UNSTABLE / INCOMPLETE guide dueto time shortage.
probably it will be replaced with squid 3.2 with ssl support and dynamic cert geenration
The aim of writing this basic howto is to find methods in SQUID to inspect SSL / HTTPS traffic at very minimum level. In this method, The SQUID will act as a MITM (man in the middle). The aim behind doing this config is to decrypt HTTPS connections to apply content filtering which is usually not possible with traditional http methods.
Also note that https caching is not recommended , at the date of writing this (January 2014) still, I haven’t found any 100% working method to bypass certificate issues.
The only way is to IMPORT certificate to user browser. Importing is OK for a small network, like cyber/net Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.
Please be aware that RIPPING and decrypting HTTPS is fundamentally against the reasons for using HTTPS. HTTPS is designed for secure connectivity and privacy. Since secure HTTP connections are encrypted SSL sessions between your browser and the secure site, and are meant to be reliably secure. Your users will not trust you if you use it without proper implementation. Every SSL request to the HTTPS site will present an invalid certificate window. Users will get a certificate miss match with the SSL enabled sites they try to visit. They will have to add exceptions to trust the self-signed cert from above for each site (This bump can be covered by a workaround but I will NOT go in that detail for some reasons)
Also if you are ripping SSL traffic, You’re exposing yourself to potential lawsuits for doing ripping user private stuff and possible hacking purposes.
IMPO, This approach is OK for content filtering purposes or for government surveillance or only according to law . There are methods to bypass CERTIFICATE mismatching and via using iptables nat, you can do transparent redirection of 443 to your proxy.
↓
↓
Compiling SQUID by source code with –enable-ssl
Update apt and install few required packages by following
apt-get update apt-get install -y build-essential libssl-dev fakeroot devscripts gawk gcc-multilib dpatch
Now create temporary directory where we will download squid source packages for compilation.
mkdir /temp cd /temp wget ftp://artfiles.org/squid-cache.org/pub/archive/3.1/squid-3.1.19.tar.gz tar zxvf squid-3.1.19.tar.gz cd squid-3.1.19/
Now compile squid with –enable-ssl option
#===========
#For 64bit =
#===========
./configure \ --prefix=/usr \ --exec_prefix=/usr \ --bindir=/usr/sbin \ --sbindir=/usr/sbin \ --libexecdir=/usr/lib/squid \ --sysconfdir=/etc/squid \ --localstatedir=/var/spool/squid \ --datadir=/usr/share/squid \ --enable-async-io=24 \ --with-aufs-threads=24 \ --with-pthreads \ --enable-storeio=aufs \ --enable-linux-netfilter \ --enable-arp-acl \ --enable-epoll \ --enable-removal-policies=heap,lru \ --with-aio --with-dl \ --enable-snmp \ --enable-delay-pools \ --enable-htcp \ --enable-cache-digests \ --disable-unlinkd \ --enable-large-cache-files \ --with-large-files \ --enable-err-languages=English \ --enable-default-err-language=English --with-maxfd=65536 \ --enable-carp \ --enable-ssl \ --enable-follow-x-forwarded-for \ --with-maxfd=65536 \ 'amd64-debian-linux' 'build_alias=amd64-debian-linux' 'host_alias=amd64-debian-linux' 'target_alias=amd64-debian-linux' 'CFLAGS=-Wall -g -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='
Now install it
make make install
Now edit SQUID CONFIG file and paste the following (remove all old entries, make sure to backup original config file for alter retrieval for backup purposes)
nano /etc/squid/squid.conf
Paste Following SAMPLE config file.
