· 9 years ago · Jan 18, 2017, 12:30 AM
1Squid.conf & Store-id.pl sample squid 3.5
2May 12, 2015 — mikrotiksquid
3SQUID CONF
4
5======================================================
6
7acl localnet src 192.168.2.0/24
8
9acl SSL_ports port 443
10acl Safe_ports port 80 # http
11acl Safe_ports port 21 # ftp
12acl Safe_ports port 443 # https
13acl Safe_ports port 70 # gopher
14acl Safe_ports port 210 # wais
15acl Safe_ports port 1025-65535 # unregistered ports
16acl Safe_ports port 280 # http-mgmt
17acl Safe_ports port 488 # gss-http
18acl Safe_ports port 591 # filemaker
19acl Safe_ports port 777 # multiling http
20acl CONNECT method CONNECT
21
22#acl nocache dst "/etc/squid/lanjut.txt"
23
24acl chrome url_regex -i ^http:\/\/.*\.pack.google.com\/edgedl\/chrome\/win\/.*
25acl chrome url_regex -i ^http:\/\/cache.pack.google.com\/edgedl\/.*
26acl chrome url_regex -i ^http:\/\/www.google.com\/dl\/chrome\/win\/.*
27acl chrome url_regex -i ^http:\/\/.*.gvt1.com\/edgedl\/chrome\/win\/.*\/.*
28acl chrome url_regex -i ^https:\/\/dl.google.com\/chrome\/win\/.*\/.*.exe
29
30acl bypast dstdomain .gmail.com
31acl bypast dstdomain \.(mail.yahoo.com|bri.co.id|bankmandiri.co.id|klikbca.com|bni.com)
32
33# STOREID ACCESS LIST
34acl urlrewrite dstdomain .fbcdn.net .akamaihd.net .fbsbx.com
35acl storeid-helper url_regex -i ^https?:\/\/attachment\.fbsbx\.com\/.*\?(id=[0-9]*).*
36acl storeid-helper url_regex -i \.fbsbx\.com\/.*\/(.*\.(unity3d|pak|zip|exe|dll|jpg|png|gif|swf)/)$
37acl storeid-helper url_regex -i ^https?:\/\/.*\.ytimg\.com(.*\.(webp|jpg|gif))
38acl storeid-helper url_regex -i ^https?:\/\/([^\.]*)\.yimg\.com\/(.*)
39acl storeid-helper url_regex -i ^https?:\/\/.*\.gstatic\.com\/images\?q=tbn\:(.*)
40acl storeid-helper url_regex -i ^https?:\/\/.*\.reverbnation\.com\/.*\/(ec_stream_song|download_song_direct|stream_song)\/([0-9]*).*
41acl storeid-helper url_regex -i ^https?:\/\/([a-z0-9.]*)(\.doubleclick\.net|\.quantserve\.com|.exoclick\.com|interclick.\com|\.googlesyndication\.com|\.auditude\.com|.visiblemeasures\.com|yieldmanager|cpxinteractive)(.*)
42acl storeid-helper url_regex -i ^https?:\/\/(.*?)\/(ads)\?(.*?)
43acl storeid-helper url_regex -i ^https?:\/\/.*steampowered\.com\/.*\/([0-9]+\/(.*))
44acl speedtest url_regex -i ^https?:\/\/(.*?)\/speedtest\/.*\.(jpg|txt|png|gif|swf)\?.*
45acl speedtest url_regex -i speedtest\/.*\.(jpg|txt|png|gif|swf)\?.*
46acl reverbnation url_regex -i reverbnation.*audio_player.*ec_stream_song.*$
47acl utmgif url_regex -i utm.gif.*
48acl playstoreandroid url_regex -i c.android.clients.google.com.market.GetBinary.GetBinary.*
49acl youtube url_regex -i youtube.*(ptracking|stream_204|player_204|gen_204).*$
50acl youtube url_regex -i \.c\.(youtube|google)\.com\/(get_video|videoplayback|videoplay).*$
51acl youtube url_regex -i (youtube|google).*\/videoplayback\?.*
52acl loop_302 http_status 302
53acl getmethod method GET
54
55# Recommended minimum Access Permission configuration:
56
57http_access deny chrome
58http_access deny !Safe_ports
59http_access deny CONNECT !SSL_ports
60http_access deny localhost manager
61http_access deny manager
62http_access allow localnet
63http_access allow localhost
64http_access deny all
65
66#SSL BUMP OPTION
67always_direct allow all
68ssl_bump splice bypast
69ssl_bump peek bypast
70#ssl_bump stare all
71ssl_bump server-first all
72sslproxy_cert_error deny all
73sslproxy_flags DONT_VERIFY_PEER
74sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/squid/ssl_db -M 10MB
75sslcrtd_children 8 startup=1 idle=1
76
77#Squid normally listens to port 3128
78https_port 3129 tproxy ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_certs/squid.crt key=/etc/squid/ssl_certs/squid.key
79http_port 3128 tproxy
80http_port 3128
81
82# Uncomment and adjust the following to add a disk cache directory.
