← Back to DevBytes
Developer Tutorial August 08, 2026 18 min read

Squid Proxy: Complete Setup and Configuration Guide

Introduction to Squid Proxy

Squid is a powerful, open-source caching proxy server that supports HTTP, HTTPS, FTP, and other network protocols. Originally developed in the mid-1990s, Squid has evolved into one of the most widely deployed proxy servers in the world, used by organizations ranging from small businesses to large enterprises and internet service providers. At its core, Squid sits between client applications and the internet, intercepting requests, caching responses, and enforcing access policies.

Unlike simple forwarding proxies, Squid offers sophisticated caching mechanisms, granular access control lists, bandwidth management, and detailed logging capabilities. It runs on most Unix-like operating systems, including Linux, BSD variants, and Solaris, making it a versatile choice for network administrators and developers who need reliable proxy infrastructure.

What Squid Actually Does

When a client makes a request through Squid, the proxy evaluates the request against configured rules, checks if a cached copy of the requested resource exists, and either serves the cached content or forwards the request to the destination server. The response is then cached for future requests. This process reduces bandwidth consumption, improves response times, and provides a central point for monitoring and controlling web traffic.

Why Squid Proxy Matters

Understanding the value of Squid requires looking at the specific problems it solves in real-world scenarios. Network administrators and developers choose Squid for several compelling reasons.

Bandwidth Optimization

In environments where bandwidth is expensive or limited, Squid's caching capabilities can dramatically reduce external traffic. When multiple users access the same resources, Squid serves cached copies instead of making repeated requests to origin servers. This is particularly valuable for organizations with many users accessing common software updates, documentation, or media content.

Access Control and Security

Squid provides fine-grained control over what users can access. Administrators can block specific websites, restrict access by time of day, limit bandwidth per user, and require authentication. This makes Squid an effective tool for enforcing acceptable use policies and protecting against malicious content.

Performance Improvement

By caching frequently accessed content closer to users, Squid reduces latency and improves perceived performance. This is especially beneficial for organizations with slow or congested internet connections, as cached content is served at local network speeds.

Monitoring and Compliance

Squid's detailed logging capabilities provide visibility into web usage patterns. Organizations can use these logs for compliance reporting, security analysis, and capacity planning. The logs capture information about requested URLs, response times, cache hit ratios, and user identities when authentication is enabled.

Content Filtering

Through integration with external filtering services and custom access control lists, Squid can block access to malicious or inappropriate content. This makes it a valuable component in layered security architectures.

Installing Squid Proxy

Installation procedures vary by operating system, but the process is straightforward on most platforms. Below are instructions for common Linux distributions.

Installing on Ubuntu and Debian

# Update package lists
sudo apt update

# Install Squid
sudo apt install squid3 -y

# Verify installation
squid -v

# Check service status
sudo systemctl status squid

Installing on CentOS, RHEL, and Fedora

# Install EPEL repository (if needed)
sudo dnf install epel-release -y

# Install Squid
sudo dnf install squid -y

# Enable and start the service
sudo systemctl enable squid
sudo systemctl start squid

# Check service status
sudo systemctl status squid

Installing from Source

For environments where you need a specific version or custom compilation options, building from source is the way to go.

# Install build dependencies
sudo apt install build-essential gcc g++ libssl-dev -y

# Download source
wget http://www.squid-cache.org/Versions/v6/squid-6.10.tar.gz
tar xzf squid-6.10.tar.gz
cd squid-6.10

# Configure with common options
./configure \
  --prefix=/usr/local/squid \
  --enable-ssl-crtd \
  --with-openssl \
  --enable-linux-netfilter

# Compile and install
make -j$(nproc)
sudo make install

# Create cache directories
sudo /usr/local/squid/sbin/squid -z

Basic Configuration

Squid's main configuration file is typically located at /etc/squid/squid.conf on package installations or /usr/local/squid/etc/squid.conf when built from source. The configuration file uses a straightforward directive-based syntax. Let us build a configuration from scratch.