# SQUID 3.1.19 CONFIG FILE FOR SSL FILTERING [ Zaib] # Thsi file also contains many other JUNK ENTRIES FOR CACHING with some VIDEOCACHE entries, # Remove them if not required # By - Syed Jahanzaib # Email: aacable@hotmail.com # Web : https://aacable.wordpress.com # SSL BUMP always_direct allow all ssl_bump allow all # PORT OPTIONS. for http and https # Repalce the IP 10.0.0.1 as per your local squid box ip http_port 8080 http_port 10.0.0.1:8081 ssl-bump cert=/etc/squid3/cert/squid.pem key=/etc/squid3/cert/squid.pem # for videocache, not required for general setup acl vc_deny_url url_regex -i \.blip\.tv\/(.*)filename \.hardsextube\.com\/videothumbs \.xtube\.com\/(.*)(Thumb|videowall) acl vc_url url_regex -i \/youku\/[0-9A-Z]+\/[0-9A-Z\-]+\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) acl vc_url url_regex -i \/(.*)key=[a-z0-9]+(.*)\.flv acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/feeds\/api\/videos\/[0-9a-zA-Z_-]{11}\/ acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(videoplayback|get_video|watch|watch_popup|user_watch)\? acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(v|e|embed)\/[0-9a-zA-Z_-]{11} acl vc_dom_r dstdom_regex -i msn\..*\.(com|net) acl vc_dom_r dstdom_regex -i msnbc\..*\.(com|net) acl vc_dom_r dstdom_regex -i video\..*\.fbcdn\.net acl vc_dom_r dstdom_regex -i myspacecdn\..*\.footprint\.net acl vc_dom dstdomain .stream.aol.com .videos.5min.com msn.com .blip.tv .vid.ec.dmcdn.net .break.com .vimeocdn.com acl vc_dom dstdomain .cdn.turner.com .dailymotion.com .c.wrzuta.pl .v.imwx.com .mccont.com .myspacecdn.com acl vc_dom dstdomain .hardsextube.com .public.extremetube.phncdn.com .redtubefiles.com .video.pornhub.phncdn.com acl vc_dom dstdomain .public.keezmovies.com .public.keezmovies.phncdn.com .slutload-media.com .public.spankwire.com .xtube.com acl vc_dom dstdomain .public.youporn.phncdn.com .xvideos.com .tube8.com .public.spankwire.phncdn.com .pornhub.com refresh_pattern \.youtube\.com\/videoplayback\? 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern stream\.aol\.com\/(.*)/[a-zA-Z0-9]+\/(.*)\.(flv|mp4) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern videos\.5min\.com\/(.*)/[0-9_]+\.(mp4|flv) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern proxy[a-z0-9\-]?[a-z0-9]?[a-z0-9]?[a-z0-9]?\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern vid\.akm\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern vid\.ec\.dmcdn\.net\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern video\.(.*)\.fbcdn\.net\/(.*)/[0-9_]+\.(mp4|flv|avi|mkv|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern (.*)\.myspacecdn\.com\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern (.*)\.myspacecdn\.(.*)\.footprint\.net\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern c\.wrzuta\.pl\/wv[0-9]+\/[a-z0-9]+/[0-9]+/ 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern c\.wrzuta\.pl\/wa[0-9]+\/[a-z0-9]+ 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private refresh_pattern vs[a-z0-9]?[a-z0-9]?[a-z0-9]?\.hardsextube\.com\/(.*)\/(.*)\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private acl vc_deny_url url_regex -i crossdomain.xml acl vc_method method GET acl vc_header req_header X-Requested-With -i videocache url_rewrite_access deny !vc_method url_rewrite_access deny vc_header url_rewrite_access deny vc_deny_url url_rewrite_access allow vc_dom url_rewrite_access allow vc_url url_rewrite_access allow vc_dom_r url_rewrite_bypass on strip_query_terms off maximum_object_size 1 GB # If you want to enable DATE time n SQUID Logs,use following emulate_httpd_log on logformat squid %tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt log_fqdn off # 1 year = 525600 mins, 1 month = 43800 mins refresh_pattern imeem.*\.flv 0 0% 0 override-lastmod override-expire refresh_pattern \.rapidshare.*\/[0-9]*\/.*\/[^\/]* 161280 90% 161280 ignore-reload refresh_pattern (get_video\?|videoplayback\?|videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern (get_video\?|videoplayback\?id|videoplayback.*id|videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims #refresh_pattern -i (get_video\?|videoplayback\?id|videoplayback.*id||videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern \.(ico|video-stats) 10800 80% 10800 override-expire ignore-reload ignore-no-cache ignore-private ignore-auth override-lastmod refresh_pattern \.etology\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache refresh_pattern galleries\.video(\?|sz) 10800 80% 10800 override-expire ignore-reload ignore-no-cache refresh_pattern brazzers\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache refresh_pattern \.adtology\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache #refresh_pattern ^.