3

I have configure squid proxy in our network on ubuntu server. All the traffic being divert to proxy server by Mikrotik router. After I configure squid proxy I changed /etc/squid3/squid.conf as 

http_port 8080  #changed from default port 3128
/var/log/squid3/access.log #uncomment access log
variable_hostname myproxy #added
http_access allow all  #added

I have added following lines to squid.conf to make squid highly anonymous 

forwarded_for transparent
header_access Allow allow all
header_access Authorization allow all
header_access Cache-Control allow all
header_access Content-Encoding allow all
header_access Content-Length allow all
header_access Content-Type allow all
header_access Date allow all
header_access Expires allow all
header_access Host allow all
header_access If-Modified-Since allow all
header_access Last-Modified allow all
header_access Location allow all
header_access Pragma allow all
header_access Accept allow all
#header_access Accept-Enncoding allow all
header_access Accept-Language allow all
header_access Content-Language allow all
header_access Mime-Version allow all
header_access Cookie allow all
header_access Set_Cookie allow all
header_access Retry-After allow all
header_access Title allow all
header_access Connection allow all
header_access Proxy-Connection allow all
header_access All deny all
header_replace User-Agent anonymous

Now internet connection for our network is very slow. The moment I disable the rule which divert all traffic to squid proxy server we get faster internet. How can I make squid proxy server very fast.

Additional Info

OS: Ubuntu server 12.04.
RAM: 512 MB.
HardDisk: 80 GB.
Processor: Pentium 4.
Squid: version 3.1.19

I didn't configure cache in squid to make internet fast but no use.

niren
  • 263
  • 2
  • 5
  • 11
  • Are you certain your problem has to do with squid. If you statically configure a single host to use your squid server directly does it work? How exactly are you redirecting traffic? – Zoredache Dec 03 '13 at 18:40

3 Answers3

5

The server looks like old piece of hardware. For HTTP proxy it is necessary to tune your setup this way:

  • Make sure DNS resolves fast on your squid system (try "host www.google.com", make sure you have fast DNS servers - you can setup Google fast DNS: 8.8.8.8 and 8.8.4.4)
  • Calculate how much memory to use for caching: http://wiki.squid-cache.org/SquidFaq/SquidMemory
  • Make sure your server is not swapping.
  • Put your disk cache onto separate partition dedicated only to the disk cache and nothing else (this is important).
  • Choose proper filesystem for the cache (I recommend ext4 with dir_index option!)
  • Tune your disk cache setting: http://www.squid-cache.org/Doc/config/cache_dir/ (very important - depends on the size and expected files there - are they big or small?)
  • Monitor your server and make tunings over time (you can't achieve perfect setup the first day - you need to revisit your setting after while when cache fills up).
lzap
  • 2,882
  • 2
  • 23
  • 23
  • For me, changing the disk cache setting worked wonders. The default `ufs` disk cache seemed to be blocking on disk IO; changing to `aufs` sped it right up! – z0r Jan 27 '15 at 00:32
1

For completeness...

Your hardware is more than ten years old; you should expect it to perform like hardware of ten years ago! While you should definitely tune your squid server, there's not much that will help when it's running on that ancient monstrosity, except to use more current hardware.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • 1
    Well put :-) Agreed. – lzap Dec 05 '13 at 15:17
  • 1
    Here it is, about a year after this comment, and I've just put together a single-board computer (an APU1D4) for purposes of filtering/proxying traffic for a small network. Admittedly, it's probably more powerful than a P4, and certainly has more than 512M of RAM, but I'm replacing a computer much like the OP, just because this configuration is fanless, and I'm tired of the noise in my office. These computers have PLENTY of power to route and filter traffic for a small network. After turning off IPV6, you can't tell this thing is in the path to the internet. – David Krider Mar 06 '15 at 19:13
0

Maybe you make squid forward all traffic from hacker or scam ip addr, just allow only your incoming host like this:

acl myhost src 11.22.33.44
http_access allow myhost
http_access deny all

You can install bmon for monitoring network traffic when start squid, or tail -f /var/log/squid/access.log for seeing how many heckers are attacking your squid. When log showing TCP_DENIED, Your config may be will right:

1685811047.087      0 159.69.35.117 TCP_DENIED/403 3825 CONNECT 5.188.131.136:80 - HIER_NONE/- text/html
1685811047.113      0 128.140.59.219 NONE/400 3690 NONE error:invalid-request - HIER_NONE/- text/html
1685811047.116      0 216.24.213.159 TCP_DENIED/403 3832 CONNECT 151.248.114.172:80 - HIER_NONE/- text/html
1685811047.121      0 168.119.111.117 TCP_DENIED/403 3830 CONNECT 151.248.126.33:80 - HIER_NONE/- text/html
1685811047.124      0 146.0.36.10 TCP_DENIED/403 3832 CONNECT 95.173.151.110:5060 - HIER_NONE/- text/html
1685811047.129      0 89.208.105.27 TCP_DENIED/403 3831 CONNECT 151.248.114.172:80 - HIER_NONE/- text/html
1685811047.138      0 216.24.213.159 TCP_DENIED/403 3826 CONNECT 5.188.131.136:80 - HIER_NONE/- text/html
1685811047.141      0 216.24.213.159 TCP_DENIED/403 3829 CONNECT 141.8.195.45:3306 - HIER_NONE/- text/html
1685811047.142      0 23.109.137.110 TCP_DENIED/403 3838 CONNECT 31.31.198.18:443 - HIER_NONE/- text/html
nobjta_9x_tq
  • 101
  • 2