Introduction

Squid is commonly used as a forward proxy between clients and external services. Its security depends on precise ACLs and ordered http_access rules; an open proxy can be abused from the Internet.

What you should be able to do after this lesson:

Locate and validate squid.conf.
Define ACLs for clients, destinations, ports, and times.
Understand ordered access decisions.
Recognize proxy authentication and caching behavior.
Read Squid logs and test client access.

Big Idea: Define Conditions First, Then Ordered Decisions

A Squid ACL does not permit or deny anything by itself. It gives a condition a name. http_access evaluates those conditions in order and stops at the first matching decision.

request facts -> named ACL matches -> first matching http_access rule -> allow or deny

Read a policy from top to bottom with a concrete client and destination in mind.

Basic Configuration

A common configuration path is /etc/squid/squid.conf.

http_port 3128

acl localnet src 192.0.2.0/24
acl SSL_ports port 443
acl Safe_ports port 80 443

http_access deny !Safe_ports
http_access allow localnet
http_access deny all

ACL lines define conditions. http_access lines make decisions. Squid evaluates access rules in order, so a broad early allow can bypass later restrictions.

Useful ACL Types

src for client addresses
dst for destination addresses
dstdomain for destination domain names
port for destination ports
method for HTTP methods
time for schedules
proxy_auth for authenticated users

Avoid assuming a domain ACL proves the final destination is trustworthy; DNS and redirects can affect behavior.

Authentication Awareness

Squid can call authentication helpers for Basic and other schemes. Credentials and helper behavior must match the client environment. Authentication identifies a user but does not automatically authorize every destination.

Caching and HTTPS

HTTP responses include cache-control information that influences whether objects are stored. Many dynamic or authenticated responses should not be cached.

Normal HTTPS through a forward proxy uses the CONNECT method to establish a tunnel. The proxy does not see encrypted HTTP content unless TLS interception is deliberately configured, which introduces major trust, privacy, and legal considerations.

Resource settings such as memory cache, disk cache directories, object-size limits, and replacement policy affect capacity. Measure hit rate, disk I/O, memory, and response time before increasing cache sizes. A larger cache is not automatically a faster proxy.

Validate and Operate

squid -k parse
squid -k reconfigure
systemctl status squid

Common logs include access.log and cache.log. Test from an allowed client and from a path that should be denied.

Guided Practice: Prove Rule Ordering

On an isolated lab proxy, define one allowed client subnet and a restricted destination port set. Before reconfiguration, parse the file:

squid -k parse

Test this matrix from an allowed client:

permitted HTTP destination
permitted HTTPS CONNECT destination
unsafe destination port
explicitly denied domain

Repeat from a client outside the allowed subnet. For every request, connect the result to one http_access line and one access-log entry. Move a broad allow above a specific deny temporarily in the lab, predict the result, then restore the secure order and retest.

Troubleshooting Scenario

Internal clients are unexpectedly denied even though acl localnet src ... is correct. An earlier http_access deny all matches before the later allow.

Move the intended allow before the final deny, parse configuration, reconfigure, and test both trusted and untrusted clients. Changing the ACL subnet cannot fix a decision that is never reached.

Exam Focus

Know the usual squid.conf role and http_port listener.
Distinguish ACL definitions from ordered http_access decisions.
Understand proxy authentication separately from destination authorization.
Relate cache resource settings to measured memory, disk, and workload limits.

Recap

ACL definitions and access decisions are separate.
http_access order is significant.
End every policy with an explicit decision, commonly deny all.
Restrict listeners and firewall access so Squid cannot become an open proxy.

208.3 Implementing Squid as a caching proxy