*(utm\.gif|ads\?|rmxads\.com|ad\.z5x\.net|bh\.contextweb\.com|bstats\.adbrite\.com|a1\.interclick\.com|ad\.trafficmp\.com|ads\.cubics\.com|ad\.xtendmedia\.com|\.googlesyndication\.com|advertising\.com|yieldmanager|game-advertising\.com|pixel\.quantserve\.com|adperium\.com|doubleclick\.net|adserving\.cpxinteractive\.com|syndication\.com|media.fastclick.net).* 10800 20% 10800 ignore-no-cache ignore-private override-expire ignore-reload ignore-auth negative-ttl=40320 max-stale=10 refresh_pattern ^.*safebrowsing.*google 10800 80% 10800 override-expire ignore-reload ignore-no-cache ignore-private ignore-auth refresh_pattern ^http://((cbk|mt|khm|mlt)[0-9]?)\.google\.co(m|\.uk) 10800 80% 10800 override-expire ignore-reload ignore-private refresh_pattern ytimg\.com.*\.jpg 10800 80% 10800 override-expire ignore-reload refresh_pattern images\.friendster\.com.*\.(png|gif) 10800 80% 10800 override-expire ignore-reload refresh_pattern garena\.com 10800 80% 10800 override-expire reload-into-ims refresh_pattern photobucket.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png) 10800 80% 10800 override-expire ignore-reload refresh_pattern vid\.akm\.dailymotion\.com.*\.on2\? 10800 80% 10800 ignore-no-cache override-expire override-lastmod refresh_pattern mediafire.com\/images.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png) 10800 80% 10800 reload-into-ims override-expire ignore-private refresh_pattern ^http:\/\/images|pics|thumbs[0-9]\. 10800 80% 10800 reload-into-ims ignore-no-cache ignore-reload override-expire refresh_pattern ^http:\/\/www.onemanga.com.*\/ 10800 80% 10800 reload-into-ims ignore-no-cache ignore-reload override-expire # ANTI VIRUS refresh_pattern guru.avg.com/.*\.(bin) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern (avgate|avira).*(idx|gz)$ 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern kaspersky.*\.avc$ 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern kaspersky 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern update.nai.com/.*\.(gem|zip|mcs) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern ^http:\/\/liveupdate.symantecliveupdate.com.*\(zip) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern windowsupdate.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern update.microsoft.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims refresh_pattern download.microsoft.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims #images facebook refresh_pattern ((facebook.com)|(85.131.151.39)).*\.(jpg|png|gif|css) 10800 80% 10800 ignore-reload override-expire ignore-no-cache refresh_pattern -i \.fbcdn.net.*\.(jpg|gif|png|swf|mp3) 10800 80% 10800 ignore-reload override-expire ignore-no-cache refresh_pattern static\.ak\.fbcdn\.net*\.(jpg|gif|png) 10800 80% 10800 ignore-reload override-expire ignore-no-cache refresh_pattern ^http:\/\/profile\.ak\.fbcdn.net*\.(jpg|gif|png) 10800 80% 10800 ignore-reload override-expire ignore-no-cache #banner IIX refresh_pattern ^http:\/\/openx.*\.(jp(e?g|e|2)|gif|pn[pg]|swf|ico|css|tiff?) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern ^http:\/\/ads(1|2|3).kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern ^http:\/\/img.ads.kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern .kompasimages.com.*\.(jpg|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern ^http:\/\/openx.kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern kaskus.\us.*\.(jp(e?g|e|2)|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache refresh_pattern ^http:\/\/img.kaskus.us.*\.(jpg|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache #IIX DOWNLOAD refresh_pattern ^http:\/\/\.www[0-9][0-9]\.indowebster\.com\/(.*)(mp3|rar|zip|flv|wmv|3gp|mp(4|3)|exe|msi|zip) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache ignore-auth #All File refresh_pattern -i \.(3gp|7z|ace|asx|avi|bin|cab|dat|deb|divx|dvr-ms) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern -i \.(rar|jar|gz|tgz|bz2|iso|m1v|m2(v|p)|mo(d|v)) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern -i \.(jp(e?g|e|2)|gif|pn[pg]|bm?|tiff?|ico|swf|css|js|jpg|png) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern -i \.(mp(e?g|a|e|1|2|3|4)|mk(a|v)|ms(i|u|p)|og(x|v|a|g)|rar|rm|r(a|p)m|snd|vob|wav) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims refresh_pattern -i \.(pp(s|t)|wax|wm(a|v)|wmx|wpl|zip|cb(r|z|t)) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims ######################################################################### refresh_pattern (cgi-bin|\?) 0 0% 0 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern ^ftp: 10080 95% 10800 override-lastmod reload-into-ims refresh_pattern . 