Cara Install squid-3.4.7 di Ubuntu Server

Update dan Upgrade :

apt-get update
apt-get upgrade

Install Packet-Packet untuk mendukung squid-3 seperti berikut :

apt-get install devscripts build-essential openssl libssl-dev fakeroot libcppunit-dev libsasl2-dev cdbs ccze libfile-readbackwards-perl libcap2 libcap-dev libcap2-dev
apt-get install libtool sysv-rc-conf

Download dan Extract squid-3.4.7 :

wget http://www.squid-cache.org/Versions/v3/3.4/squid-3.4.7.tar.bz2
tar -xjf squid-3.4.7.tar.bz2
cd squid-3.4.7

Download Patch 302 dan memleak kemudian patch squid-3.4.7 :

wget https://googledrive.com/host/0B8LC6mDTXV0hVEpYN1I5djVPSlU/302_v2_memleak.patch
patch -p0 < 302_v2_memleak.patch

Compile squid-3.4.7 :

./configure \
--prefix=/usr \
--exec-prefix=/usr \
--bindir=/usr/sbin \
--sbindir=/usr/sbin \
--datadir=/usr/share/squid \
--includedir=/usr/include \
--libexecdir=/usr/lib/squid \
--sysconfdir=/etc/squid \
--localstatedir=/var/spool/squid \
--libdir=/usr/lib \
--sharedstatedir=/usr/com \
--mandir=/usr/share/man \
--infodir=/usr/share/info \
--x-includes=/usr/include \
--x-libraries=/usr/lib \
--enable-http-violations \
--enable-async-io=24 \
--enable-storeio=aufs \
--enable-linux-netfilter \
--enable-ssl \
--enable-ssl-crtd \
--enable-removal-policies=heap \
--enable-follow-x-forwarded-for \
--enable-zph-qos \
--enable-delay-pools \
--disable-icmp \
--disable-ipv6 \
--disable-epoll \
--disable-ident-lookups \
--with-aufs-threads=24 \
--with-large-files \
--with-libcap \
--with-openssl \
--with-included-ltdl \
--with-default-user=proxy \
--with-logdir=/etc/log/squid \
--with-pidfile=/var/run/squid.pid \
--with-maxfd=65536 \
--with-filedescriptors=65536

Install squid-3.4.7 :

make & make install

Membuat Certificate Untuk squid-3.4.7 :

cd /etc/squid
mkdir ssl_certs
cd ssl_certs
openssl genrsa -out squid.key 2048
openssl req -new -key squid.key -out squid.csr -nodes
openssl x509 -req -days 3652 -in squid.csr -signkey squid.key -out squid.crt

Buat Certificate Cache :

mkdir /var/lib/squid
chown -R nobody /var/lib/squid/
/usr/lib/squid/ssl_crtd -c -s /var/lib/squid/ssl_db
chown -R proxy:proxy /var/lib/squid/ssl_db/
chmod -R 777 /var/lib/squid/ssl_db/

Konfigurasi squid.conf :

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 192.168.10.0/24 # Sesuaikan dengan ip client/local

acl SSL_ports port 443
acl Safe_ports port 80  # http
acl Safe_ports port 21  # ftp
acl Safe_ports port 443  # https
acl Safe_ports port 70  # gopher
acl Safe_ports port 210  # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280  # http-mgmt
acl Safe_ports port 488  # gss-http
acl Safe_ports port 591  # filemaker
acl Safe_ports port 777  # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all

# squid ssl_bump option
#
always_direct allow all
ssl_bump server-first all
sslproxy_cert_error deny all
sslproxy_flags DONT_VERIFY_PEER
sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/squid/ssl_db -M 4MB
sslcrtd_children 8 startup=1 idle=1

# Squid normally listens to port 3128
https_port 3129 tproxy ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_certs/squid.crt key=/etc/squid/ssl_certs/squid.key
http_port 3128 tproxy
http_port 3127

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /cache_proxy 25000 16 256 # sesuaikan dengan drive penyimpanan cache 

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:  1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .  0 20% 4320

Silahkan di kembangkan sendiri sesuai keinginan anda, di atas adalah contoh. Beri permision pada disk cache :

chown -R proxy:proxy /cache_proxy
chmod -R 777 /cache_proxy

Untuk membentuk directory di dalam disk cache jalankan perintah berikut :

squid -f /etc/squid/squid.conf -z

Cek squid.conf apakah ada error atau tidak, jika masih terdapat error silahkan perbaiki terlebih dahulu. Buat file squid di dalam /etc/init.d/squid :

touch /etc/init.d/squid
chmod +x /etc/init.d/squid
nano /etc/init.d/squid

Copy code berikut ke dalamnya :

#! /bin/sh
#
# squid32012                Startup script for the SQUID HTTP proxy-cache.
#
# Version:      @(#)squid3.rc  1.0  07-Jul-2006  luigi@debian.org
#
### BEGIN INIT INFO
# Provides:          Squid 3.X
# File-Location:     /etc/init.d/squid3
# Required-Start:    $network $remote_fs $syslog
# Required-Stop:     $network $remote_fs $syslog
# Should-Start:      $named
# Should-Stop:       $named
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Squid HTTP Proxy version 3.2.0.12
### END INIT INFO
 
NAME=squid
DESC="Squid HTTP Proxy 3.X"
DAEMON=/usr/sbin/squid
PIDFILE=/var/run/$NAME.pid
CONFIG=/etc/squid/squid.conf
SQUID_ARGS="-YC -f $CONFIG"
# RAMFS=/scripts/ramcache
 