Minimal Working Configuration

# /etc/squid/squid.conf

# Define the port Squid listens on
http_port 3128

# Define ACL for local network
acl localnet src 192.168.1.0/24
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12

# Define ACL for safe ports
acl Safe_ports port 80          # HTTP
acl Safe_ports port 21          # FTP
acl Safe_ports port 443         # HTTPS
acl Safe_ports port 70          # Gopher
acl Safe_ports port 210         # WAIS
acl Safe_ports port 1025-65535  # Unregistered ports
acl Safe_ports port 280         # HTTP-mgmt
acl Safe_ports port 488         # GSS-HTTP
acl Safe_ports port 591         # FileMaker
acl Safe_ports port 777         # Multiling HTTP

# Define ACL for SSL ports
acl SSL_ports port 443

# Define ACL for CONNECT method
acl CONNECT method CONNECT

# Deny requests to unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to non-SSL ports
http_access deny CONNECT !SSL_ports

# Allow access from local networks
http_access allow localnet
http_access allow localhost

# Deny all other access
http_access deny all

# Configure cache directory
cache_dir ufs /var/spool/squid 1000 16 256

# Configure cache log
cache_log /var/log/squid/cache.log

# Configure access log
access_log /var/log/squid/access.log squid

# Configure visible hostname
visible_hostname myproxy.local

# Configure cache memory
cache_mem 256 MB

# Configure maximum object size in memory
maximum_object_size_in_memory 512 KB

# Refresh pattern for common content types
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

Understanding the Configuration Directives

Each directive in the configuration file serves a specific purpose. The http_port directive specifies the port Squid listens on for client connections. The acl directives define access control lists that match traffic based on source address, destination port, HTTP method, and other criteria. The http_access directives apply rules to these ACLs in order, with the first matching rule determining whether a request is allowed or denied.

The cache_dir directive configures on-disk caching. The format is cache_dir <type> <directory> <size-in-MB> <first-level-dirs> <second-level-dirs>. The ufs type is the default storage scheme and works well for most deployments.

Testing the Configuration

Before restarting Squid, always validate the configuration file to catch syntax errors.

# Validate configuration
sudo squid -k parse

# If no errors, reconfigure the running instance
sudo squid -k reconfigure

# Or restart the service
sudo systemctl restart squid

Testing the Proxy

# Test with curl
curl -x http://localhost:3128 http://httpbin.org/ip

# Test with wget
http_proxy=http://localhost:3128 wget http://httpbin.org/ip

# Test HTTPS
curl -x http://localhost:3128 https://httpbin.org/ip

Authentication Configuration

By default, Squid allows access based on network address. In many environments, you need to authenticate users before they can use the proxy. Squid supports multiple authentication schemes, including Basic, Digest, and NTLM.

Basic Authentication with htpasswd

The simplest authentication method uses HTTP Basic authentication with a password file created by Apache's htpasswd utility.

# Install apache2-utils for htpasswd
sudo apt install apache2-utils -y

# Create password file and add a user
sudo htpasswd -c /etc/squid/passwords user1

# Add additional users
sudo htpasswd /etc/squid/passwords user2

# Verify the file
cat /etc/squid/passwords

Now add the authentication configuration to your squid.conf file.

# Add to squid.conf

# Configure authentication program
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic children 5
auth_param basic realm Squid Proxy Authentication
auth_param basic credentialsttl 2 hours

# Define ACL for authenticated users
acl authenticated proxy_auth REQUIRED

# Require authentication before allowing access
http_access allow localnet authenticated
http_access allow localhost authenticated
http_access deny all

After updating the configuration, validate and reconfigure Squid.

sudo squid -k parse
sudo squid -k reconfigure

Test the authentication by making a request with credentials.

# Test with authentication
curl -x http://user1:password@localhost:3128 http://httpbin.org/ip

# Test without authentication (should fail)
curl -x http://localhost:3128 http://httpbin.org/ip

LDAP Authentication

For enterprise environments, LDAP authentication integrates Squid with directory services like Active Directory or OpenLDAP.

# Add to squid.conf for LDAP authentication

auth_param basic program /usr/lib/squid/basic_ldap_auth \
  -b "dc=example,dc=com" \
  -D "cn=admin,dc=example,dc=com" \
  -w "admin_password" \
  -f "uid=%s" \
  ldap.example.com

auth_param basic children 10
auth_param basic realm Corporate Proxy Server
auth_param basic credentialsttl 1 hour

acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

Access Control Lists (ACLs)

ACLs are the heart of Squid's access control system. They allow you to define rules based on a wide variety of criteria and apply them in a flexible, ordered manner.