180 95% 10800 override-lastmod reload-into-ims global_internal_static off retry_on_error on buffered_logs on read_ahead_gap 32 KB #header_access Accept-Encoding deny all client_persistent_connections off server_persistent_connections on half_closed_clients off strip_query_terms off quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 100 vary_ignore_expire on reload_into_ims on pipeline_prefetch on read_timeout 30 minute client_lifetime 6 hour positive_dns_ttl 6 hour pconn_timeout 15 second request_timeout 1 minute log_icp_queries off ipcache_size 16384 ipcache_low 98 ipcache_high 99 log_fqdn off fqdncache_size 16384 memory_pools off forwarded_for on client_db off max_filedescriptors 8192 # ZAIB # ZPH for Squid 3.3.19 qos_flows local-hit=0x30 # ACCESS CONTROLS OPTIONS # ==================== acl all src acl localnet src 101.0.0.0/8 # Your network here acl localnet src 192.168.1.0/24 # Your network here acl localhost src 127.0.0.1/32 acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535 acl sslports port 443 563 81 2087 8081 10000 acl manager proto cache_object acl purge method PURGE acl connect method CONNECT http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports http_access allow localhost http_access allow localnet http_access deny all # OPTIONS WHICH AFFECT THE CACHE SIZE # ============================== cache_mem 512 MB maximum_object_size_in_memory 4096 KB memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA minimum_object_size 0 bytes # 10GB CACHE SIZE [JZ] # ===================== cache_dir aufs /cache-1 10000 14 256 maximum_object_size 1000 MB cache_swap_low 95 cache_swap_high 99 # LOGFILE LOCATIONS AND CACHE_DIR [JZ] # ==================================== access_log /var/log/squid3/access.log cache_log /var/log/squid3/cache.log #cache_log /dev/null cache_store_log none logfile_rotate 5 log_icp_queries off # REFRESH PATTERNS AND OTHER TUNING OPTIONS [JZ] # ============================================== refresh_pattern ^ftp: 1440 20% 10080 reload-into-ims refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i .(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(html|htm|css|js)$ 1440 75% 40320 refresh_pattern -i .index.(html|htm)$ 0 75% 10080 #refresh_pattern -i (/cgi-bin/|?) 0 0% 0 refresh_pattern . 1440 90% 10080 quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 100 store_avg_object_size 13 KB vary_ignore_expire on # ANONIMITY OPTIONS # =============== request_header_access From deny all request_header_access Server deny all request_header_access Link deny all request_header_access Via deny all request_header_access X-Forwarded-For deny all # ADMINISTRATIVE PARAMETERS [JZ] # ============================== cache_mgr Syed_jahanzaib visible_hostname aacable@hotmail.com cache_effective_user proxy cache_effective_group proxy httpd_suppress_version_string on ftp_list_width 32 ftp_passive on ftp_sanitycheck on # DNS SERVER [JZ] # =============== dns_nameservers 8.8.8.8 # MISCELLANEOUS [JZ] # ================== memory_pools off client_db off reload_into_ims on coredump_dir /cache-1 pipeline_prefetch on offline_mode off ### END OF SQUID SAMPLE CONFIGURATION ### ### IT WAS MADE ROUGHLY ###
Now Generate SSL certificate which SQUID will present to the end client. For test purposes in a test environment, you can create a self-signed
certificate using OpenSSL by using the following:
cd /etc/squid3 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout squid.pem -out squid.pem
It will ask few simple questions like country code, use PK if you are in Pakistan, and some other questions, just answer and proceed further
#####
Create cache folder and assign necnessary permissions.
mkdir /cache-1 chown proxy:proxy /cache-1
Now initialize CACHE folders by SQUID
squid -z
Now start SQUID in no daemon mode to verify you dont have any errors in the config file.
squid -d1N
↓
↓
To redirect TRANSPARENTLY port 80 and 443 to local proxy.
change the eth0 to match your local LAN interface.
iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to-destination 10.0.0.1:8080 iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 443 -j DNAT –to-destination 10.0.0.1:8081
To check SQUID port
netstat -nap | grep 8080 netstat -nap | grep 8081
↓
↓
↓
↓
↓
↓
↓
With Decryption ↓
↓
↓
With Encryption ↓
we are waiting …………………………………………………
LikeLike
Comment by Ahmed Ramze — October 22, 2013 @ 4:37 PM
Dear Sir,
Please tell how to install squid3 ssl-bump, step by step
LikeLike
Comment by Suprianto — October 22, 2013 @ 7:34 PM
I’m desperately waiting for the configurations and settings. So i could compare with my settings & configuration.
