Increase internet response speed by using a local Squid proxy
There are many reasons to start hosting an outgoing proxy. Mine was slow upstream servers. But if, for whatever reason, you wish to use an outgoing proxy, this blogpost might be helpful.
The steps are as follows:
- Compile and Install the software (squid on Debian Linux in my case)
- Configure the software (squid on Debian Linux)
- Configure your various software to accept the proxy intercepting the TLS secure connections
- Redirect all traffic through the proxy, with some exceptions if needed.
Compile and Install
- Debian doesn't include tls interception (called ssl-bump in squid) support. If you want this, you need to recompile.
sudo apt install build-essential libssl-dev devscripts p11-kit-modules sudo apt build-dep squid apt source squid cd squid-4.13 (or whatever version was downloaded) - Edit debian/rules and replace
--with-gnutlswith:--enable-ssl \ --enable-ssl-crtd \ --with-openssl - Edit the debian/changelog file and on the first line, edit the version from (x.xx.x-yy) to (x.xx.x-99). In other words, replace the part after the dash with 99 to prevent replacement by apt.
- Build the package with
debuild - Install the resulting package:
cd .. apt install squid_*deb squid-common_*deb
Configure
- Prepare the Certificate Authority (CA)
mkdir -p /etc/squid/cert/ cd /etc/squid/cert/ # This puts the private key and the self-signed certificate in the same file openssl req -new -newkey rsa:4096 -sha256 -days 3650 -nodes -x509 -keyout myCA.pem -out myCA.pem - Create a config file /etc/squid/squid.conf
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src 127.0.0.1/8 acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl DiscoverSNIHost at_step SslBump1 acl step2 at_step SslBump2 acl websocket url_regex ^wss://.*$ acl tunnelsites ssl::server_name_regex -i "/etc/squid/tunnelsites.list" http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager include /etc/squid/conf.d/* http_access allow localnet http_access allow localhost http_access deny all http_port 3128 http_port 3129 intercept https_port 3131 intercept ssl-bump tls-cert=/etc/squid/cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=8MB ssl_bump splice websocket ssl_bump splice tunnelsites ssl_bump peek DiscoverSNIHost ssl_bump bump all sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB sslcrtd_children 5 sslproxy_cert_error deny all cache_mem 2500 MB memory_cache_mode always maximum_object_size_in_memory 5 MB coredump_dir /var/spool/squid refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern -i .(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i .(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i .(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i .(css|js)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i .index.(html|htm)$ 0 40% 10080 refresh_pattern -i .(html|htm)$ 1440 40% 40320 refresh_pattern . 0 40% 40320 global_internal_static off forwarded_for delete - Create the certificate database by issuing
/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MBand correct access rights with
chmod -R proxy:proxy /var/spool/squid/ssl_db - Restart squid with
systemctl restart squid
Configure client software
- Prepare the CA certificate for use by browsers.
# This can be added to browsers openssl x509 -in /etc/squid/cert/myCA.pem -outform DER -out /tmp/myCA.der - Add the squid CA to the system wide ca-certificates
# Copy the CA to the ca-certificates directory sudo openssl x509 -in /etc/squid/cert/myCA.pem -out /usr/share/ca-certificates/myCA.crt - Add the line
myCA.crtto /etc/ca-certificates.conf and runsudo update-ca-certificates - For firefox (this is what I use), open the settings, find security devices and add
/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.soas a security device. This means Firefox will also trust the system wide CAs. - For other browsers, you can import the /tmp/myCA.der as a Certificate Authority.
Force all traffic through the proxy
- Install packages for firewall management if not already installed:
sudo apt install netfilter-persistent iptables-persistent - Configure the firewall rules
sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner root -j RETURN sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner proxy -j RETURN sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -m owner --uid-owner root -j RETURN sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -m owner --uid-owner proxy -j RETURN sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129 sudo iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3131 - Save the rules:
sudo netfilter-persistent save
Have a cup of tea
Because you're done. You might need to relogin/reboot for the p11-kit stuff to take effect.