Common ACL Types

Blocking Specific Websites

# Create a file with blocked domains
sudo tee /etc/squid/blocked_domains.txt << 'EOF'
facebook.com
twitter.com
youtube.com
instagram.com
EOF

# Add ACLs to squid.conf
acl blocked_domains dstdomain "/etc/squid/blocked_domains.txt"

# Deny access to blocked domains
http_access deny blocked_domains
http_access allow localnet
http_access deny all

Time-Based Access Control

# Define time-based ACL
# Format: time [day-of-week] [hh:mm-hh:mm]
# Days: S M T W H F A (Sunday through Saturday)

acl business_hours time MTWHF 09:00-17:00
acl lunch_break time MTWHF 12:00-13:00

# Allow social media only during lunch break
acl social_media dstdomain "/etc/squid/social_media.txt"
http_access allow social_media lunch_break
http_access deny social_media business_hours
http_access allow localnet
http_access deny all

Bandwidth Limiting with Delay Pools

Delay pools allow you to throttle bandwidth for specific users or traffic types. This is useful for ensuring fair resource allocation.

# Enable delay pools in squid.conf
delay_pools 1
delay_class 1 2

# Define delay pool parameters
# First parameter: aggregate limit (bytes per second)
# Second parameter: per-user limit (bytes per second)
delay_parameters 1 64000/64000 16000/16000

# Apply delay pool to local network
delay_access 1 allow localnet
delay_access 1 deny all

# Define ACL for large file downloads
acl large_files url_regex -i \.iso$ \.zip$ \.tar$ \.gz$ \.avi$ \.mp4$

# Create a second delay pool for large files
delay_pools 2
delay_class 2 1
delay_parameters 2 8000/8000
delay_access 2 allow large_files
delay_access 2 deny all

Combining Multiple ACLs

Squid evaluates ACLs with logical AND when multiple ACLs are specified on the same line, and logical OR when the same ACL name is defined multiple times.

# Define multiple ACLs
acl managers proxy_auth manager1 manager2 manager3
acl streaming_sites dstdomain "/etc/squid/streaming_sites.txt"
acl work_hours time MTWHF 08:00-18:00

# Allow managers to access streaming sites during work hours
http_access allow managers streaming_sites work_hours

# Deny streaming sites for everyone else during work hours
http_access deny streaming_sites work_hours

# Allow streaming sites outside work hours
http_access allow localnet streaming_sites

# Default rules
http_access allow localnet
http_access deny all

Logging and Monitoring

Squid generates several log files that provide valuable information for monitoring, troubleshooting, and compliance. Understanding these logs is essential for effective proxy management.

Access Log

The access log, typically located at /var/log/squid/access.log, records every request processed by Squid. The default format includes timestamp, elapsed time, client IP, result code, bytes transferred, request method, URL, user identity, hierarchy code, and content type.

# Sample access log entries
1700000000.123  456 192.168.1.50 TCP_MISS/200 1024 GET http://example.com/ - HIER_DIRECT/text/html
1700000001.456  789 192.168.1.51 TCP_MEM_HIT/200 2048 GET http://example.com/image.png - HIER_NONE/image/png
1700000002.789 1234 192.168.1.52 TCP_DENIED/403  512 GET http://blocked.com/ user1 HIER_NONE/-

Custom Log Format

You can customize the access log format to suit your needs, which is particularly useful for integration with log analysis tools.

# Define custom log format
logformat custom_log %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

# Apply custom format
access_log /var/log/squid/access.log custom_log

JSON Log Format

For modern log aggregation systems, JSON format is often preferred.

# Define JSON log format
logformat json_log {"timestamp":"%ts.%03tu","client_ip":"%>a","user":"%un","method":"%rm","url":"%ru","status":"%>Hs","bytes":"%<st","hierarchy":"%Ss:%Sh","content_type":"%mt"}

# Apply JSON format
access_log /var/log/squid/access.log json_log

Cache Log

The cache log at /var/log/squid/cache.log contains debugging and error messages. It is essential for troubleshooting configuration issues and monitoring Squid's internal operations.

