Proxy Server Setup: Squid and HAProxy Guide

Proxy servers are critical components for managing network traffic, enhancing security, and providing load balancing. In this guide, we will cover the setup of Squid forward proxy and HAProxy load balancer in detail.

What is Squid Proxy?

Squid is the most widely used open-source forward proxy and caching server. It saves bandwidth by caching web content and enhances network security with access control rules.

Key features of Squid:

HTTP/HTTPS Proxy: Forward and reverse proxy support
Caching: Web content caching
ACL (Access Control List): Detailed access control
Bandwidth Throttling: Bandwidth limiting
SSL Bumping: HTTPS traffic inspection
Authentication: LDAP, RADIUS, NCSA authentication

Squid Installation

Installation with Package Manager

hljs bash

# Ubuntu/Debian
sudo apt update
sudo apt install squid -y

# CentOS/RHEL
sudo dnf install squid -y

# Service status
sudo systemctl enable --now squid
sudo systemctl status squid

Squid with Docker

hljs yaml

# docker-compose.yml
version: '3.8'
services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid-proxy
    restart: unless-stopped
    ports:
      - "3128:3128"
    volumes:
      - ./squid.conf:/etc/squid/squid.conf
      - squid_cache:/var/spool/squid
      - squid_logs:/var/log/squid

volumes:
  squid_cache:
  squid_logs:

Squid Basic Configuration

hljs bash

# /etc/squid/squid.conf

# Network definitions
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16

# Port definitions
acl SSL_ports port 443
acl Safe_ports port 80          # HTTP
acl Safe_ports port 443         # HTTPS
acl Safe_ports port 21          # FTP
acl Safe_ports port 1025-65535  # High ports
acl CONNECT method CONNECT

# Access rules
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all

# Proxy port
http_port 3128

# Cache settings
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 100 MB
minimum_object_size 0 KB

# Log settings
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# DNS settings
dns_nameservers 8.8.8.8 8.8.4.4

# Privacy
forwarded_for off
request_header_access Via deny all
request_header_access X-Forwarded-For deny all

Squid ACL Rules

hljs bash

# Block specific sites
acl blocked_sites dstdomain .facebook.com .twitter.com .instagram.com
http_access deny blocked_sites

# Block specific file types
acl blocked_extensions urlpath_regex -i \.(mp3|mp4|avi|mkv)$
http_access deny blocked_extensions

# Restrict access outside working hours
acl work_hours time MTWHF 08:00-18:00
acl social_media dstdomain .youtube.com .reddit.com
http_access deny social_media !work_hours

# IP-based access
acl admin_ips src 192.168.1.100 192.168.1.101
http_access allow admin_ips

# Bandwidth limiting
delay_pools 1
delay_class 1 2
delay_parameters 1 1000000/1000000 500000/500000
delay_access 1 allow localnet

Squid Authentication

hljs bash

# NCSA (htpasswd) authentication
sudo apt install apache2-utils -y
sudo htpasswd -c /etc/squid/passwords user1
sudo htpasswd /etc/squid/passwords user2

# Add to squid.conf
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm Proxy Authentication
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

What is HAProxy?

HAProxy (High Availability Proxy) is a high-performance TCP/HTTP load balancer and proxy server. It can handle millions of concurrent connections and provides enterprise-grade load balancing.

Key features of HAProxy:

Layer 4/7 Load Balancing: TCP and HTTP level load balancing
SSL Termination: SSL/TLS encryption termination
Health Checks: Backend server health monitoring
Sticky Sessions: Session persistence
Rate Limiting: Request rate limiting
Stats Dashboard: Real-time statistics panel

HAProxy Installation

Installation with Package Manager

hljs bash

# Ubuntu/Debian
sudo apt update
sudo apt install haproxy -y

# Version check
haproxy -v

# Start service
sudo systemctl enable --now haproxy

HAProxy with Docker

hljs yaml

# docker-compose.yml
version: '3.8'
services:
  haproxy:
    image: haproxy:latest
    container_name: haproxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
      - ./certs:/etc/haproxy/certs:ro

HAProxy Basic Configuration

hljs bash

# /etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  forwardfor
    option  http-server-close
    timeout connect 5000
    timeout client  50000
    timeout server  50000

# Statistics panel
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if LOCALHOST
    stats auth admin:StrongPassword123

# HTTP → HTTPS redirect
frontend http_front
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

# HTTPS frontend
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    acl is_api path_beg /api
    acl is_static path_end .css .js .png .jpg .gif .ico
    
    use_backend api_servers if is_api
    use_backend static_servers if is_static
    default_backend web_servers

# Web servers backend
backend web_servers
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
    cookie SERVERID insert indirect nocache
    
    server web1 192.168.1.10:8080 check cookie web1 weight 100
    server web2 192.168.1.11:8080 check cookie web2 weight 100
    server web3 192.168.1.12:8080 check cookie web3 weight 50 backup

# API servers backend
backend api_servers
    balance leastconn
    option httpchk GET /health
    
    server api1 192.168.1.20:3000 check
    server api2 192.168.1.21:3000 check

SSL Termination

hljs bash

# HAProxy with Let's Encrypt certificate
sudo cat /etc/letsencrypt/live/example.com/fullchain.pem \
     /etc/letsencrypt/live/example.com/privkey.pem \
     > /etc/haproxy/certs/example.com.pem

# Certificate renewal hook
sudo tee /etc/letsencrypt/renewal-hooks/post/haproxy.sh > /dev/null <<'EOF'
#!/bin/bash
cat /etc/letsencrypt/live/example.com/fullchain.pem \
    /etc/letsencrypt/live/example.com/privkey.pem \
    > /etc/haproxy/certs/example.com.pem
systemctl reload haproxy
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/haproxy.sh

HAProxy Health Check Configuration

hljs bash

backend web_servers
    option httpchk
    http-check connect
    http-check send meth GET uri /health ver HTTP/1.1 hdr Host example.com
    http-check expect status 200
    
    server web1 192.168.1.10:8080 check inter 5s fall 3 rise 2
    server web2 192.168.1.11:8080 check inter 5s fall 3 rise 2

HAProxy Rate Limiting

hljs bash

frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    # Rate limiting - 20 requests per second per IP
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 200 }
    
    # DDoS protection
    stick-table type ip size 100k expire 30s store conn_cur
    http-request deny deny_status 429 if { src_conn_cur ge 50 }

HAProxy High Availability (HA)

HAProxy HA setup with Keepalived:

hljs bash

sudo apt install keepalived -y

# /etc/keepalived/keepalived.conf (Master)
vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass StrongPassword
    }
    
    virtual_ipaddress {
        192.168.1.100/24
    }
    
    track_script {
        check_haproxy
    }
}

Configuration Validation and Testing

hljs bash

# Squid configuration check
squid -k parse
squid -k reconfigure

# HAProxy configuration check
haproxy -c -f /etc/haproxy/haproxy.cfg

# Proxy test
curl -x http://proxy-ip:3128 http://example.com

# HAProxy stats
curl http://localhost:8404/stats

Set up secure internet access with Squid and highly available load balancing with HAProxy on your REXE servers. With SSL termination and health check features, you can build enterprise-grade infrastructure.

Proxy Server Setup: Squid and HAProxy Guide

Table of Contents