And i would like to Thank you for bringing something new & latest.
LikeLiked by 1 person
Comment by Umer Sarwar — October 22, 2013 @ 9:31 PM
ohhhhhhhhhhhhhhh .. good news
i waiting
LikeLike
Comment by mohamed — October 22, 2013 @ 10:28 PM
wow i m waiting bhai.. aur kitne din lagenge.. ???
LikeLike
Comment by Haji amad — October 22, 2013 @ 11:01 PM
Sir, create rule for MT Hotspot to Redirect SSL links to login page. , It will be Great Discovery for all the networks which are still using MT Hotspot for their clients. Thanks
Hammad Hassan
Fast ISP
LikeLike
Comment by hammad hassan — October 23, 2013 @ 9:19 AM
sir… how to fix this
FATAL: Bungled squid.conf line 7: http_port 10.0.0.1:8081 ssl-bump cert=/etc/squid3/cert/squid.pem key=/etc/squid3/cert/squid.pem
Squid Cache (Version 3.1.19): Terminated abnormallyCPU Usage: 0.004 seconds = 0.000 user + 0.004 sys Maximum Resident Size: 17264 KB
Page faults with physical i/o: 0
LikeLike
Comment by Hizkya Net — October 24, 2013 @ 6:08 AM
salam janzaib,
this is rehmat ali i buy a router borad 750gl for WAN merging i m little confused that i need to merge my 4 wan’s into one but in background MT used a loadbalnce method in PCC method distance rule.
means wan1 distance is 1
wan2 distance is 2
and go on is pcc method all wan’s at same time,
i only need to do my 4 mb dsl connection into 16mb DSL connection with mikrotik is it possible with bridging or with PCC method.
LikeLike
Comment by rehmat ali gulwating — October 24, 2013 @ 11:28 PM
is PCC method use all wan’s at same time….?
LikeLike
Comment by rehmat ali gulwating — October 24, 2013 @ 11:33 PM
one another question is that is your PCC loadbalancing script work when wan connection on MT is on PPTP, if not then what modification is to be configure?
LikeLike
Comment by rehmat ali gulwating — October 25, 2013 @ 12:04 AM
dear janzaib:
i do the all configuration of your PCC loadbalancing but it only use wan1 then i read comments under that topic and i reset my router configuration and start again but this time i set route distance same to 1 on all 4 routes, after that i check my route page on winbox wan1 is active and others are inactive,
AS wan1
S wan2
S wan3
S wan4
i do all configuration as it is manually by winbox, not copying in terminal,
plzzz resolve this ,thxzzzzzzzzz
LikeLike
Comment by rehmat ali gulwating — October 25, 2013 @ 2:49 AM
please reply as soon as possible
LikeLike
Comment by rehmat ali gulwating — October 25, 2013 @ 7:46 PM
dear janzaib:
my problem is resolved i was just not checked on invert after that it was done but one question i have to ask from u is that
what is
4/0
4/1
4/2
4/3
in PCC , please describe fully
thxzzzzzzzzz
LikeLike
Comment by rehmat ali gulwating — October 25, 2013 @ 10:37 PM
is video cache need for storeurl
LikeLike
Comment by dh — October 27, 2013 @ 1:58 AM
videocache and storeurl.pl are separate methods to cache video files.
storeurl.pl is a free method, wehreas videocache is a commercial software for squid.
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — October 27, 2013 @ 9:50 AM
i have the latest videocache cracked if you want it syed ?
LikeLike
Comment by Hussein — November 3, 2013 @ 4:11 AM
can i get it plz
LikeLike
Comment by dh — December 14, 2013 @ 6:18 PM
Waiting for full version with video support…..