# View recent cache log entries
sudo tail -f /var/log/squid/cache.log

# Search for errors
sudo grep -i error /var/log/squid/cache.log

Monitoring Cache Performance

Squid provides a built-in manager interface for monitoring cache statistics.

# Query cache manager
squidclient mgr:info

# Check cache statistics
squidclient mgr:stats

# Monitor store directory stats
squidclient mgr:storedir

# Check current connections
squidclient mgr:client_list

Log Rotation

Log files can grow large over time. Configure log rotation to manage disk space.

# /etc/logrotate.d/squid

/var/log/squid/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    nocreate
    sharedscripts
    postrotate
        squid -k rotate
    endscript
}

Reverse Proxy Configuration

While Squid is commonly used as a forward proxy, it can also function as a reverse proxy (also called an accelerator or web accelerator). In this mode, Squid sits in front of web servers, caching their content and shielding them from direct client access.

Basic Reverse Proxy Setup

# /etc/squid/squid.conf - Reverse proxy configuration

# Listen on port 80 for incoming HTTP requests
http_port 80 accel defaultsite=www.example.com

# Define backend server
cache_peer 192.168.1.100 parent 80 0 no-query originserver name=backend

# Define ACL for the site
acl site_domain dstdomain www.example.com example.com

# Route requests to backend
cache_peer_access backend allow site_domain
cache_peer_access backend deny all

# Allow access to the site
http_access allow site_domain
http_access deny all

# Cache configuration
cache_dir ufs /var/spool/squid 5000 16 256
cache_mem 512 MB

# Refresh patterns for static content
refresh_pattern -i \.(jpg|jpeg|png|gif|ico|css|js)$ 3600 90% 86400
refresh_pattern -i \.(html|htm)$ 60 20% 3600

# Don't cache dynamic content
acl dynamic_content urlpath_regex \.(php|asp|aspx|jsp|cgi)(\?|$)
cache deny dynamic_content

Multiple Backend Servers

# Define multiple backend servers
cache_peer 192.168.1.100 parent 80 0 no-query originserver name=server1
cache_peer 192.168.1.101 parent 80 0 no-query originserver name=server2
cache_peer 192.168.1.102 parent 80 0 no-query originserver name=server3

# Define ACLs for different paths
acl api_path urlpath_regex ^/api/
acl static_path urlpath_regex ^/static/
acl default_path urlpath_regex ^/

# Route API requests to server1
cache_peer_access server1 allow api_path
cache_peer_access server1 deny all

# Route static content to server2
cache_peer_access server2 allow static_path
cache_peer_access server2 deny all

# Route remaining traffic to server3
cache_peer_access server3 allow default_path
cache_peer_access server3 deny all

# Allow access
http_access allow default_path
http_access deny all

HTTPS Reverse Proxy with SSL Bumping

# Configure HTTPS listener with SSL certificate
https_port 443 accel cert=/etc/squid/ssl/proxy.crt key=/etc/squid/ssl/proxy.key defaultsite=www.example.com

# SSL bump configuration
acl bump_step1 at_step SslBump1
acl bump_step2 at_step SslBump2
acl bump_step3 at_step SslBump3

ssl_bump peek bump_step1 all
ssl_bump bump bump_step2 all
ssl_bump splice bump_step3 all

# Generate dynamic SSL certificates
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB
sslcrtd_children 5

SSL/TLS Interception

SSL/TLS interception, also known as SSL bumping, allows Squid to inspect and filter HTTPS traffic. This requires generating a root CA certificate that client devices must trust. Use this feature carefully, as it has privacy implications and may not be legal in all jurisdictions.

Setting Up SSL Interception

# Create directory for SSL certificates
sudo mkdir -p /etc/squid/ssl_cert
cd /etc/squid/ssl_cert

# Generate root CA private key
openssl genrsa -out ca.key 4096

# Generate root CA certificate
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
  -subj "/C=US/ST=State/L=City/O=My Organization/CN=Squid Proxy CA"

# Set proper permissions
chmod 600 ca.key
chmod 644 ca.crt

# Initialize SSL certificate database
sudo /usr/lib/squid/security_file_certgen -c -s /var/lib/ssl_db -M 4MB
sudo chown -R proxy:proxy /var/lib/ssl_db

