How to Set Up Transparent and Reverse Squid Proxy on Linux

Squid is a widely used high‑performance proxy service on Linux that caches web content, reduces client wait time, and eases backend server load.

Configure Transparent Proxy

A transparent proxy works without user configuration, automatically routing traffic through the proxy via DHCP‑assigned network settings.

The experiment uses 10.10.10.20 to simulate the external network and a Windows 10 machine as the internal client.

[主机类型]           [IP地址]             [网卡编号]           [网卡模式]         [作用]

Windows 10           192.168.1.8          eth0                桥接模式           模拟内网

Squid                192.168.1.10         eth0                桥接模式           内网网关
                     10.10.10.10          eth1                仅主机模式         模拟外网网口

Apache               10.10.10.20          eth0                仅主机模式         模拟web服务器

Configure Squid Gateway

1. Install Squid via yum: # yum install -y squid 2. Edit /etc/squid/squid.conf to enable transparent mode:

# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 192.168.1.10:3128 transparent
visible_hostname www.lyshark.com
# cache_dir ufs /var/spool/squid 100 16 256

3. Enable IP forwarding:

# echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
# sysctl -p
# echo "1" > /proc/sys/net/ipv4/ip_forward

4. Add an SNAT rule to forward all internal requests to the proxy port:

iptables -t nat -A PREROUTING -i eth0 \ 
  -s 192.168.1.0/24 -p tcp --dport 80 \ 
  -j REDIRECT --to-ports 3128

5. Start Squid and enable it at boot:

# systemctl restart squid
# systemctl enable squid

Configure Internal Client

route add default gw 192.168.1.10

Configure External Web Server

Install and start Apache to simulate the external site:

# yum install -y httpd
# systemctl restart httpd

Configure Reverse Proxy

A reverse proxy sits between the Internet and local web servers, handling all incoming requests and reducing load on the backend servers.

The experiment sets up Squid as a reverse proxy for two Apache web servers.

[主机类型]           [IP地址]             [网卡编号]           [网卡模式]         [作用]

Windows 10           192.168.1.8          eth0                桥接模式           模拟外网

Squid                192.168.1.10         eth0                桥接模式           外网网口
                     10.10.10.10          eth1                仅主机模式         内网网口

Apache               10.10.10.20          eth0                仅主机模式         模拟web_1
Apache               10.10.10.30          eth0                仅主机模式         模拟web_2

Configure Two Web Servers

Install Apache on each internal server and set it to start on boot:

# yum install -y httpd
# echo "web *" >/var/www/html/index.html
# systemctl restart httpd

Add a default gateway pointing to the Squid interface (10.10.10.10):

# route add default gw 10.10.10.10

Configure Squid Reverse Proxy

1. Install Squid (if not already installed). # yum install -y squid 2. Enable IP forwarding (same commands as above).

# echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
# sysctl -p
# echo "1" > /proc/sys/net/ipv4/ip_forward

3. Edit /etc/squid/squid.conf to allow all traffic and define the external interface and cache peers:

# Squid normally listens to port 3128
http_access allow all
http_port 192.168.1.10:80 vhost
cache_peer 10.10.10.20 parent 80 0 originserver round-robin weight=1
cache_peer 10.10.10.30 parent 80 0 originserver round-robin weight=1
# cache_dir ufs /var/spool/squid 100 16 256

4. Restart and enable Squid:

# systemctl restart squid
# systemctl enable squid

Common ACL Parameters

# Squid configuration common parameters
http_port 3128
http_port 192.168.1.1:80       # listen on internal interface only
cache_mem 512MB
cache_dir ufs /var/spool/squid 4096 16 256
cache_effective_user squid
cache_effective_group squid
dns_nameservers 8.8.8.8
visible_hostname www.lyshark.com
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_mgr [email protected]
http_access [allow|deny]

# Deny all clients
acl all src 0.0.0.0/0.0.0.0
http_access deny all

# Block 192.168.1.0/24 network
acl client src 192.168.1.0/255.255.255.0
http_access deny client

# Block access to www.baidu.com
acl baidu dstdomain www.baidu.com
http_access deny baidu

# Block 192.168.1.0/24 users Mon‑Fri 9:00‑13:00
acl badtime time MTWHF 9:00-13:00
http_access deny client badtime

# Block certain file types
acl badfile urlpath_regex -i \.mp3$ \.exe$ \.zip$ \.rar$
http_access deny badfile

# Block specific site
acl badsite dstdomain -i www.baidu.com
http_access deny badsite

# Block URLs containing "SEX"
acl sex url_regex -i SEX
http_access deny sex

# Deny dangerous ports
acl deny_port port 22 23 25 53 110 119
http_access deny deny_port