clearos 6.4 + Squid 3.5.2 Gateway Mode https caching

clearos 6.4 + Squid 3.5.2 Gateway Mode https caching

April 1, 2015 — mikrotiksquid

clearos 6.4 + squid 3.5.2 (Gateway Mode [https cache :P)
http://forum.clearos.or.id/index.php?topic=2458.0

# yum update 

# yum-config-manager --enable clearos-core

# yum --enablerepo=clearos-core,clearos-developer,clearos-epel install clearos-devel app-devel

# yum install openssl openssl-devel fakeroot ccze ebtables perl-File-ReadBackwards libcap libcap-devel libtool-ltdl-devel automake gcc glibc-devel e2fsprogs-devel sharutils

# yum --enablerepo=* install libtool libtool-ltdl libtool-ltdl-devel

# reboot

# service squid stop

# service remove squid 

# mkdir /squid3

# mkdir /etc/apache2

# cd squid3

# wget ... bla bla .. squid.org 

# tar -zxvf squid 3.5.2

# cd squid 3.5.2

# ./bootstrap.sh 

# ./configure options:  '--prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--sysconfdir=/etc/squid' '--localstatedir=/cache' '--libdir=/usr/lib' '--includedir=/usr/include' '--datadir=/usr/share/squid' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--srcdir=.' '--disable-dependency-tracking' '--disable-strict-error-checking' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--disable-ipv6' '--disable-wccp' '--disable-wccpv2' '--enable-kill-parent-hack' '--disable-snmp' '--enable-cachemgr-hostname=squid' '--enable-ssl' '--enable-cache-digests' '--disable-select' '--enable-http-violations' '--enable-linux-netfilter' '--enable-follow-x-forwarded-for' '--disable-ident-lookups' '--enable-ssl-crtd' '--disable-auth-basic' '--enable-x-accelerator-vary' '--enable-zph-qos' '--with-default-user=squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid.pid' '--with-swapdir=/var/spool/squid' '--with-aufs-threads=32' '--with-dl' '--with-large-fi  les' '--with-openssl' '--enable-ltdl-convenience' '--enable-delay-pools' '--with-filedescriptors=65536

# make 

# make install

# squid -v

# mkdir /cache

# chown squid:squid /cache && chmod 755 /cache

# chown squid:squid /var/log/squid

# cd

# mkdir /etc/squid/cert

# cd /etc/squid/cert 

# openssl genrsa 4096 > /etc/squid/cert/private.pem

# openssl req -new -x509 -days 3650 -key /etc/squid/cert/private.pem -out /etc/squid/cert/public.pem

# openssl x509 -in /etc/squid/cert/public.pem -outform DER -out /etc/squid/cert/gobrother.der

# /usr/lib/squid/ssl_crtd -c -s /etc/squid/ssl_db

# chown -R squid:squid /etc/squid/ssl_db

# chown -R nobody /etc/squid/ssl_db/

# touch /var/log/squid/cache.log

# touch /var/log/squid/access.log

# chown -R squid:squid /etc/squid/cert

# chown -R squid:squid /var/log/squid/

# chown -R squid:squid /var/log/squid/cache.log

# chown -R squid:squid /var/log/squid/access.log

# chmod 755 /etc/squid/store-id.pl squid.conf 

# cd /etc/apache2

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

Listen 3129
Listen 3128

<IfModule ssl_module>
 Listen 443
</IfModule>

<IfModule mod_gnutls.c>
 Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

buat file + save dengan nama (apaajaboleh.conf)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


# chmod 755 /etc/apache2/apaajaboleh.conf

# chown -R squid:squid /etc/apache2/apaajaboleh.conf

# cd /etc/rc.d

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

edit rc.local + save

iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A INPUT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

iptables -t mangle -A PREROUTING ! -d xx.xx.xx.xx/24 -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128
iptables -t mangle -A PREROUTING ! -d xx.xx.xx.xx/24 -p tcp --dport 443 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129


/sbin/ip rule add fwmark 1 lookup 100
/sbin/ip route add local 0.0.0.0/0 dev lo table 100

echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter
echo 1 > /proc/sys/net/ipv4/ip_forward

exit 0

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# squid -z 

# squid -Nd1 &

# service firewall restart

+++++++ catatan pribadi ++++++++++
tidak untuk diperjual belikan 
resiko ditanggung penumpang 
+++++++++++++++++++++++++++++++++

sumber: https://mikrotiksquid.wordpress.com/2015/04/01/clearos-6-4-squid-3-5-2-gateway-mode-https-caching/