Configuring SSL Bumping in Squid

# /etc/squid/squid.conf - SSL interception configuration

# Listen on standard proxy port with SSL bumping
http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/ca.crt key=/etc/squid/ssl_cert/ca.key

# SSL certificate generation program
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB
sslcrtd_children 8 startup=1 idle=1

# Define SSL bump steps
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

# Peek at the TLS handshake to get the SNI
ssl_bump peek step1 all

# Bump the connection to inspect content
ssl_bump bump step2 all

# Splice (pass through) for trusted sites
acl trusted_sites dstdomain "/etc/squid/trusted_sites.txt"
ssl_bump splice step3 trusted_sites
ssl_bump bump step3 all

# Standard access rules
acl localnet src 192.168.1.0/24
http_access allow localnet
http_access deny all

Distributing the CA Certificate

Client devices must trust the Squid CA certificate to avoid SSL warnings. The method depends on the operating system.

# Linux (Ubuntu/Debian)
sudo cp /etc/squid/ssl_cert/ca.crt /usr/local/share/ca-certificates/squid-ca.crt
sudo update-ca-certificates

# Linux (CentOS/RHEL)
sudo cp /etc/squid/ssl_cert/ca.crt /etc/pki/ca-trust/source/anchors/squid-ca.crt
sudo update-ca-trust

# macOS
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.crt

Transparent Proxy Setup

A transparent proxy intercepts traffic without requiring client configuration. This is achieved by redirecting traffic at the network level using firewall rules. Transparent proxies are useful for enforcing proxy usage without relying on users to configure their browsers.

Configuring Transparent Proxy on Linux

# /etc/squid/squid.conf - Transparent proxy configuration

# Listen for transparent proxy traffic
http_port 3128 intercept
https_port 3129 intercept ssl-bump cert=/etc/squid/ssl_cert/ca.crt key=/etc/squid/ssl_cert/ca.key

# Standard ACLs
acl localnet src 192.168.1.0/24
http_access allow localnet
http_access deny all

iptables Rules for Traffic Redirection

# Redirect HTTP traffic to Squid
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

# Redirect HTTPS traffic to Squid
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3129

# Save iptables rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Using nftables (Modern Linux)

# /etc/nftables.conf

table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0;
        
        # Redirect HTTP to Squid
        iifname "eth0" tcp dport 80 redirect to 3128
        
        # Redirect HTTPS to Squid
        iifname "eth0" tcp dport 443 redirect to 3129
    }
}

# Apply rules
sudo nft -f /etc/nftables.conf

Performance Tuning

Optimizing Squid performance involves configuring cache parameters, memory usage, file descriptor limits, and system-level settings. Proper tuning can significantly improve cache hit ratios and throughput.

Cache Memory Configuration

# Memory configuration
cache_mem 1024 MB
maximum_object_size_in_memory 2048 KB
memory_replacement_policy heap GDSF

# Cache directory configuration
cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 512 MB
cache_replacement_policy heap LFUDA

# Increase file descriptors (add to squid.conf)
max_filedescriptors 65536

System-Level Tuning

# Increase file descriptor limits
# Add to /etc/security/limits.conf
squid soft nofile 65536
squid hard nofile 65536

# Increase system file descriptor limit
echo "fs.file-max = 131072" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Network tuning
echo "net.core.somaxconn = 4096" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_max_syn_backlog = 4096" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Worker Configuration

For multi-core systems, configuring Squid workers can improve performance by utilizing multiple CPU cores.

# Enable multiple workers
workers 4

# Configure CPU affinity (optional)
cpu_affinity_map process_numbers=1,2,3,4 cores=1,2,3,4

# Per-worker shared memory
if ${process_number} = 1
    cache_dir aufs /var/spool/squid/worker1 5000 16 256
endif
if ${process_number} = 2
    cache_dir aufs /var/spool/squid/worker2 5000 16 256
endif
if ${process_number} = 3
    cache_dir aufs /var/spool/squid/worker3 5000 16 256
endif
if ${process_number} = 4
    cache_dir aufs /var/spool/squid/worker4 5000 16 256
endif

Best Practices

Following established best practices ensures your Squid deployment is secure, performant, and maintainable. Here are key recommendations based on real-world deployments.

