hours that are Available to Access the Proxy

You can literally control the hours of access to the proxy server! The ACL section starts about line 673:
671 # none 672 673 # TAG: acl 674 # Defining an Access List 675 #To set this up, let’s add this info to the bottom of the ACL section of the /etc/squid/squid.conf file:

acl liquidweb src 10.1.10.0/24 acl liquidweb time M T W T F 9:00-17:00Granted, this is an example using liquidweb as the business name, but you can use any name.

Other ACL options include:

***** ACL TYPES AVAILABLE ***** 711 # 712 # acl aclname src ip-address/mask ... # clients IP address [fast] 713 # acl aclname src addr1-addr2/mask ... # range of addresses [fast] 714 # acl aclname dst [-n] ip-address/mask ... # URL host's IP address [slow] 715 # acl aclname localip ip-address/mask ... # IP address the client connected to [fast] 717 # acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation) ... 730 # acl aclname srcdomain .foo.com ... 731 # # reverse lookup, from client IP [slow] 732 # acl aclname dstdomain [-n] .foo.com ... 733 # # Destination server from URL [fast] 734 # acl aclname srcdom_regex [-i] \.foo\.com ... 735 # # regex matching client name [slow] 736 # acl aclname dstdom_regex [-n] [-i] \.foo\.com … … … (all the way down to line 989) … 968 # Example rule allowing access from your local networks. 969 # Adapt to list your (internal) IP networks from where browsing 970 # should be allowed 971 #acl localnet src 10.0.0.0/8 # RFC1918 possible internal network 972 #acl localnet src 172.16.0.0/12 # RFC1918 possible internal network 973 #acl localnet src 192.168.0.0/16 # RFC1918 possible internal network 974 #acl localnet src fc00::/7 # RFC 4193 local private network range 975 #acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines 976 977 acl SSL_ports port 443 978 acl Safe_ports port 80 # http 979 acl Safe_ports port 21 # ftp 980 acl Safe_ports port 443 # https 981 acl Safe_ports port 70 # gopher 982 acl Safe_ports port 210 # wais 983 acl Safe_ports port 1025-65535 # unregistered ports 984 acl Safe_ports port 280 # http-mgmt 985 acl Safe_ports port 488 # gss-http 986 acl Safe_ports port 591 # filemaker 987 acl Safe_ports port 777 # multiling http 988 acl CONNECT method CONNECT 989

All Squid Configuration Options

A full accounting of Squid’s available configurations can be found here:

(Make sure you plan to take some time because there is a lot of info there)

Restart Squid

After making those changes, let’s restart the Squid service to reload the configuration file.

[root@test ~]# systemctl restart squid.service

Other Important File Locations for Squid

Even More Information about Squid

How Can We Help?

Our Most Helpful Humans in Hosting can provide clarity and further information about Squid and how it can be utilized in our specific environments. Our Support team contains many talented individuals with intimate knowledge of web hosting technologies, especially like those discussed in this article. If you are uncomfortable walking through the steps outlined here, we are just a phone call, chat or ticket away from providing you info to walk you through the process. Let us assist you today!

How to Use Let’s Encrypt with Cloudflare

Posted on March 21, 2019 by Luke Cavanagh
Category: Common Fixes | Tags: caching, cloudflare, encryption, errors, Let's Encrypt, SSL, VPS

Reading Time: 3 minutes

Cloudflare is an excellent and well-known content delivery network. A CDN can increase site speed by utilizing Cloudflare’s global caching network to deliver content closer to a visitor’s location. You can also easily attach Cloudflare as an add-on product to your existing Liquid Web server, but there are some configurations to consider.

In this article, we will be covering how to use Cloudflare in conjunction with Let’s Encrypt SSL. Cloudflare will act as the CDN while Let’s Encrypt performs the SSL (HTTPS) encryption (in lieu of Cloudflare’s Universal SSL). Let’s Encrypt is an amazing open-service for creating free SSL certs for your site and for this tutorial you should already have Let’s Encrypt installed on your server. While there are correct ways to use Cloudflare with Let’s Encrypt there are also configuration settings that could cause connection errors to appear. So, it’s important to know which options to selecting when setting up these entities.

Step 1: First, you will need a Cloudflare account and will need to generate a Let’s Encrypt x3 cert on your server.

Note:

Our Managed WooCommerce and Managed WordPress plans will automatically generate a valid Let’s Encrypt SSL cert for your primary domain set in the manager when your site goes live or if you rename your primary domain in the manager.

If an incorrect SSL mode is selected in Cloudflare it will not load and instead will display an invalid SSL cert. This is a common error and one that can be avoided to ensure that your customer’s have a positive and trusted experience with your site.

A key part is to make certain the correct SSL mode is set in Cloudflare since it offers a number of different SSL modes:

Off
Flexible SSL
Full SSL (Recommended Setting)
Full SSL (Strict)

Step 2: SSL Modes can be accessed from the Crypto section in the Cloudflare dashboard.

Now that you are in the settings of Crypto you will need to go through these specific settings in Cloudflare; these changes will take maybe 30 – 50 seconds to make.

Note:

When using Cloudflare, Cloudflare’s universal SSL is what browsers would see, unless you manually upload your own SSL certificate, which requires the $200/month business plan. Most customers will be fine with utilizing Cloudflare’s universal SSL.

Step 3: Select the domain you want to work with, then select “Crypto” top menu option in Cloudflare. Under SSL select – Full. Scroll down to see Always use HTTPS and set it to ON.

Step 4: On the HTTP Strict Transport Security (HSTS) section select Enable HSTS

You will need to select the “I understand” checkbox and click on the Next button.