Thanks for the efforts you put, and thanks for the time you spare for us…
Jazak ALLAH
LikeLike
Comment by Quality DSL — October 27, 2013 @ 8:24 PM
janziab bhai plz answere my question…?
LikeLike
Comment by rehmat ali — October 28, 2013 @ 3:03 AM
salam to all
janzaib bhai i have a question
is PCC loadbalancing method is able to work with when WAN connections is on VPN(pptp or l2tp) or in PPPoe directly connected with Mikrotik Wan ports………?
if yes then what modification will change in config of PCC.
please reply as soon as you read this.
thanking you,
LikeLike
Comment by rehmat ali gulwating — October 30, 2013 @ 7:51 PM
salam alaikom,
dear Syed Jahanzaib
is this method work with lusca ??
thank you 🙂
LikeLike
Comment by Hussein — November 3, 2013 @ 4:11 AM
dear sayed please check this
so the images not work under https
LikeLike
Comment by Hussein — November 6, 2013 @ 5:22 AM
ok now thats what iam gettin
2013/11/05 19:38:21| clientNegotiateSSL: Error negotiating SSL connection on FD 11: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request (1/-1)
LikeLike
Comment by Hussein — November 6, 2013 @ 6:17 AM
can i get videocache cracked plz and is it work ok
LikeLike
Comment by dh — December 12, 2013 @ 6:01 PM
https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:24 PM
on which distribution you make that its not worked under Debian the browser said the certificate is wrong and then sites not loaded successfully
LikeLike
Comment by Hussein — November 7, 2013 @ 7:34 AM
sir ………………how to configure squid proxy server………with ( http ) and ( https )
LikeLike
Comment by Salman — November 14, 2013 @ 2:47 AM
sir………how to configure both ( http/https ) sevices cached in squid proxy server in ubuntu
ALLAH aap ko JAZA E KHAIR dey………..Ameen
LikeLike
Comment by Salman — November 23, 2013 @ 1:56 AM
Try not to do so.
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — November 23, 2013 @ 12:54 PM
syed … if this setting works well in a proxy server?
LikeLike
Comment by boim — November 24, 2013 @ 4:01 AM
Bhai …………compile squid with –enable-ssl option for 32bit ……….not available in Article.
please ………step by step guide i m beginer. ALLAH aap ko Jaza e Khair de…….
LikeLike
Comment by Salman — November 26, 2013 @ 12:03 PM
How to make Squid 3 as Transparent Proxy SSL ?
LikeLike
Comment by Aji Diyantoro — November 29, 2013 @ 8:40 AM
https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:23 PM
Sir ………..squid proxy for http / squid for https keley seprate server bansakta hai?
LikeLike
Comment by Salman — December 2, 2013 @ 7:45 PM
no need to create separate servers, you can run multiple instance of various squid versions, just install them under different folders, and use them by change the ports, then use IPTABLES to redirect ports as per the requirements 🙂
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — December 3, 2013 @ 9:50 AM
0 10.0.0.5 NONE/000 0 CONNECT fbcdn-photos-b-a.akamaihd.net:443 – HIER_NONE/- –
1386112989.803 0 10.0.0.5 NONE/000 0 CONNECT fbcdn-photos-h-a.akamaihd.net:443 – HIER_NONE/- –
1386112989.803 0 10.0.0.5 NONE/000 0 CONNECT fbcdn-photos-h-a.akamaihd.net:443 – HIER_NONE/- –
1386112989.848 0 10.0.0.5 NONE/000 0 CONNECT http://www.facebook.com:443 – HIER_NONE/- –
1386112989.853 0 10.0.0.5 TCP_MEM_HIT/200 1435 GET https://www.facebook.com/images/loaders/indicator_blue_medium.gif – HIER_NONE/- image/gif
1386112989.895 0 10.0.0.5 NONE/000 0 CONNECT http://www.facebook.com:443 – HIER_NONE/- –
1386112989.905 116 10.0.0.5 TCP_MISS/304 366 GET https://fbcdn-profile-a.akamaihd.net/hprofile-ak-prn2/274257_100000491643689_879564140_q.jpg – HIER_DIRECT/195.10.11.89 image/jpeg
1386112989.910 107 10.0.0.5 TCP_MISS/304 341 GET https://fbstatic-a.akamaihd.net/rsrc.php/v2/yn/r/slh9ZgwfrSA.gif – HIER_DIRECT/77.67.96.230 image/gif
1386112989.928 121 10.0.0.5 TCP_MISS/304 332 GET https://fbcdn-photos-h-a.akamaihd.net/hphotos-ak-ash3/851576_533281403402821_583149410_n.png – HIER_DIRECT/195.27.155.123 image/png
