Install and configure Squid 6 proxy server with bandwidth controls and content filtering

Intermediate 45 min Apr 14, 2026 607 views
Ubuntu 24.04 Debian 12 AlmaLinux 9 Rocky Linux 9

Set up Squid 6 proxy server with advanced traffic shaping, content filtering, and user authentication. Configure bandwidth limits, access control lists, and comprehensive logging for enterprise proxy deployments.

Prerequisites

  • Root or sudo access
  • At least 2GB RAM
  • 20GB available disk space
  • Basic understanding of networking concepts
  • Email server for monitoring alerts (optional)

What this solves

Squid 6 is a high-performance caching proxy server that provides bandwidth control, content filtering, and user authentication for enterprise networks. This tutorial shows you how to install Squid 6, configure traffic shaping with delay pools, set up content filtering with access control lists, and enable comprehensive logging with authentication mechanisms.

Step-by-step installation

Update system packages

Start by updating your package manager to ensure you get the latest versions of all packages.

sudo apt update && sudo apt upgrade -y
sudo dnf update -y

Install Squid proxy server

Install Squid 6 and additional packages needed for authentication and SSL support.

sudo apt install -y squid apache2-utils ssl-cert
sudo apt install -y squid-langpack squidclient
sudo dnf install -y squid httpd-tools openssl
sudo dnf install -y squid-helpers

Create backup of default configuration

Create a backup of the original Squid configuration file before making changes.

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.backup
sudo chmod 644 /etc/squid/squid.conf.backup

Configure basic Squid settings

Create a new Squid configuration with basic proxy settings, custom port, and access controls.

# Squid 6 Configuration with Bandwidth Controls and Content Filtering

# Basic proxy settings
http_port 3128
coredump_dir /var/spool/squid

# Memory and cache settings
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 1000 16 256
maximum_object_size 50 MB

# Access Control Lists (ACLs)
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
acl localnet src fc00::/7
acl localnet src fe80::/10

# Define business hours (Monday to Friday, 8 AM to 6 PM)
acl business_hours time MTWHF 08:00-18:00

# Content filtering ACLs
acl blocked_sites dstdomain "/etc/squid/blocked_sites.txt"
acl allowed_sites dstdomain "/etc/squid/allowed_sites.txt"

# File type restrictions
acl multimedia urlpath_regex -i \.(avi|mp4|mkv|mov|wmv|flv|mp3|wav|ogg)$
acl executables urlpath_regex -i \.(exe|msi|dmg|pkg|deb|rpm)$

# Safe ports and SSL ports
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT

# Bandwidth control delay pools
delay_pools 3
delay_class 1 2
delay_class 2 2
delay_class 3 1

# Pool 1: Standard users (512 KB/s individual, 2 MB/s aggregate)
delay_parameters 1 2097152/2097152 524288/524288
delay_access 1 allow localnet

# Pool 2: Multimedia restriction (128 KB/s for multimedia)
delay_parameters 2 131072/131072 131072/131072
delay_access 2 allow multimedia
delay_access 2 deny all

# Pool 3: Business hours throttling (1 MB/s during business hours)
delay_parameters 3 1048576/1048576
delay_access 3 allow business_hours localnet
delay_access 3 deny all

# Access rules
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny blocked_sites
http_access deny executables
http_access allow localnet
http_access allow localhost
http_access deny all

# Logging configuration
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
coredump_dir /var/spool/squid

# Performance tuning
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

# Anonymity settings
forwarded_for off
via off

# DNS settings
dns_nameservers 8.8.8.8 1.1.1.1

Create content filtering lists

Create blocked and allowed sites lists for content filtering. These files will contain domains to block or allow.

sudo mkdir -p /etc/squid
sudo touch /etc/squid/blocked_sites.txt
sudo touch /etc/squid/allowed_sites.txt
sudo chown proxy:proxy /etc/squid/blocked_sites.txt /etc/squid/allowed_sites.txt
sudo chmod 644 /etc/squid/blocked_sites.txt /etc/squid/allowed_sites.txt

Configure blocked sites list

Add common sites to block for content filtering. You can customize this list based on your organization's policy.

facebook.com
twitter.com
youtube.com
instagram.com
tiktok.com
reddit.com
netflix.com
gaming.com
porn.com
adult.com
gambling.com
betting.com

Configure allowed sites list

Add business-critical sites that should always be accessible, even if they might match other blocking rules.

google.com
microsoft.com
office.com
outlook.com
gmail.com
github.com
stackoverflow.com
documentation.example.com
company.example.com

