Squid快速起步

Squid快速起步

安装

Arch Linux 安装:

在 Arch Linux 系统安装squid

pacman -S squid

RedHat Linux 安装:

在 RedHat Linux 系统安装squid

dnf install squid

默认配置的缓存目录是 /var/cache/squid ，配置文件是 /etc/squid/squid.conf 。

配置

配置文件 /etc/squid/squid.conf 默认具备来开箱即用配置。

监听端口默认是 3128

http_port 3128

注意，默认只允许本地局域网和本地主机访问，并拒绝所有其他主机访问代理:

http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

由于我们已经允许了 localnet ，所以我们还需要定义 localnet 的来源:

# 默认已经配置了本地局域网的网段
acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10          # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12          # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10              # RFC 4291 link-local (directly plugged) machines

你可以再增加自己定义的网段段。

完整的初始配置可以参考如下(采用 Fedora 发行版安装squid后默认初始 /etc/squid/squid.conf ):

fedora 默认初始squid配置: /etc/squid/squid.conf

acl localnet src 0.0.0.1-0.255.255.255    # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8        # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10        # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16     # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12        # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16        # RFC 1918 local private network (LAN)
acl localnet src fc00::/7           # RFC 4193 local private network range
acl localnet src fe80::/10          # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

http_access allow localhost manager
http_access deny manager

http_access allow localnet
http_access allow localhost

http_access deny all

http_port 3128

cache_dir ufs /var/cache/squid 100 16 256

coredump_dir /var/spool/squid

refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
refresh_pattern .        0    20%    4320

备注

Fedora 发行版安装squid默认没有启用本地缓存目录，修改了上述一行 cache_dir 配置

重启并激活squid服务:

重启并激活squid服务器(在操作系统启动时启动)¶

systemctl restart squid
systemctl enable squid

对于使用了firewalld的防火墙主机，请设置允许访问端口 3128

firewall-cmd --zone=public --add-port=3128/tcp --permanent
firewall-cmd --reload

无需重启即重新加载配置

很多时候修订配置重启squid是非常缓慢麻烦的事情，因为重启服务会清理缓存，效率非常低下。所以，通常我们修改配置后，应该仅仅重新加载配置而不要重启服务。有多种方法可以实现:

方法一: Systemd进程管理器 系统中使用:

sudo systemctl reload squid

方法二: 向进程id发送 HUP 信号:

sudo kill -HUP cat /var/run/squid.pid

或者:

sudo kill -HUP $(cat /var/run/squid.pid)

方法三: 命令参数(也适用于FreeBSD):

sudo /usr/sbin/squid -k reconfigure