# Squid as Reverse Proxy

URL: https://sohaib.com/blog/squid-as-reverse-proxy
Author: Sohaib Khan
Published: Apr 12, 2013
Updated: Sep 8, 2026
Category: Web Servers & DevOps

> Squid Reverse Proxy 1.Installing the squid proxy in the server # yum install squid 2.All the configuration should are done at squid.conf file which is located at /etc/squid/squid.conf Changes : At acl Declaration :…

[![Squid Reverse Proxy](/uploads/generated/inline/squid-as-reverse-proxy-inline-01.svg)](http://52.201.111.196/wp-content/uploads/2013/04/squid-cache_logo.jpg) Squid Reverse Proxy

1.Installing the squid proxy in the server

```bash
# yum install squid

```

2.All the configuration should are done at squid.conf file which is located at /etc/squid/squid.conf

Changes :

At acl Declaration :

This acls are declared to separate the http and https query.

acl port443 port 443

acl port80 port 80

Port 3128 is used for proxy so it is not used in our case so it is disabled

\# Squid normally listens to port 3128

#http\_port 3128

#Squid changed to default port to 80 for http  Reverse Proxy

http\_port 80 accel vhost

#Squid reverse proxy port for https  Reverse Proxy

```plaintext
https_port 443 cert=/etc/squid/ssl/1.crt key=/etc/squid/ssl/1.key vhost

```

We have to provide certificate path and key path when using SSL port at this directive.

##For HTTP Reverse Proxy ##

\# Directive to tell Squid the IP address 192.168.1.23 and other are of server1

cache\_peer 192.168.1.23 parent 80 0 no-query no-digest originserver login=PASS name=server1

#for other Servers

#cache\_peer X.X.X.X parent 80 0 no-query no-digest originserver login=PASS name=server2

#cache\_peer X.X.X.X parent 80 0 no-query no-digest originserver login=PASS name=server3

To specify other caches in a hierarchy, we use the format:

cache\_peer hostname or IP type http-port icp-port

Parent  : type of cache

originserver :  Causes this parent to be contacted as an origin server.Meant to be used in accelerator setups when the peer is a web server.

no-query :  Disable ICP queries to this neighbor.

no-digest: Disable request of cache digests

originserver: Causes this parent to be contacted as an origin server.Meant to be used in accelerator setups when the peer is a web server.

acl sites\_server1 dstdomain www.YOURDOMAIN.com YOURDOMAIN.com

#acl sites\_server2 dstdomain server2.domain.com

#acl sites\_server3 dstdomain server3.domain.com

#Cache Peer Directive to map corresponding sites

cache\_peer\_access server1 allow sites\_server1 port80

#cache\_peer\_access server2 allow sites\_server2 port80

#cache\_peer\_access server3 allow sites\_server3 port80

#Allow  Access to the sites

http\_access allow sites\_server1

#http\_access allow sites\_server2

#http\_access allow sites\_server3

##For HTTPS Reverse Proxy ##

\# Directive to tell Squid the IP address of the servers 209.251.48.72 and other are private ip address hosted inside the network

cache\_peer 192.168.1.23 parent 443 0 no-query no-digest originserver ssl sslflags=DONT\_VERIFY\_PEER  login=PASS name=sslserver1

#for other Servers

#cache\_peer X.X.X.X parent 80 0 no-query no-digest originserver ssl sslflags=DONT\_VERIFY\_PEER  login=PASS name=sslserver2

#cache\_peer X.X.X.X parent 80 0 no-query no-digest originserver ssl sslflags=DONT\_VERIFY\_PEER  login=PASS name=sslserver3

acl sites\_ssl\_server1 dstdomain  www.YOURDOMAIN.com

#acl sites\_ssl\_server2 dstdomain server2.domain.com

#acl sites\_ssl\_server3 dstdomain server3.domain.com

#Cache Peer Directive to map corresponding sites

cache\_peer\_access sslserver1 allow sites\_ssl\_server1 port443

#cache\_peer\_access sslserver2 allow sites\_ssl\_server2  port443

#cache\_peer\_access sslserver3 allow sites\_ssl\_server3   port 443

#Allow  Access to the sites

http\_access allow sites\_ssl\_server1

#http\_access allow sites\_ssl\_server2

#http\_access allow sites\_ssl\_server3

##This last line is compulsion to avoid proxy to be used for other site browsing

http\_access deny all

Command to reload squid :

\# /etc/init.d/squid reload

or simply

\# squid reload

3\. Generating SSL Signing request

Generate a ‘key’ file that tells our server apart from other servers. If we dont  have openssl already installed on our machine, we can install it using

yum install openssl

Then changed to the directory to the place we would like to store certificates . In  our  case, I chose:

mkdir /etc/squid/ssl

cd ssl

openssl genrsa -out 1.key 2048

This will spit out a key for our server to create the CSR which is what we need to send to send to  SSL authority in order to get the required files to finish the setup. Next we generate a CSR (so in the same directory):

openssl req -new -key 1.key -out 1.csr

we have to send the contents of this CSR to SSL authority  received the signed certificate as crt but in our case we have already a key and certificate so it was added to ssl folder and renamed accordingly.

The received crt was renamed to 1.crt and added to /etc/squid/ssl/

4\. Appending ca certificate to main certificate file (1 .crt)

Following command was executed:

ssl.ca was ca certificate received from signing authority

cat ssl.ca >> 1.crt

A self signed certificate can be generated for testing purpose as :

openssl x509 -req -days 3650 -in 1.csr -signkey 1.key -out selfsign.crt