1386112990.072 139 10.0.0.5 TCP_MISS/304 332 GET https://fbcdn-photos-h-a.akamaihd.net/hphotos-ak-prn1/851559_267287446750649_1154408741_n.png – HIER_DIRECT/195.27.155.123 image/png
1386112990.123 287 10.0.0.5 TCP_MISS/200 1550 GET https://www.facebook.com/ajax/browse/null_state.php? – HIER_DIRECT/31.13.64.81 application/x-javascript
1386112990.164 270 10.0.0.5 TCP_MISS/200 676 GET https://www.facebook.com/ajax/typeahead/search/facebar/bootstrap/? – HIER_DIRECT/31.13.64.81 application/x-javascript
1386112990.196 295 10.0.0.5 TCP_MISS/200 676 GET https://www.facebook.com/ajax/typeahead/search/facebar/bootstrap/? – HIER_DIRECT/31.13.64.81 application/x-javascript
1386112990.343 535 10.0.0.5 TCP_MISS/304 262 GET https://fbcdn-photos-h-a.akamaihd.net/hphotos-ak-prn2/1478966_10202168633404767_1289088601_t.jpg – HIER_DIRECT/195.27.155.123 image/jpeg
1386112990.356 193 10.0.0.5 TCP_MISS/304 326 GET https://fbcdn-profile-a.akamaihd.net/hprofile-ak-prn2/s32x32/1117368_100005737664208_1788800814_q.jpg – HIER_DIRECT/195.10.11.89 image/jpeg
1386112990.357 192 10.0.0.5 TCP_MISS/304 326 GET https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash2/s32x32/1116498_100006347773686_70562821_q.jpg – HIER_DIRECT/195.10.11.89 image/jpeg
tried most of everything still TCP_MISS/304 and TCP_MISS/200 in every page reloaded the page more then 2 times , tried to with diferent versions of squid 3+
LikeLike
Comment by asd — December 4, 2013 @ 4:26 AM
1386006187.572 11353 10.0.0.222 TCP_MISS/200 2207 CONNECT fbstatic-a.akamaihd.net:443 – HIER_DIRECT/77.67.96.232 –
1386006190.682 14463 10.0.0.222 TCP_MISS/200 2207 CONNECT fbstatic-a.akamaihd.net:443 – HIER_DIRECT/77.67.96.232 –
1386006194.199 21028 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-sphotos-a-a.akamaihd.net:443 – HIER_DIRECT/46.33.70.43 –
1386006194.199 21029 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-photos-f-a.akamaihd.net:443 – HIER_DIRECT/81.52.207.192 –
1386006194.208 21037 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-sphotos-a-a.akamaihd.net:443 – HIER_DIRECT/46.33.70.43 –
1386006259.113 1715 10.0.0.222 TCP_MISS/200 34826 GET http://l1.yimg.com/nn/fp/rsz/120113/images/smush/walker2_635x250_1385923107.jpg – HIER_DIRECT/66.196.65.174 image/jpeg
1386006268.181 775 10.0.0.222 TCP_MISS/200 24364 GET http://l1.yimg.com/nn/fp/rsz/111813/images/smush/grey_hair_635x250_1384817243.jpg – HIER_DIRECT/66.196.65.174 image/jpeg
keep getting this loogs in 99% of the pages i visit
the only hits
1386006467.864 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/My2FRPA3Gf8/mqdefault.jpg – HIER_NONE/- image/jpeg
1386006467.866 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/LrUvu1mlWco/mqdefault.jpg – HIER_NONE/- image/jpeg
1386006467.867 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/H7QhvIc8NrQ/mqdefault.jpg – HIER_NONE/- image/jpeg
1386006467.869 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/450p7goxZqg/mqdefault.jpg – HIER_NONE/- image/jpeg
1386006467.871 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/DeumyOzKqgI/mqdefault.jpg – HIER_NONE/- image/jpeg
1386006467.872 0 127.0.0.1 TCP_IMS_HIT/304 439 GET http://i1.ytimg.com/vi/1-TTNdyIMAE/mqdefault.jpg – HIER_NONE/- image/jpeg
anny idea what am i doing wrong
LikeLike
Comment by asd — December 2, 2013 @ 10:49 PM
Sir……….which version of squid ………http and https
sir ………..we have a problem for https……sites cahe ;;;;;;plz sir upload full Article step by step about this problem
ALLAH aap ko jaza e khair dey…….ameen
LikeLike
Comment by Salman — December 3, 2013 @ 5:25 PM
Sir ……………….We are waiting your full Article………..plz
ALLAH aap ko jaza e khair dey…………Ameen
LikeLike
Comment by Salman — December 20, 2013 @ 2:40 AM
https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:23 PM
E: Could not get lock /var/lib/dpkg/lock – open (11: Resource temporarily unavailable)
E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it?