Set up user authentication

Create user authentication using htpasswd for basic HTTP authentication. This adds a security layer to your proxy.

sudo mkdir -p /etc/squid/auth
sudo htpasswd -c /etc/squid/auth/users john
sudo htpasswd /etc/squid/auth/users jane
sudo htpasswd /etc/squid/auth/users admin
sudo chown proxy:proxy /etc/squid/auth/users
sudo chmod 600 /etc/squid/auth/users

Configure authentication in Squid

Add authentication configuration to Squid. This will require users to authenticate before accessing the proxy.

sudo tee -a /etc/squid/squid.conf > /dev/null << 'EOF'

# Authentication configuration
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/auth/users
auth_param basic children 5 startup=5 idle=1
auth_param basic realm Squid Proxy Server
auth_param basic credentialsttl 2 hours

# Authentication ACLs
acl authenticated proxy_auth REQUIRED

# Modify access rules to require authentication
http_access allow authenticated localnet
http_access deny all
EOF

Configure log rotation

Set up log rotation to prevent Squid logs from consuming too much disk space.

/var/log/squid/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    create 0644 proxy proxy
    postrotate
        test ! -e /run/squid.pid || /usr/sbin/squid -k rotate
    endscript
}

Initialize Squid cache directories

Initialize the cache directories that Squid will use for storing cached content.

sudo squid -z
sudo chown -R proxy:proxy /var/spool/squid
sudo chmod -R 755 /var/spool/squid

Configure firewall rules

Open the necessary ports for Squid proxy access. We'll allow access on port 3128 from local networks.

sudo ufw allow from 192.168.0.0/16 to any port 3128
sudo ufw allow from 172.16.0.0/12 to any port 3128
sudo ufw allow from 10.0.0.0/8 to any port 3128
sudo ufw reload
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.0.0/16" port protocol="tcp" port="3128" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.16.0.0/12" port protocol="tcp" port="3128" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port protocol="tcp" port="3128" accept'
sudo firewall-cmd --reload

Test configuration and start Squid

Test the Squid configuration for syntax errors, then enable and start the service.

sudo squid -k parse
sudo systemctl enable squid
sudo systemctl start squid
sudo systemctl status squid

Configure monitoring and alerting

Create a script to monitor Squid performance and generate alerts for high bandwidth usage or blocked requests.

#!/bin/bash

# Squid monitoring script
LOG_FILE="/var/log/squid/access.log"
ALERT_EMAIL="admin@example.com"
THRESHOLD_MB=100

# Check bandwidth usage in last hour
CURRENT_HOUR=$(date +"%d/%b/%Y:%H")
BANDWIDTH=$(grep "$CURRENT_HOUR" $LOG_FILE | awk '{sum += $7} END {print int(sum/1048576)}')

if [ "$BANDWIDTH" -gt "$THRESHOLD_MB" ]; then
    echo "High bandwidth usage detected: ${BANDWIDTH}MB in the last hour" | \
    mail -s "Squid Bandwidth Alert" $ALERT_EMAIL
fi

# Check for blocked requests
BLOCKED_COUNT=$(grep "$(date +"%d/%b/%Y")" $LOG_FILE | grep "TCP_DENIED" | wc -l)

if [ "$BLOCKED_COUNT" -gt 50 ]; then
    echo "High number of blocked requests: $BLOCKED_COUNT today" | \
    mail -s "Squid Security Alert" $ALERT_EMAIL
fi

# Log current statistics
echo "$(date): Bandwidth: ${BANDWIDTH}MB, Blocked: ${BLOCKED_COUNT}" >> /var/log/squid/monitoring.log

Set up monitoring cron job

Schedule the monitoring script to run every hour and make it executable.

sudo chmod +x /usr/local/bin/squid-monitor.sh
sudo chown root:root /usr/local/bin/squid-monitor.sh

# Add cron job
echo "0 * * * * /usr/local/bin/squid-monitor.sh" | sudo crontab -

Configure advanced bandwidth controls

Set up user-based bandwidth limits

Configure different bandwidth limits for different user groups using external ACL helpers.

john manager
jane employee
admin manager
guest guest

Configure group-based delay pools

Add group-based bandwidth controls to your Squid configuration for more granular traffic shaping.

sudo tee -a /etc/squid/squid.conf > /dev/null << 'EOF'

# User group definitions
external_acl_type user_group ttl=60 children-max=10 %LOGIN /usr/local/bin/user_group_helper.py
acl managers external user_group manager
acl employees external user_group employee
acl guests external user_group guest

# Manager bandwidth (2 MB/s)
delay_pools 4
delay_class 4 2
delay_parameters 4 2097152/2097152 2097152/2097152
delay_access 4 allow managers authenticated
delay_access 4 deny all

# Employee bandwidth (1 MB/s)
delay_class 5 2
delay_parameters 5 1048576/1048576 1048576/1048576
delay_access 5 allow employees authenticated
delay_access 5 deny all

# Guest bandwidth (512 KB/s)
delay_class 6 2
delay_parameters 6 524288/524288 524288/524288
delay_access 6 allow guests authenticated
delay_access 6 deny all
EOF

Create user group helper script

Create a Python script to determine user groups for bandwidth allocation.