83cache_dir ufs /cache-1 12000 28 256
84cache_dir ufs /cache-2 12000 28 256
85cache_dir ufs /cache-3 12000 28 256
86cache_dir ufs /cache-4 12000 28 256
87cache_dir ufs /cache-5 12000 28 256
88cache_dir ufs /cache-6 12000 28 256
89cache_dir ufs /cache-7 12000 28 256
90
91# OBJECT SIZE
92cache_replacement_policy heap LFUDA
93memory_replacement_policy heap GDSF
94cache_mem 8 MB
95minimum_object_size 0 KB
96maximum_object_size 100 MB
97maximum_object_size_in_memory 200 KB
98cache_swap_low 90
99cache_swap_high 95
100
101# Leave coredumps in the first cache dir
102cache_store_log /var/log/squid/store.log
103access_log /var/log/squid/access.log
104cache_log /var/log/squid/cache.log
105#cache_log /etc/log/squid/cache.log
106cache_log /dev/null
107coredump_dir /var/spool/squid
108
109#STORE-ID OPTION
110store_id_program /etc/squid/store-id.pl
111store_id_children 25 startup=15 idle=5 concurrency=10
112store_id_access deny !getmethod
113store_id_access allow urlrewrite
114store_id_access allow storeid-helper
115store_id_access allow speedtest
116store_id_access allow reverbnation
117store_id_access allow utmgif
118store_id_access allow playstoreandroid
119store_id_access allow youtube
120store_id_access deny all
121store_miss deny youtube loop_302
122send_hit deny youtube loop_302
123
124# Add any of your own refresh_pattern entries above these.
125
126refresh_pattern -i ^http.*squid\.internal.* 43200 100% 799000 override-expire override-lastmod ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth
127
128# FILES TYPE
129refresh_pattern -i \.(3gp|7z|ace|asx|bin|deb|cup|dvr-ms|ram|rpm|exe|inc|cab|qt) 10080 100% 43800 override-expire override-lastmod ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate store-stale
130refresh_pattern -i \.(rar|jar|gz|tgz|bz2|iso|m1v|m2(v|p)|mo(d|v)|arj|lha|lzh|zip|tar|pak|cup) 10080 100% 43800 override-expire override-lastmod ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate store-stale
131refresh_pattern -i \.(jp(e?g|e|2)|gif|pn[pg]|bm?|tiff?|ico|swf|dat|ad|txt|dll) 10080 100% 43800 override-expire override-lastmod ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate store-stale
132refresh_pattern -i \.(avi|ac4|mp(e?g|a|e|1|2|3|4)|mk(a|v)|ms(i|u|p)|og(x|v|a|g)|rm|r(a|p)m|snd|vob) 10080 100% 43800 override-expire override-lastmod ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate store-stale
133refresh_pattern -i \.(pp(t?x)|s|t)|pdf|rtf|wax|wm(a|v)|wmx|wpl|cb(r|z|t)|xl(s?x)|do(c?x)|flv|x-flv) 10080 100% 43800 override-expire override-lastmod ignore-reload ignore-no-store ignore-private ignore-auth ignore-must-revalidate store-stale
134refresh_pattern -i .(html|htm|css|js|xml)$ 1440 75% 40320
135refresh_pattern -i .index.(html|htm)$ 0 75% 43800
136
137refresh_pattern ^ftp: 1440 20% 10080
138refresh_pattern ^gopher: 1440 0% 1440
139refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
140refresh_pattern . 0 20% 4320
141
142# QoS MARKING
143qos_flows local-hit=0x30
144tcp_outgoing_tos 0x30 all
145dns_nameservers 192.168.2.1
146ipcache_size 2048
147ipcache_low 98
148ipcache_high 99
149quick_abort_min 0
150quick_abort_max 0
151quick_abort_pct 98
152memory_pools off
153reload_into_ims on
154pipeline_prefetch on
155vary_ignore_expire on
156=====================================================
157
158STORE-ID
159
160#!/usr/bin/perl
161#
162# storeid.pl with debug opt - based on storeurl.pl
163# @ http://www2.fh-lausitz.de/launic/comp/misc/squid/projekt_youtube/
164#
165# mods by cespun and fajar @ ipfire.id
166#
167
168use IO::File;
169$|=1;
170STDOUT->autoflush(1);
171$debug=0; ## recommended:0
172$bypassallrules=0; ## recommended:0
173$sucks=""; ## unused
174$sucks="sucks" if ($debug>=1);
175$timenow="";
176$printtimenow=1; ## print timenow: 0|1
177my $logfile = '/tmp/storeid.log';
178
179open my $logfh, '>>', $logfile
180 or die "Couldn't open $logfile for appending: $!\n" if $debug;
181$logfh->autoflush(1) if $debug;
182
183while (<>) {
184$timenow=time()." " if ($printtimenow);
185print $logfh "$timenow"."in : $_" if ($debug>=1);
186chop;
187my $myURL = $_;
188@X = split(" ",$myURL);
189$a = $X[0]; ## channel id
190$b = $X[1]; ## url
191$c = $X[2]; ## ip address
192$u = $b; ## url
193
194if ($bypassallrules){
195 $out="$u"; ## map 1:1
196
197} elsif ($u=~ m/http.*\.(fbcdn|akamaihd)\.net\/h(profile|photos).*[\d\w].*\/([\w]\d+x\d+\/.*\.[\d\w]{3}).*/) {
198 $out="OK store-id=http://fbcdn.net.squid.internal/" . $2 . "/" . $3 ;
199} elsif ($u=~ m/^http(.*)static(.*)(akamaihd|fbcdn).net\/rsrc.php\/(.*\/.*\/(.*).(js|css|png|gif|jpg))(\?(.*)|$)/) {
200 $out="OK store-id=http://fbcdn.net.squid.internal/static/" . $5 . "." . $6 ;
201} elsif ($u =~ m/^https?:\/\/attachment\.fbsbx\.com\/.*\?(id=[0-9]*).*/) {
202 $out="OK store-id=http://facebook.squid.internal/" . $1;
203} elsif ($u=~ m/^https?\:\/\/.*utm.gif.*/) {
204 $out="OK store-id=http://google-analytics.squid.internal/__utm.gif";
205} elsif ($u=~ m/^http\:\/\/.*\/speedtest\/(.*\.(jpg|txt|png|swf|gif|xml|css)).*/) {
206 $out="OK store-id=http://speedtest.squid.internal/" . $1;
207} elsif ($u=~ m/^https?\:\/\/.*\/(.*\..*(mp4|3gp|flv))\?.*/) {
208 $out="OK store-id=http://video-file.squid.internal/" . $1;
209} elsif ($u=~ m/^https?\:\/\/c2lo\.reverbnation\.com\/audio_player\/ec_stream_song\/(.*)\?.*/) {
210 $out="OK store-id=http://reverbnation.squid.internal/" . $1;
211} elsif ($u=~ m/^https?\:\/\/.*\.c\.android\.clients\.google\.com\/market\/GetBinary\/GetBinary\/(.*\/.*)\?.*/) {
212 $out="OK store-id=http://playstore-android.squid.internal/" . $1;
213
214} elsif ($_ =~ m/^https?:\/\/.*\.ytimg\.com\/(.*\.(webp|jpg|gif))/){