LikeLike
Comment by SHAHBAZ — December 25, 2013 @ 6:21 PM
login with ROOT id, or use SUDO
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — December 26, 2013 @ 9:12 AM
thanks but i have one problem with certificate not working, how i can fix it.
the chorme browser say me connection failed, but http work good
LikeLike
Comment by MCM — April 9, 2014 @ 2:24 AM
have you tried it firefox?
LikeLike
Comment by Syed Jahanzaib / Pinochio~:) — April 10, 2014 @ 8:52 AM
libtool: compile: g++ -DHAVE_CONFIG_H -I../.. -I../../include -I../../src -I../../include -I../../libltdl -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT IntRange.lo -MD -MP -MF .deps/IntRange.Tpo -c IntRange.cc -fPIC -DPIC -o .libs/IntRange.o
g++: warning: switch ‘-fhuge-objects’ is no longer supported
MD -MP -MF $depbase.Tpo -c -o store_dir.o store_dir.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_key_md5.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_key_md5.o -MD -MP -MF $depbase.Tpo -c -o store_key_md5.o store_key_md5.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_log.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_log.o -MD -MP -MF $depbase.Tpo -c -o store_log.o store_log.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_rebuild.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_rebuild.o -MD -MP -MF $depbase.Tpo -c -o store_rebuild.o store_rebuild.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_swapin.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapin.o -MD -MP -MF $depbase.Tpo -c -o store_swapin.o store_swapin.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_swapmeta.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapmeta.o -MD -MP -MF $depbase.Tpo -c -o store_swapmeta.o store_swapmeta.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
depbase=`echo store_swapout.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapout.o -MD -MP -MF $depbase.Tpo -c -o store_swapout.o store_swapout.cc &&\
mv -f $depbase.Tpo $depbase.Po
g++: warning: switch ‘-fhuge-objects’ is no longer supported
“is no longer supported” ؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟
LikeLike
Comment by New Llife — April 20, 2014 @ 9:09 PM
see ftp://artfiles.org/squid-cache.org/pub/archive/3.4/squid-3.4.5-RELEASENOTES.html#ss2.2
we have good advances.
LikeLike
Comment by int21 — May 26, 2014 @ 12:54 AM
i have 4 lines and i need to make one squid for all of them
it will be lik this
squid has 4 lines in and 4 lines out
every in line and out line has adifferent pool
every out line to be routed from aspaciefic in line
can it be done
thanks
LikeLike
Comment by ahmed — June 15, 2014 @ 9:46 PM
We are the worlds leading publisher of Squid ‘Native ACL’ formatted blacklists, that allow for web filtering directly with Squid proxy. Of course we also offer alternative formats for the most widely used third party plugins, such as DansGuardian and Squidguard. And while our blacklists are subscription based, they are as a result of our efforts, of a much higher degree of quality than the free alternatives.
We hope to serve you,
—
Signed,
Benjamin E. Nichols
http://www.squidblacklist.org
LikeLike
Comment by Squidblacklist (@Squidblacklist) — August 23, 2014 @ 1:54 PM
O único que funcionou dentre vários tutorias. Obrigado.
LikeLike
Comment by ijm07 — January 12, 2015 @ 12:53 AM
it does not work for me.
LikeLike
Comment by zero — August 19, 2015 @ 9:24 AM
Assalaamu Alaikum
Jahanzaib bhai plzz https cache squid 3.4 ki detail rakhain https cache ho hi nhi raha us ka kuch tareqa batain
LikeLike
Comment by abdulsami — January 24, 2016 @ 11:04 AM