Share Internet with squid & Iptables

implement a nice trick to share internet with squid and block website using port redirection.

open your sysctl.conf

vim /etc/sysctl.conf and change line
net.ipv4.ip_forward = 1 (by default its 0)

save & exit from file 

1. Install Squid

yum -y install squid*

2. Edit Squid.conf file 

To Block website apply copy and paste this below lines as per your source network

acl blocksite dstdomain .orkut.com
http_access deny blocksite 

acl our_networks src
http_access allow our_networks

vim /etc/squid/squid.conf then search for http_port you will see 3128 by default port there so change it to 8888

save & exit from file

3. service squid restart

4.Now share your internet using iptables by executing following command:-

iptables -t nat -A POSTROUTING -o eth1 < Live-IP-Lan-Card> -j MASQUERADE

5. Now redirect your 80 port to 8888 

iptables -t nat -A PREROUTING -i eth0 (Local-Lan-Card) -p -tcp –dport 80 -j REDIRECT –to-port 8888

Now your Outlook will work directly without doing anything but client will not able to surf block websites which you blocked in squid.

How to set squid proxy server download limit ?

Add the following line in the squid.conf file
Use based download limit is tested only on squid-3.0.STABLE20-2 and older versions.

acl Group1 proxy_auth user1 user2
acl Group2 proxy_auth user3 user4
reply_body_max_size 20480 KB Group2
reply_body_max_size 10240 KB Group1
reply_body_max_size 5120 KB all

For version squid-3.1 and higher , you can use IP based download limit 

acl Group1 src 10.5.0.1-10.5.0.10/32

acl Group2 src 10.5.2.1-10.5.2.10/32

reply_body_max_size 20480 KB Group2
reply_body_max_size 10240 KB Group1
reply_body_max_size 5120 KB all 

Time Based Download Limit

acl WorkingHours time 08:00-17:00
reply_body_max_size 10240 KB WorkingHours

How to enable Time based access in squid proxy server ?

Below you can find the squid time based access.
Edit squid.conf and add the below mentioned lines

User Based restriction

acl USER1 proxy_auth raj
acl USER2 proxy_auth sam
acl DAY time 08:00-18:00
http_access allow USER1 DAY
http_access deny USER1
http_access allow USER2 !DAY
http_access deny USER2

Special Access

acl After_Office time SMTWHFA 20:00-24:00
acl Before_Office time SMTWHFA 00:00-08:30

acl Proxy_Afrer8 proxy_auth  user1 user2

http_access deny  Before_Office #(Deny access to all users)

http_access deny After_Office !Proxy_Afrer8  # (This will exclude user1,user2)

http_access allow ntlm_users
http_access deny all                   

IP Based Restriction

acl IPGROUP01 src 10.1.2.3 10.1.2.4
acl WORKINGHOUR time MTWHF 08:30-17:30
http_access allow IPGROUP01 WORKINGHOUR
http_access deny IPGROUP01

Restart squid

How to Block skype on squid proxy server

Edit squid.conf and add the below mentioned lines. This will allow skype for user1, user 2 and deny for all.

acl numeric_IPs url_regex -i ^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)

acl Skype_UA browser ^skype^
acl Skype_Allowed_Users proxy_auth user1 user2

http_access deny numeric_IPS !Skype_Allowed_Users
http_access deny Skype_UA !Skype_Allowed_Users 


http_access allow ntlm_users
http_access deny all

Squid Proxy Caching server Installation and Configuration in Linux

Below are the steps to setup the Squid Proxy Caching server on Red Hat Enterprise Linux

1. Install Required Packages for Proxy Server:

   
    Install the  "squid-2.5.STABLE14-1.4E"  RPM packages on the server

                  
                      rpm -ivh squid-2.5.STABLE14-1.4E.rpm

2. Customize the squid.conf configuration file

                
     a. vi /etc/squid/squid.conf 

Configuring Squid File ( /etc/squid/squid.conf)

Just Specify the details with respect to your requirements in squid.conf file. Look for the following lines…

http_port 8080

cache_dir ufs /var/spool/squid 1400 16 256

cache_access_log /var/log/squid/access.log

cache_log /var/log/squid/cache.log

cache_store_log /var/log/squid/store.log

dns_nameservers [YOUR_NAME_SERVERS]

acl our_networks src  192.168.1.0/24 192.168.2.0/24 [ADD_YOUR_NETWORK_ADDRESS_HERE]

http_access allow our_networks

visible_hostname [YOUR_PROXY_SERVER_NAME]

3. Change the squid directory "/var/spool/squid/" to be owned by nobody  


                a. chown nobody /var/spool/squid/

                b. chmod 700 /var/spool/squid/

4. Run squid

                service squid start

                         

Relax... You are done with the Job.. :-)