Step 5: A pop up box will appear, here you’ll set:

Max-Age: 3 months
Apply HSTS policy to subdomains (includeSubDomains): Off
Preload: Off

Now click Save

Step 6: Set to Minimum TLS Version to TLS 1.2

Step 7: Opportunistic Encryption: ON

Step 8: TLS 1.3: Enabled

Step 9: Automatic HTTPS Rewrites: On

Step 10: Disable Universal SSL by selecting this option you are no longer using Cloudflare Universal SSL certificate. You will only use SSLs stored in your server, in this case, Let’s Encrypt. Click “I understand” and select Confirm.

These simple changes made in Cloudflare, will help you to avoid any dreaded downtime when using Let’s Encrypt with Cloudflare. Meaning that your customer’s can fully trust that their data is securely transferred with HTTPS through Let’s Encrypt’s.

Still need help setting up Cloudflare and Let’s Encrypt on your server? Reach out to us! Our Liquid Web servers come with 24/7 assistance from our knowledgable support team. Get the support you deserve today!

What Does Varnish Do? [Infograph]

Posted on March 15, 2019 by Echo Diaz | Updated: April 1, 2019
Category: Getting Started | Tags: apache, caching, iis, Linux, nginx

Reading Time: 1 minute

Install Memcached on Ubuntu 16.04

Posted on August 28, 2018 by Echo Diaz | Updated: February 19, 2019
Category: Tutorials | Tags: caching, database, Memcached, performance, Ubuntu

Reading Time: 2 minutes

Memcached works to enhance performance by keeping a copy of commonly used script elements within the server’s memory in a form that is more easily read by the server thus reducing time. Continue reading “Install Memcached on Ubuntu 16.04” →

Configure Apache 2 to Control Browser Caching

Posted on June 14, 2018 by J. Potter | Updated: February 19, 2019
Category: Tutorials | Tags: browser caching, caching, httpd_conf, VPS

Reading Time: 9 minutes

Today we are configuring browser caching control on common Apache 2 servers. Caching is a great tool to reduce server resource consumption, bandwidth utilization and provide a faster end-user experience to visitors. To get familiar with caching concepts, simply review our ‘What is Caching?’ tutorial. Continue reading “Configure Apache 2 to Control Browser Caching” →

How to Install the Memcached PHP Extension on Ubuntu 15.04

Posted on September 2, 2015 by J. Mays | Updated: September 14, 2018
Category: Tutorials | Tags: caching, Memcached, performance, Ubuntu

Reading Time: 1 minute

Memcached is a distributed, high-performance, in-memory caching system that is primarily used to speed up sites that make heavy use of databases. It can, however, be used to store objects of any kind. Nearly every popular CMS has a plugin or module to take advantage of Memcached, and many programming languages have a Memcached library, including PHP, Perl, Ruby, and Python. Memcached runs in memory and is thus quite speedy since it does not need to write data to disk.

Pre-Flight Check

These instructions are intended specifically for installing the Memcached PHP Extension on a single Ubuntu 15.04 node.
I’ll be working from a Liquid Web Core Managed Ubuntu 15.04 server, and I’ll be logged in as root.
Follow our tutorial on How to Install Memcached on Ubuntu 15.04 prior to this KB!

Continue reading “How to Install the Memcached PHP Extension on Ubuntu 15.04” →

How to Install XCache on Ubuntu 15.04

Posted on August 10, 2015 by J. Mays | Updated: January 29, 2019
Category: Tutorials | Tags: caching, PHP, php-xcache, Ubuntu, XCache

Reading Time: 1 minute

Note:

Please note that this article is considered legacy documentation because Ubuntu 15.04 has reached its end-of-life support.

Pre-Flight Check

These instructions are intended specifically for installing XCache, an open-source opcode cacher, on Ubuntu 15.04.
I’ll be working from a Liquid Web Self Managed Ubuntu 15.04 server with Apache and PHP installed, and I’ll be logged in as non-root user. If you need more information then visit our tutorial on How to Add a User and Grant Root Privileges on Ubuntu 15.04.

Continue reading “How to Install XCache on Ubuntu 15.04” →

How to Install Memcached on Ubuntu 15.04

Posted on August 4, 2015 by J. Mays | Updated: September 13, 2018
Category: Tutorials | Tags: caching, Memcached, performance, Ubuntu

Reading Time: 1 minute

Memcached is a distributed, high-performance, in-memory caching system that is primarily used to speed up sites that make heavy use of databases. It can however be used to store objects of any kind. Nearly every popular CMS has a plugin or module to take advantage of memcached, and many programming languages have a memcached library, including PHP, Perl, Ruby, and Python. Memcached runs in memory and is thus quite speedy, since it does not need to write data to disk.

Pre-Flight Check

These instructions are intended specifically for installing Memcached on a single Ubuntu 15.04 node.
I’ll be working from a Liquid Web Core Managed Ubuntu 15.04 server, and I’ll be logged in as root.

Continue reading “How to Install Memcached on Ubuntu 15.04” →

What is Caching?

Posted on June 8, 2015 by J. Mays | Updated: November 14, 2017
Category: Getting Started, Technical Support, Tutorials | Tags: caching, cdn, Content Delivery Network, Memcached

Reading Time: 1 minute

Caching Defined

Caching, as it pertains to hosting a website, is the temporary storage of content. This content could be images, files, bits of PHP scripts that are precompiled, HTML pages, results of database queries, and other web objects.

Why Use Caching?

Caching quickens the responsiveness of your website. You’ll also hear this concept referred to as: reducing latency, eliminating redundant processing steps, improving responsiveness, or reducing load times.

Continue reading “What is Caching?” →

Liquid Web | Knowledge Base

Tag: caching

How to Install Squid Proxy Server on Ubuntu 16.04

Installing Squid