#!/usr/bin/env python3
import sys
import os

# Read user groups from file
GROUP_FILE = '/etc/squid/user_groups.txt'
user_groups = {}

try:
    with open(GROUP_FILE, 'r') as f:
        for line in f:
            if line.strip() and not line.startswith('#'):
                parts = line.strip().split()
                if len(parts) >= 2:
                    user_groups[parts[0]] = parts[1]
except:
    pass

# Process requests
while True:
    try:
        line = sys.stdin.readline().strip()
        if not line:
            break
        
        username = line.split()[0] if line.split() else ''
        group = user_groups.get(username, 'employee')
        
        print(f"OK user={username} group={group}")
        sys.stdout.flush()
    except:
        print("ERR")
        sys.stdout.flush()

Make helper script executable

Set proper permissions for the user group helper script.

sudo chmod +x /usr/local/bin/user_group_helper.py
sudo chown proxy:proxy /usr/local/bin/user_group_helper.py
sudo chown proxy:proxy /etc/squid/user_groups.txt
sudo chmod 644 /etc/squid/user_groups.txt

Verify your setup

Test your Squid proxy configuration to ensure all features are working correctly.

# Check Squid service status
sudo systemctl status squid

# Test configuration syntax
sudo squid -k parse

# Check if Squid is listening on port 3128
sudo netstat -tlnp | grep :3128

# Test proxy functionality
curl -x localhost:3128 -U john:password http://example.com

# Check access logs
sudo tail -f /var/log/squid/access.log

# Monitor bandwidth usage
sudo tail -f /var/log/squid/monitoring.log

# Test blocked site (should be denied)
curl -x localhost:3128 -U john:password http://facebook.com

# Check cache statistics
squidclient -p 3128 mgr:info

# View current delay pool status
squidclient -p 3128 mgr:delay
Note: Replace "password" with the actual password you set during user creation. Monitor the access logs to verify that bandwidth controls and content filtering are working as expected.

Common issues

Symptom Cause Fix
Squid won't start Configuration syntax error sudo squid -k parse to check syntax
Authentication not working Wrong file permissions sudo chmod 600 /etc/squid/auth/users
Cache directory errors Uninitialized cache sudo squid -z to initialize cache
Bandwidth limits not applied Delay pools misconfigured Check ACL order and delay_access rules
Content filtering not working Wrong file format Ensure blocked_sites.txt has one domain per line
High CPU usage Too many auth helpers Reduce auth_param basic children count
Logs growing too large Log rotation not working Check logrotate configuration and permissions
User group helper failing Python script permissions sudo chmod +x /usr/local/bin/user_group_helper.py

Next steps

Automated install script

Run this to automate the entire setup

#squid #proxy server #bandwidth control #content filtering #authentication

Related tutorials

networking Intermediate

Set up HAProxy SSL termination with Let's Encrypt certificates

Learn how to terminate SSL/TLS at HAProxy using Let's Encrypt certificates, redirect HTTP to HTTPS, automate renewal with deploy hooks, and harden your cipher suites for production load balancing.

35 min 4 distros 167 views
networking Advanced

Configure HAProxy with Consul for dynamic service discovery

Learn how to combine HAProxy, Consul and consul-template to build a self-updating load balancer that discovers backends automatically, reacts to health checks, and reloads without downtime.

50 min 4 distros 186 views
networking Advanced

Implement enterprise network QoS with Cisco integration using FRRouting and traffic shaping

Configure enterprise-grade Quality of Service policies with DSCP marking, traffic shaping using tc and HTB, and seamless integration with Cisco equipment through FRRouting BGP and OSPF routing protocols for comprehensive network bandwidth management.

45 min 4 distros 606 views
Browse all tutorials in our complete directory →

Don't want to manage this yourself?

We handle infrastructure for businesses that depend on uptime. Fully managed, with one fixed contact who knows your setup.

You get one fixed contact who knows your setup

Rotterdam 01:27 · reachable in a message, no ticket form

+31 10 477 5362 WhatsApp