[ ! -f /etc/default/squid ] || . /etc/default/squid
 
. /lib/lsb/init-functions
 
PATH=/bin:/usr/bin:/sbin:/usr/sbin
 
[ -x $DAEMON ] || exit 0
 
ulimit -n 65536
 
find_cache_dir () {
        w="     " # space tab
        res=`sed -ne '
                s/^'$1'['"$w"']\+[^'"$w"']\+['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
                t end;
                d;
                :end q' < $CONFIG`
        [ -n "$res" ] || res=$2
        echo "$res"
}
 
find_cache_type () {
        w="     " # space tab
        res=`sed -ne '
                s/^'$1'['"$w"']\+\([^'"$w"']\+\).*$/\1/p;
                t end;
                d;
                :end q' < $CONFIG`
        [ -n "$res" ] || res=$2
        echo "$res"
}
 
start () {
        cache_dir=`find_cache_dir cache_dir /var/spool/squid/cache`
        cache_type=`find_cache_type cache_dir ufs`
 
        if [ "$cache_type" = "coss" -a -d "$cache_dir" -a ! -f "$cache_dir/stripe" ] || [ "$cache_type" != "coss" -a -d "$cache_dir" -a ! -d "$cache_dir/00" ]
        then
                log_warning_msg "Creating $DESC cache structure"
                $DAEMON -z
        fi
 
        umask 027
        ulimit -n 65536
 
               
        cd $cache_dir
        start-stop-daemon --quiet --start \
                --pidfile $PIDFILE \
                --exec $DAEMON -- $SQUID_ARGS < /dev/null
        return $?
}
 
stop () {
 
        PID=`cat $PIDFILE 2>/dev/null`
        start-stop-daemon --stop --quiet --pidfile $PIDFILE --exec $DAEMON
        sleep 2
        if test -n "$PID" && kill -0 $PID 2>/dev/null
        then
                log_action_begin_msg " Waiting"
                cnt=0
                while kill -0 $PID 2>/dev/null
                do
                        cnt=`expr $cnt + 1`
                        if [ $cnt -gt 24 ]
                        then
                                log_action_end_msg 1
                                return 1
                        fi
                        sleep 5
                        log_action_cont_msg ""
                done
                log_action_end_msg 0
                return 0
        else
                return 0
        fi
}
 
case "$1" in
    start)
        log_daemon_msg "Starting $DESC" "$NAME"
        if start ; then
                log_end_msg $?
        else
                log_end_msg $?
        fi
        ;;
    stop)
        log_daemon_msg "Stopping $DESC" "$NAME"
 
 
        if stop ; then
                log_end_msg $?
        else
                log_end_msg $?
        fi
        ;;
    reload|force-reload)
        log_action_msg "Reloading $DESC configuration files"
        start-stop-daemon --stop --signal 1 \
                --pidfile $PIDFILE --quiet --exec $DAEMON
        log_action_end_msg 0
        ;;
    restart)
        log_daemon_msg "Restarting $DESC" "$NAME"
        stop
        if start ; then
                log_end_msg $?
        else
                log_end_msg $?
        fi
        ;;
    status)
       status_of_proc -p "$PIDFILE" "$DAEMON" squid && exit 0 || exit $?
        ;;
    *)
        echo "Usage: /etc/init.d/$NAME {start|stop|reload|force-reload|restart|status}"
        exit 3
        ;;
esac

exit 0

Jalankan squid :

/etc/init.d/squid restart

Cek apakah squid sudah berjalan :

/etc/init.d/squid status

jika muncul tulisan * squid is running artinya squid sudah berjalan. Terakhir silahkan import certificate yang sudah di tadi ke dalam browser.

Konfigurasi Firewall Tproxy squid-3.4.7

Agar tproxy pada squid-3.4.7 dapat berjalan dengan baik anda harus membuat firewall dan mengaktifkan beberapa modul untuk mengdukung tproxy.
Berikut beberapa modul yang harus di aktifkan, letakan Konfigurasi berikut di dalam file rc.local yang berada di /etc/rc.local.

modprobe xt_TPROXY
modprobe xt_socket
modprobe xt_mark
modprobe nf_nat
modprobe nf_conntrack_ipv4
modprobe nf_conntrack
modprobe nf_defrag_ipv4
modprobe ipt_REDIRECT
modprobe iptable_nat

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter

ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

Mangle tproxy :

iptables -t mangle -F
iptables -t mangle -X

iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A INPUT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -d 192.168.10.251 -p tcp -m multiport --dports 80,443,3127,3128,3129,8000,8080 -j ACCEPT
iptables -t mangle -A PREROUTING ! -d 192.168.10.251 -p tcp -m multiport --dports 80,8080,8000 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128
iptables -t mangle -A PREROUTING ! -d 192.168.10.251 -p tcp -m multiport --dports 443 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

Ketrangan : 
192.168.10.251 adalah IP Proxy Server silahkan sesuaikan dengan keadaan di tempat anda.

Mangle tproxy di mikrotik.

/ip firewall mangle
add action=mark-routing chain=prerouting disabled=no dst-port=80,443 in-interface= new-routing-mark=proxy passthrough=no protocol=tcp
add action=mark-connection chain=prerouting disabled=no dst-port=80,443 in-interface= new-connection-mark=tproxy passthrough=yes protocol=tcp src-address=!192.168.10.251
add action=mark-routing chain=prerouting connection-mark=tproxy disabled=no in-interface=! new-routing-mark=proxy passthrough=no