Security Best Practices

Configuration Management

# Restrict cache manager access
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl admin_network src 192.168.1.0/24

http_access allow manager localhost
http_access allow manager admin_network
http_access deny manager

# Set a custom cache manager password
cachemgr_passwd strong_password all

Performance Best Practices

Operational Best Practices

# Configure proper DNS resolution
dns_nameservers 8.8.8.8 8.8.4.4
dns_v4_first on

# Set reasonable timeouts
connect_timeout 30 seconds
read_timeout 15 minutes
client_lifetime 1 day
request_timeout 5 minutes

# Configure proper error pages
error_directory /usr/share/squid/errors/English

# Enable collapsed forwarding to reduce origin server load
collapsed_forwarding on

# Configure store digest for cache peer communication
store_digest_enable on

Backup and Recovery

Always maintain backups of your Squid configuration and related files.

# Create a backup script
#!/bin/bash
# /usr/local/bin/backup_squid.sh

BACKUP_DIR="/backup/squid/$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# Backup configuration
cp /etc/squid/squid.conf "$BACKUP_DIR/"
cp /etc/squid/blocked_domains.txt "$BACKUP_DIR/" 2>/dev/null
cp /etc/squid/passwords "$BACKUP_DIR/" 2>/dev/null
cp -r /etc/squid/ssl_cert "$BACKUP_DIR/" 2>/dev/null

# Compress backup
tar czf "${BACKUP_DIR}.tar.gz" "$BACKUP_DIR"
rm -rf "$BACKUP_DIR"

# Keep only last 30 days of backups
find /backup/squid -name "*.tar.gz" -mtime +30 -delete

echo "Backup completed: ${BACKUP_DIR}.tar.gz"

Monitoring with External Tools

For production environments, integrate Squid with monitoring tools like Prometheus, Grafana, or Nagios.

# Install Squid exporter for Prometheus
# Using squid-exporter

# Example Prometheus scrape configuration
# /etc/prometheus/prometheus.yml

scrape_configs:
  - job_name: 'squid'
    static_configs:
      - targets: ['localhost:9301']
    metrics_path: /metrics

# The exporter reads Squid cache manager stats
# and exposes them in Prometheus format

High Availability Setup

For mission-critical deployments, configure multiple Squid instances with cache peering for redundancy and load distribution.

# On squid-server-1 (192.168.1.10)
cache_peer 192.168.1.11 sibling 3128 3130 proxy-only
cache_peer 192.168.1.12 sibling 3128 3130 proxy-only

# On squid-server-2 (192.168.1.11)
cache_peer 192.168.1.10 sibling 3128 3130 proxy-only
cache_peer 192.168.1.12 sibling 3128 3130 proxy-only

# On squid-server-3 (192.168.1.12)
cache_peer 192.168.1.10 sibling 3128 3130 proxy-only
cache_peer 192.168.1.11 sibling 3128 3130 proxy-only

# Enable ICP (Internet Cache Protocol) on all servers
icp_port 3130

Troubleshooting Common Issues

Even with careful configuration, issues can arise. Here are solutions to common problems.

Squid Fails to Start

# Check configuration syntax
sudo squid -k parse

# Check for port conflicts
sudo netstat -tlnp | grep 3128

# Check cache log for errors
sudo tail -50 /var/log/squid/cache.log

# Verify cache directory permissions
sudo chown -R proxy:proxy /var/spool/squid
sudo squid -z

High Memory Usage

# Reduce cache_mem
cache_mem 512 MB

# Reduce maximum_object_size_in_memory
maximum_object_size_in_memory 256 KB

# Check memory usage
squidclient mgr:mem

# Monitor process memory
ps aux | grep squid

Low Cache Hit Ratio

# Check current hit ratio
squidclient mgr:info | grep -i hit

# Review refresh patterns
# Ensure static content has long refresh times
refresh_pattern -i \.(jpg|jpeg|png|gif|ico|css|js)$ 3600 90% 86400

# Check if cache directory is full
squidclient mgr:

🛠 Tools from DevBytes

Inventory Tracker Pro — Excel inventory system, low-stock alerts · $19
AI Dev Kit for Mac — local AI dev environment templates · $9.99
KeyMapper for Mac — custom keyboard shortcut toolkit · $7.99

← Back to all articles