Skip to main content
Back to Category

Proxy Server Setup: Squid and HAProxy Guide

Squid forward proxy, HAProxy load balancer, SSL termination, ACL rules, caching, health checks and high availability.

Read time: 16 min Monitoring
proxysquidhaproxyload balancerssl terminationcaching
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Proxy Server Setup: Squid and HAProxy Guide

Proxy servers are critical components for managing network traffic, enhancing security, and providing load balancing. In this guide, we will cover the setup of Squid forward proxy and HAProxy load balancer in detail.

What is Squid Proxy?

Squid is the most widely used open-source forward proxy and caching server. It saves bandwidth by caching web content and enhances network security with access control rules.

Key features of Squid:

  • HTTP/HTTPS Proxy: Forward and reverse proxy support
  • Caching: Web content caching
  • ACL (Access Control List): Detailed access control
  • Bandwidth Throttling: Bandwidth limiting
  • SSL Bumping: HTTPS traffic inspection
  • Authentication: LDAP, RADIUS, NCSA authentication

Squid Installation

Installation with Package Manager

hljs bash
# Ubuntu/Debian
sudo apt update
sudo apt install squid -y

# CentOS/RHEL
sudo dnf install squid -y

# Service status
sudo systemctl enable --now squid
sudo systemctl status squid

Squid with Docker

hljs yaml
# docker-compose.yml
version: '3.8'
services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid-proxy
    restart: unless-stopped
    ports:
      - "3128:3128"
    volumes:
      - ./squid.conf:/etc/squid/squid.conf
      - squid_cache:/var/spool/squid
      - squid_logs:/var/log/squid

volumes:
  squid_cache:
  squid_logs:

Squid Basic Configuration

hljs bash
# /etc/squid/squid.conf

# Network definitions
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16

# Port definitions
acl SSL_ports port 443
acl Safe_ports port 80          # HTTP
acl Safe_ports port 443         # HTTPS
acl Safe_ports port 21          # FTP
acl Safe_ports port 1025-65535  # High ports
acl CONNECT method CONNECT

# Access rules
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all

# Proxy port
http_port 3128

# Cache settings
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 100 MB
minimum_object_size 0 KB

# Log settings
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# DNS settings
dns_nameservers 8.8.8.8 8.8.4.4

# Privacy
forwarded_for off
request_header_access Via deny all
request_header_access X-Forwarded-For deny all

Squid ACL Rules

hljs bash
# Block specific sites
acl blocked_sites dstdomain .facebook.com .twitter.com .instagram.com
http_access deny blocked_sites

# Block specific file types
acl blocked_extensions urlpath_regex -i \.(mp3|mp4|avi|mkv)$
http_access deny blocked_extensions

# Restrict access outside working hours
acl work_hours time MTWHF 08:00-18:00
acl social_media dstdomain .youtube.com .reddit.com
http_access deny social_media !work_hours

# IP-based access
acl admin_ips src 192.168.1.100 192.168.1.101
http_access allow admin_ips

# Bandwidth limiting
delay_pools 1
delay_class 1 2
delay_parameters 1 1000000/1000000 500000/500000
delay_access 1 allow localnet

Squid Authentication

hljs bash
# NCSA (htpasswd) authentication
sudo apt install apache2-utils -y
sudo htpasswd -c /etc/squid/passwords user1
sudo htpasswd /etc/squid/passwords user2

# Add to squid.conf
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm Proxy Authentication
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

What is HAProxy?

HAProxy (High Availability Proxy) is a high-performance TCP/HTTP load balancer and proxy server. It can handle millions of concurrent connections and provides enterprise-grade load balancing.

Key features of HAProxy:

  • Layer 4/7 Load Balancing: TCP and HTTP level load balancing
  • SSL Termination: SSL/TLS encryption termination
  • Health Checks: Backend server health monitoring
  • Sticky Sessions: Session persistence
  • Rate Limiting: Request rate limiting
  • Stats Dashboard: Real-time statistics panel

HAProxy Installation

Installation with Package Manager

hljs bash
# Ubuntu/Debian
sudo apt update
sudo apt install haproxy -y

# Version check
haproxy -v

# Start service
sudo systemctl enable --now haproxy

HAProxy with Docker

hljs yaml
# docker-compose.yml
version: '3.8'
services:
  haproxy:
    image: haproxy:latest
    container_name: haproxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
      - ./certs:/etc/haproxy/certs:ro

HAProxy Basic Configuration

hljs bash
# /etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  forwardfor
    option  http-server-close
    timeout connect 5000
    timeout client  50000
    timeout server  50000

# Statistics panel
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if LOCALHOST
    stats auth admin:StrongPassword123

# HTTP → HTTPS redirect
frontend http_front
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

# HTTPS frontend
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    acl is_api path_beg /api
    acl is_static path_end .css .js .png .jpg .gif .ico
    
    use_backend api_servers if is_api
    use_backend static_servers if is_static
    default_backend web_servers