215 $out="OK store-id=http://ytimg.squid.internal/" . $1;
216} elsif ($_ =~ m/^https?:\/\/.*\.gstatic\.com\/images\?q=tbn\:(.*)/){
217 $out="OK store-id=http://gstatic.squid.internal/" . $1;
218} elsif ($_ =~ m/^https?:\/\/.*\.reverbnation\.com\/.*\/(ec_stream_song|download_song_direct|stream_song)\/([0-9]*).*/){
219 $out="OK store-id=http://reverbnation.squid.internal/" . $1;
220} elsif ($_ =~ m/^https?:\/\/([^\.]*)\.yimg\.com\/(.*)/){
221 $out="OK store-id=http://yimg.squid.internal/" . $1;
222} elsif ($_ =~ m/^https?:\/\/(.*?)\/speedtest\/(.*\.(jpg|txt|png|swf|gif|xml|css))\??.*$/){
223 $out="OK store-id=http://speedtest.squid.internal/" . $1;
224} elsif ($_ =~ m/^https?:\/\/([a-z0-9.]*)(\.doubleclick\.net|\.quantserve\.com|.exoclick\.com|interclick.\com|\.googlesyndication\.com|\.auditude\.com|.visiblemeasures\.com|yieldmanager|cpxinteractive)(.*)/){
225 $out="OK store-id=http://ads.squid.internal/" . $1;
226} elsif ($_ =~ m/^https?:\/\/(.*?)\/(ads)\?(.*?)/){
227 $out="OK store-id=http://ads.squid.internal/" . $1;
228
229#} elsif ($_ =~ m/^https?:\/\/.*gemscool\.com\/.*\/([0-9]+\/(.*))/) {
230# $out="OK store-id=http://gemscool.squid.internal/" . $1;
231#} elsif ($_ =~ m/^https?:\/\/.*netmarble\.co\.id\/.*\/(Patch|ModooMarble)\/(.*)/) {
232# $out="OK store-id=http://netmarble.squid.internal/" . $1;
233#} elsif ($_ =~ m/^https?:\/\/.*lytogame\.com\/.*\/([a-zA-Z]+\/(.*))/) {
234# $out="OK store-id=http://lytogame.squid.internal/" . $1;
235
236} elsif ($u=~ m/^https?\:\/\/.*youtube.*ptracking.*/){
237 @video_id = m/[&?]video_id\=([^\&\s]*)/;
238 @cpn = m/[&?]cpn\=([^\&\s]*)/;
239 unless (-e "/tmp/@cpn"){
240 open FILE, ">/tmp/@cpn";
241 print FILE "@video_id";
242 close FILE;
243 }
244 $out="ERR";
245
246} elsif ($u=~ m/^https?\:\/\/.*youtube.*stream_204.*/){
247 @docid = m/[&?]docid\=([^\&\s]*)/;
248 @cpn = m/[&?]cpn\=([^\&\s]*)/;
249 unless (-e "/tmp/@cpn"){
250 open FILE, ">/tmp/@cpn";
251 print FILE "@docid";
252 close FILE;
253 }
254 $out="ERR";
255
256} elsif ($u=~ m/^https?\:\/\/.*youtube.*player_204.*/){
257 @v = m/[&?]v\=([^\&\s]*)/;
258 @cpn = m/[&?]cpn\=([^\&\s]*)/;
259 unless (-e "/tmp/@cpn"){
260 open FILE, ">/tmp/@cpn";
261 print FILE "@v";
262 close FILE;
263 }
264 $out="ERR";
265
266} elsif ($u=~ m/^https?\:\/\/.*(youtube|googlevideo).*videoplayback.*/){
267 @itag = m/[&?](itag\=[0-9]*)/;
268 @range = m/[&?](range\=[^\&\s]*)/;
269 @cpn = m/[&?]cpn\=([^\&\s]*)/;
270 @mime = m/[&?](mime\=[^\&\s]*)/;
271 @id = m/[&?]id\=([^\&\s]*)/;
272
273 if (defined(@cpn[0])){
274 if (-e "/tmp/@cpn"){
275 open FILE, "/tmp/@cpn";
276 @id = <FILE>;
277 close FILE;}
278 }
279 $out="OK store-id=http://video-srv.squid.internal/id=@id@mime@range";
280
281} else {
282 $out="ERR";
283}
284 print $logfh "$timenow"."out: $a $out\n" if ($debug>=1);
285 print "$a $out\n";
286}
287close $logfh if ($debug);