# Web servers backend
backend web_servers
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
    cookie SERVERID insert indirect nocache
    
    server web1 192.168.1.10:8080 check cookie web1 weight 100
    server web2 192.168.1.11:8080 check cookie web2 weight 100
    server web3 192.168.1.12:8080 check cookie web3 weight 50 backup

# API servers backend
backend api_servers
    balance leastconn
    option httpchk GET /health
    
    server api1 192.168.1.20:3000 check
    server api2 192.168.1.21:3000 check

SSL Termination

hljs bash
# HAProxy with Let's Encrypt certificate
sudo cat /etc/letsencrypt/live/example.com/fullchain.pem \
     /etc/letsencrypt/live/example.com/privkey.pem \
     > /etc/haproxy/certs/example.com.pem

# Certificate renewal hook
sudo tee /etc/letsencrypt/renewal-hooks/post/haproxy.sh > /dev/null <<'EOF'
#!/bin/bash
cat /etc/letsencrypt/live/example.com/fullchain.pem \
    /etc/letsencrypt/live/example.com/privkey.pem \
    > /etc/haproxy/certs/example.com.pem
systemctl reload haproxy
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/haproxy.sh

HAProxy Health Check Configuration

hljs bash
backend web_servers
    option httpchk
    http-check connect
    http-check send meth GET uri /health ver HTTP/1.1 hdr Host example.com
    http-check expect status 200
    
    server web1 192.168.1.10:8080 check inter 5s fall 3 rise 2
    server web2 192.168.1.11:8080 check inter 5s fall 3 rise 2

HAProxy Rate Limiting

hljs bash
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    # Rate limiting - 20 requests per second per IP
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 200 }
    
    # DDoS protection
    stick-table type ip size 100k expire 30s store conn_cur
    http-request deny deny_status 429 if { src_conn_cur ge 50 }

HAProxy High Availability (HA)

HAProxy HA setup with Keepalived:

hljs bash
sudo apt install keepalived -y

# /etc/keepalived/keepalived.conf (Master)
vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass StrongPassword
    }
    
    virtual_ipaddress {
        192.168.1.100/24
    }
    
    track_script {
        check_haproxy
    }
}

Configuration Validation and Testing

hljs bash
# Squid configuration check
squid -k parse
squid -k reconfigure

# HAProxy configuration check
haproxy -c -f /etc/haproxy/haproxy.cfg

# Proxy test
curl -x http://proxy-ip:3128 http://example.com

# HAProxy stats
curl http://localhost:8404/stats

Set up secure internet access with Squid and highly available load balancing with HAProxy on your REXE servers. With SSL termination and health check features, you can build enterprise-grade infrastructure.

Frequently Asked Questions

I cannot access HTTPS sites through Squid proxy.

Make sure the SSL_ports ACL includes port 443 and the 'http_access deny CONNECT !SSL_ports' rule is in the correct order. HTTPS traffic uses the CONNECT method. Check that port 3128 is open in the firewall. Verify that proxy settings are correctly configured on the client side.

HAProxy backend servers show as 'DOWN'.

Verify that the health check endpoint (/health) is working on backend servers. Check the 'http-check expect status 200' setting. Test connectivity from HAProxy to backend servers: 'curl http://192.168.1.10:8080/health'. Review HAProxy logs: 'tail -f /var/log/haproxy.log'. Adjust health check interval and fall/rise values.

How do I configure SSL certificates with HAProxy?

Convert the Let's Encrypt certificate to PEM format: 'cat fullchain.pem privkey.pem > example.com.pem'. Define it in the HAProxy frontend as 'bind *:443 ssl crt /etc/haproxy/certs/example.com.pem'. Create a renewal hook script for certificate renewal. You can use SNI for multiple domains.

How can I improve Squid cache performance?

Increase cache_mem (512 MB or more). Adjust cache_dir size according to disk capacity. Increase maximum_object_size for large files. Use SSD disks. Optimize cache duration with refresh_pattern rules. Monitor cache hit ratio with 'squidclient mgr:info'.

How do sticky sessions work in HAProxy?

Add 'cookie SERVERID insert indirect nocache' in the backend definition and add a 'cookie server_name' parameter to each server line. HAProxy sends a cookie to the client and routes subsequent requests to the same backend server. Alternatively, you can use 'stick-table' for IP-based persistence.

What is the difference between HAProxy and Nginx reverse proxy?

HAProxy is specifically designed for load balancing and offers more advanced features in this area: detailed health checks, advanced algorithm options (leastconn, uri, hdr), real-time stats dashboard, and lower latency. Nginx is more versatile as a web server + reverse proxy. HAProxy is generally preferred in high-traffic environments.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps