Documentation
VyOS Documentation
VyOS Services
Web Proxy (Squid) in VyOS

Web Proxy (Squid) in VyOS

Webproxy in VyOS is a Squid-based proxy server that provides web content caching, URL filtering, access control, and traffic optimization for corporate networks.

Key features

  • HTTP/HTTPS caching: Speed up access to web resources and reduce external traffic
  • Content filtering: Block access to unwanted sites by category and URL
  • User authentication: LDAP, RADIUS, local authentication
  • Access control: ACLs based on IP addresses, domains, and access times
  • Transparent proxy: Intercept HTTP traffic without configuring clients
  • SSL Bump: HTTPS traffic inspection (requires installing a CA on clients)
  • Bandwidth management: Rate limiting for users and groups
  • Logging and reporting: Detailed access logs for auditing

Basic configuration

Simple proxy with caching

# Enable webproxy
set service webproxy listen-address 192.168.1.1 port 3128

# Caching
set service webproxy cache-size 100
set service webproxy default-port 3128

# Allow access from the local network
set service webproxy listen-address 192.168.1.1

# Apply the configuration
commit
save

Verification:

# Squid status
show service webproxy

# Access logs
show log webproxy access

# Cache statistics
show service webproxy cache-stats

Client configuration (manual):

  • Proxy: 192.168.1.1
  • Port: 3128
  • Protocol: HTTP

Transparent proxy

Automatic interception of HTTP traffic without configuring browsers:

# Enable transparent mode
set service webproxy listen-address 192.168.1.1 port 3128
set service webproxy listen-address 192.168.1.1 transparent

# NAT redirect for HTTP (port 80)
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth1
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 192.168.1.1
set nat destination rule 10 translation port 3128

commit
save

Important: A transparent proxy only works for HTTP (port 80). For HTTPS (443), SSL Bump is required, along with installing the CA certificate on clients.

Basic domain filtering

# Create a list of blocked domains
set service webproxy url-filtering squidguard block-category ads
set service webproxy url-filtering squidguard block-category malware
set service webproxy url-filtering squidguard block-category gambling

# Local blacklist
set service webproxy url-filtering squidguard local-block example.com
set service webproxy url-filtering squidguard local-block badsite.net

# Apply filtering
commit
save

Advanced configuration

User authentication (LDAP)

# LDAP authentication
set service webproxy authentication method ldap
set service webproxy authentication ldap server dc.example.com
set service webproxy authentication ldap base-dn 'dc=example,dc=com'
set service webproxy authentication ldap bind-dn 'cn=proxy-reader,ou=Service Accounts,dc=example,dc=com'
set service webproxy authentication ldap password 'SecurePassword'
set service webproxy authentication ldap filter '(memberOf=cn=Internet Users,ou=Groups,dc=example,dc=com)'
set service webproxy authentication ldap username-attribute sAMAccountName
set service webproxy authentication ldap port 389

# Require authentication
set service webproxy authentication children 5
set service webproxy authentication realm "Corporate Proxy"

# Credential caching
set service webproxy authentication cache-time 60

commit
save

ACL - access control

# Allow unrestricted access for the administrators' network
set service webproxy access-control allow-admin source 192.168.10.0/24

# Allow users to access work-related sites only
set service webproxy access-control allow-users source 192.168.1.0/24
set service webproxy access-control allow-users destination !social-media
set service webproxy access-control allow-users destination !streaming

# Block access to social networks during working hours
set service webproxy access-control block-social source 192.168.1.0/24
set service webproxy access-control block-social destination social-media
set service webproxy access-control block-social time M-F 09:00-18:00

# Deny everything else
set service webproxy access-control deny-all

commit
save

SSL Bump - HTTPS inspection

Warning: SSL Bump requires installing the proxy’s CA certificate on all client devices and may violate privacy policy.

# Generate a CA for SSL Bump
generate pki ca install webproxy-ca cn "Corporate Proxy CA"

# Enable SSL Bump
set service webproxy listen-address 192.168.1.1 port 3129
set service webproxy ssl-bump enable
set service webproxy ssl-bump certificate webproxy-ca

# Exclusions (banks, medical sites)
set service webproxy ssl-bump exclude-domain online.sberbank.ru
set service webproxy ssl-bump exclude-domain www.gosuslugi.ru
set service webproxy ssl-bump exclude-domain *.bank.ru

# NAT redirect for HTTPS
set nat destination rule 20 destination port 443
set nat destination rule 20 inbound-interface eth1
set nat destination rule 20 protocol tcp
set nat destination rule 20 translation address 192.168.1.1
set nat destination rule 20 translation port 3129

commit
save

Exporting the CA certificate:

# Export the CA for installation on clients
show pki ca webproxy-ca pem

Install this certificate into the trusted root CAs on all client devices.

Caching and performance

# Increase the cache size
set service webproxy cache-size 2000
set service webproxy maximum-object-size 4096

# Memory settings
set service webproxy mem-cache-size 256

# Maximum number of clients
set service webproxy maximum-client-connections 100

# Object retention time in the cache
set service webproxy refresh-patterns pattern \.jpg$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.png$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.pdf$ min 1440 percent 80 max 43200

commit
save

SquidGuard - content categorization

# Update the SquidGuard category databases
run update webproxy blacklists

# Block categories
set service webproxy url-filtering squidguard block-category adult
set service webproxy url-filtering squidguard block-category gambling
set service webproxy url-filtering squidguard block-category weapons
set service webproxy url-filtering squidguard block-category warez
set service webproxy url-filtering squidguard block-category drugs
set service webproxy url-filtering squidguard block-category malware

# Allow social networks only for specific groups
set service webproxy url-filtering squidguard rule allow-social source-group managers
set service webproxy url-filtering squidguard rule allow-social allow social-media

# Log blocks
set service webproxy url-filtering squidguard log all

# Block page
set service webproxy url-filtering squidguard redirect-url http://proxy.example.com/blocked.html

commit
save

Configuration examples

1. Corporate proxy with authentication

Goal: Configure a proxy for an office of 200 users with LDAP authentication, caching, and basic filtering.

# Basic proxy configuration
set service webproxy listen-address 192.168.1.1 port 3128
set service webproxy cache-size 1000
set service webproxy mem-cache-size 128
set service webproxy maximum-client-connections 200

# LDAP authentication
set service webproxy authentication method ldap
set service webproxy authentication ldap server dc1.corp.local
set service webproxy authentication ldap base-dn 'dc=corp,dc=local'
set service webproxy authentication ldap bind-dn 'cn=squid-ldap,ou=ServiceAccounts,dc=corp,dc=local'
set service webproxy authentication ldap password 'LdapPassword123'
set service webproxy authentication ldap filter '(memberOf=cn=ProxyUsers,ou=Groups,dc=corp,dc=local)'
set service webproxy authentication ldap username-attribute sAMAccountName
set service webproxy authentication children 10
set service webproxy authentication realm "Corporate Internet Access"

# Content filtering
run update webproxy blacklists
set service webproxy url-filtering squidguard block-category adult
set service webproxy url-filtering squidguard block-category gambling
set service webproxy url-filtering squidguard block-category malware
set service webproxy url-filtering squidguard block-category weapons
set service webproxy url-filtering squidguard log all

# Local exceptions
set service webproxy url-filtering squidguard local-block-domain badsite.com
set service webproxy url-filtering squidguard local-ok-domain corpapp.local

# ACL - administrators without restrictions
set service webproxy access-control admins source 192.168.10.0/24

# Regular users with filtering
set service webproxy access-control users source 192.168.1.0/24

# Performance and caching
set service webproxy refresh-patterns pattern \.jpg$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.png$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.gif$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.css$ min 1440 percent 80 max 10080
set service webproxy refresh-patterns pattern \.js$ min 1440 percent 80 max 10080

commit
save

Client configuration via GPO:

  1. Computer Configuration > Preferences > Control Panel Settings > Internet Settings
  2. Proxy Settings: 192.168.1.1:3128
  3. Bypass proxy for local addresses: Enable

Monitoring:

# Active connections
show service webproxy connections

# Cache statistics
show service webproxy cache-stats

# Recently blocked requests
show log webproxy blocked tail 20

2. Transparent proxy for a school

Goal: Configure a transparent proxy with strict filtering for an educational institution.

# Transparent proxy
set service webproxy listen-address 192.168.100.1 port 3128
set service webproxy listen-address 192.168.100.1 transparent
set service webproxy cache-size 500

# NAT redirect
set nat destination rule 10 description 'Transparent proxy HTTP'
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth1
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 192.168.100.1
set nat destination rule 10 translation port 3128

# Strict filtering for students
run update webproxy blacklists
set service webproxy url-filtering squidguard block-category adult
set service webproxy url-filtering squidguard block-category gambling
set service webproxy url-filtering squidguard block-category games
set service webproxy url-filtering squidguard block-category social-media
set service webproxy url-filtering squidguard block-category streaming
set service webproxy url-filtering squidguard block-category weapons
set service webproxy url-filtering squidguard block-category drugs
set service webproxy url-filtering squidguard block-category violence
set service webproxy url-filtering squidguard block-category warez

# Whitelist of educational resources
set service webproxy url-filtering squidguard local-ok-domain edu.ru
set service webproxy url-filtering squidguard local-ok-domain uchi.ru
set service webproxy url-filtering squidguard local-ok-domain lecta.rosuchebnik.ru
set service webproxy url-filtering squidguard local-ok-domain resh.edu.ru

# Teachers have more freedom
set service webproxy access-control teachers source 192.168.100.0/28
set service webproxy access-control teachers allow-category social-media
set service webproxy access-control teachers allow-category streaming

# Students - strict restrictions
set service webproxy access-control students source 192.168.100.16/28
set service webproxy access-control students source 192.168.100.32/27

# Log all requests
set service webproxy url-filtering squidguard log all
set service webproxy access-log enable

# Block page
set service webproxy url-filtering squidguard redirect-url http://192.168.100.1/blocked.html

commit
save

Creating the block page:

# Create a simple HTML page
sudo tee /var/www/html/blocked.html > /dev/null <<'EOF'
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Access blocked</title>
    <style>
        body { font-family: Arial, sans-serif; text-align: center; padding: 50px; }
        .container { max-width: 600px; margin: 0 auto; }
        h1 { color: #d32f2f; }
    </style>
</head>
<body>
    <div class="container">
        <h1>Access to this resource is blocked</h1>
        <p>The requested site has been blocked by the school administration.</p>
        <p>If you believe this is an error, contact your system administrator.</p>
    </div>
</body>
</html>
EOF

# Configure the web server for the block page
set service https listen-address 192.168.100.1
commit
save

3. Proxy with SSL Bump for a corporate network

Goal: Inspect HTTPS traffic to protect against data leakage and malware.

# Generate a CA for SSL Bump
generate pki ca install ssl-intercept-ca cn "Corp SSL Proxy CA" org "Example Corp" country RU

# Export the CA certificate
show pki ca ssl-intercept-ca pem

# Save the certificate to a file for distribution via GPO
# (copy the output into corp-proxy-ca.crt)

# HTTP proxy (regular)
set service webproxy listen-address 192.168.1.1 port 3128

# HTTPS proxy with SSL Bump
set service webproxy listen-address 192.168.1.1 port 3129
set service webproxy ssl-bump enable
set service webproxy ssl-bump certificate ssl-intercept-ca

# SSL Bump exclusions (banks, government services, healthcare)
set service webproxy ssl-bump exclude-domain online.sberbank.ru
set service webproxy ssl-bump exclude-domain www.vtb.ru
set service webproxy ssl-bump exclude-domain *.alfabank.ru
set service webproxy ssl-bump exclude-domain www.gosuslugi.ru
set service webproxy ssl-bump exclude-domain *.rosminzdrav.ru

# Transparent interception
set nat destination rule 10 description 'Transparent HTTP proxy'
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth1
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 192.168.1.1
set nat destination rule 10 translation port 3128

set nat destination rule 20 description 'Transparent HTTPS proxy (SSL Bump)'
set nat destination rule 20 destination port 443
set nat destination rule 20 inbound-interface eth1
set nat destination rule 20 protocol tcp
set nat destination rule 20 translation address 192.168.1.1
set nat destination rule 20 translation port 3129

# Authentication
set service webproxy authentication method ldap
set service webproxy authentication ldap server dc.corp.local
set service webproxy authentication ldap base-dn 'dc=corp,dc=local'
set service webproxy authentication ldap bind-dn 'cn=proxy-reader,cn=Users,dc=corp,dc=local'
set service webproxy authentication ldap password 'SecurePassword'
set service webproxy authentication ldap filter '(memberOf=cn=Internet Access,cn=Users,dc=corp,dc=local)'
set service webproxy authentication ldap username-attribute sAMAccountName

# Filtering
run update webproxy blacklists
set service webproxy url-filtering squidguard block-category malware
set service webproxy url-filtering squidguard block-category phishing
set service webproxy url-filtering squidguard block-category adult
set service webproxy url-filtering squidguard log all

# DLP - block uploads to file-sharing services
set service webproxy url-filtering squidguard block-category file-sharing
set service webproxy url-filtering squidguard local-block-domain drive.google.com/upload
set service webproxy url-filtering squidguard local-block-domain www.dropbox.com/upload

# Performance
set service webproxy cache-size 2000
set service webproxy mem-cache-size 256
set service webproxy maximum-client-connections 200

commit
save

Deploying the CA certificate via GPO:

  1. Group Policy Management > Create new GPO > Edit
  2. Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities
  3. Import > select corp-proxy-ca.crt
  4. Link the GPO to the OU containing the computers

Verification on the client:

# PowerShell: check the installed CA
Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Subject -like "*Corp SSL Proxy CA*"}

4. Bandwidth limiting by group

Goal: Different speed limits for company departments.

# Basic proxy
set service webproxy listen-address 192.168.1.1 port 3128
set service webproxy cache-size 1000

# Create delay pools for rate limiting
# Pool 1: Sales department (high speed) - 192.168.1.0/26
set service webproxy delay-pools pool 1 class 2
set service webproxy delay-pools pool 1 aggregate 10000/10000
set service webproxy delay-pools pool 1 individual 2000/2000
set service webproxy delay-pools pool 1 network 192.168.1.0/26

# Pool 2: General department (medium speed) - 192.168.1.64/26
set service webproxy delay-pools pool 2 class 2
set service webproxy delay-pools pool 2 aggregate 5000/5000
set service webproxy delay-pools pool 2 individual 1000/1000
set service webproxy delay-pools pool 2 network 192.168.1.64/26

# Pool 3: Production floor (low speed) - 192.168.1.128/26
set service webproxy delay-pools pool 3 class 2
set service webproxy delay-pools pool 3 aggregate 2000/2000
set service webproxy delay-pools pool 3 individual 500/500
set service webproxy delay-pools pool 3 network 192.168.1.128/26

# Exclude video conferencing from the limits
set service webproxy delay-pools exclude-domain zoom.us
set service webproxy delay-pools exclude-domain teams.microsoft.com
set service webproxy delay-pools exclude-domain meet.google.com

commit
save

Speed check:

# View the current delay pool usage
show service webproxy delay-pools

# Logs with speed information
show log webproxy access tail 50 | grep "HIER_DIRECT"

5. Integration with WPAD (Web Proxy Auto-Discovery)

Goal: Automatic proxy configuration for clients via DHCP and DNS.

# 1. Configure DHCP with the WPAD option
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option wpad-url 'http://wpad.corp.local/wpad.dat'

# 2. Configure DNS for wpad.corp.local
set system static-host-mapping host-name wpad.corp.local inet 192.168.1.1

# 3. Create the wpad.dat file (PAC - Proxy Auto-Config)
cat > /var/www/html/wpad.dat <<'EOF'
function FindProxyForURL(url, host) {
    // Local addresses - no proxy
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.corp.local") ||
        isInNet(host, "192.168.0.0", "255.255.0.0") ||
        isInNet(host, "10.0.0.0", "255.0.0.0"))
        return "DIRECT";

    // Everything else through the proxy with a fallback
    return "PROXY 192.168.1.1:3128; PROXY 192.168.1.2:3128; DIRECT";
}
EOF

# 4. Configure the web server to serve wpad.dat
set service https listen-address 192.168.1.1
set service https allow-client address 192.168.1.0/24

commit
save

Verifying WPAD on the client:

# Linux
curl http://wpad.corp.local/wpad.dat

# Windows PowerShell
Invoke-WebRequest -Uri http://wpad.corp.local/wpad.dat

6. High-availability proxy (two servers)

Goal: Two VyOS proxies with configuration synchronization and VRRP.

Router 1 (Master):

# VRRP for high availability
set high-availability vrrp group PROXY vrid 10
set high-availability vrrp group PROXY interface eth1
set high-availability vrrp group PROXY virtual-address 192.168.1.100/24
set high-availability vrrp group PROXY priority 200

# Webproxy on the virtual IP
set service webproxy listen-address 192.168.1.100 port 3128
set service webproxy cache-size 1000
set service webproxy mem-cache-size 128

# LDAP authentication
set service webproxy authentication method ldap
set service webproxy authentication ldap server dc.corp.local
set service webproxy authentication ldap base-dn 'dc=corp,dc=local'
set service webproxy authentication ldap bind-dn 'cn=proxy-reader,cn=Users,dc=corp,dc=local'
set service webproxy authentication ldap password 'SecurePassword'
set service webproxy authentication ldap username-attribute sAMAccountName

# Filtering
run update webproxy blacklists
set service webproxy url-filtering squidguard block-category adult
set service webproxy url-filtering squidguard block-category malware
set service webproxy url-filtering squidguard log all

commit
save

Router 2 (Backup):

# VRRP backup
set high-availability vrrp group PROXY vrid 10
set high-availability vrrp group PROXY interface eth1
set high-availability vrrp group PROXY virtual-address 192.168.1.100/24
set high-availability vrrp group PROXY priority 100

# Identical webproxy configuration (copy from Router 1)
set service webproxy listen-address 192.168.1.100 port 3128
set service webproxy cache-size 1000
set service webproxy mem-cache-size 128

# ... the rest of the configuration is identical to Router 1 ...

commit
save

Configuration synchronization:

# On Router 1 - export the webproxy configuration
show configuration commands | grep webproxy

# Copy and apply on Router 2

Client configuration:

  • Proxy: 192.168.1.100:3128 (VRRP virtual IP)
  • If the Master fails, the Backup automatically becomes active

Failover verification:

# On Router 1 - view the VRRP status
show vrrp

# Simulate a Master failure
set high-availability vrrp group PROXY disable

# On Router 2 the status should switch to MASTER

Monitoring and diagnostics

Operational commands

# Squid status
show service webproxy

# Active connections
show service webproxy connections

# Cache statistics
show service webproxy cache-stats
# Output:
# Hit ratio: 35.2%
# Cached objects: 12453
# Cache size: 856 MB / 1000 MB

# Access logs (latest entries)
show log webproxy access tail 50

# Error logs
show log webproxy error

# Blocked requests (SquidGuard)
show log webproxy blocked tail 20

# Top requested domains
show service webproxy top-domains

# Top users by traffic
show service webproxy top-users

# Delay pool usage
show service webproxy delay-pools

LDAP authentication statistics

# Check the connection to LDAP
test service webproxy authentication ldap

# Authentication logs
show log webproxy authentication

# Number of authenticated users
show service webproxy users

Cache analysis

# Detailed cache statistics
show service webproxy cache-info

# Cached objects by type
show service webproxy cache-objects

# Clear the cache
clear service webproxy cache

Performance monitoring

# Squid process load
show system processes | grep squid

# Memory usage
show system memory

# Network connections to the proxy
show system connections port 3128

# Throughput
show interfaces eth1 statistics

Troubleshooting

1. Proxy does not respond to requests

Symptoms: Clients receive the error “Unable to connect to proxy server”.

Checks:

# Check whether Squid is running
show service webproxy
# The status should be: running

# Check the port
show system connections port 3128 | grep LISTEN

# Check the firewall
show firewall name WAN_LOCAL

# Error logs
show log webproxy error tail 20

Solution:

# Restart webproxy
restart service webproxy

# Check for configuration errors
show configuration service webproxy

# Check reachability from the client
# (on the client)
telnet 192.168.1.1 3128
curl -x http://192.168.1.1:3128 http://example.com

2. LDAP authentication does not work

Symptoms: Users cannot authenticate; they are repeatedly prompted for a password.

Checks:

# Check the connection to LDAP
test service webproxy authentication ldap

# Authentication logs
show log webproxy authentication tail 50

# Check the LDAP settings
show configuration service webproxy authentication ldap

# Check the reachability of the DC
ping dc.corp.local

Solution:

# Check the bind-dn and password
set service webproxy authentication ldap bind-dn 'cn=correct-user,ou=ServiceAccounts,dc=corp,dc=local'
set service webproxy authentication ldap password 'CorrectPassword'

# Check the LDAP filter (it may be too strict)
set service webproxy authentication ldap filter '(objectClass=user)'

# Check the base DN
set service webproxy authentication ldap base-dn 'dc=corp,dc=local'

# Increase the number of authentication processes
set service webproxy authentication children 10

# Restart the service
restart service webproxy

commit
save

Testing LDAP manually:

# On VyOS, install ldap-utils
sudo apt-get update
sudo apt-get install ldap-utils

# Check the LDAP query
ldapsearch -x -H ldap://dc.corp.local -D "cn=proxy-reader,ou=ServiceAccounts,dc=corp,dc=local" -W -b "dc=corp,dc=local" "(sAMAccountName=testuser)"

3. SSL Bump causes certificate errors

Symptoms: Browsers show warnings about an untrusted certificate.

Checks:

# Check whether SSL Bump is enabled
show configuration service webproxy ssl-bump

# View the CA certificate
show pki ca webproxy-ca pem

# Check the exclusions
show configuration service webproxy ssl-bump exclude-domain

Solution:

# 1. Export the CA certificate
show pki ca webproxy-ca pem > /tmp/proxy-ca.crt

# 2. Copy the certificate to clients and install it in the trusted CAs

# Windows (PowerShell with administrator rights):
certutil -addstore -enterprise -f "Root" proxy-ca.crt

# Linux:
sudo cp proxy-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# macOS:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain proxy-ca.crt

# 3. Add sites to the exclusions if SSL Bump interferes
set service webproxy ssl-bump exclude-domain problematic-site.com

commit
save

4. Poor proxy performance

Symptoms: Slow page loading through the proxy.

Checks:

# CPU and memory
show system resources

# Cache statistics (hit ratio should be >30%)
show service webproxy cache-stats

# Number of active connections
show service webproxy connections | wc -l

# DNS latency
show service webproxy dns-stats

Solution:

# 1. Increase the cache size
set service webproxy cache-size 2000
set service webproxy mem-cache-size 256

# 2. Increase the connection limits
set service webproxy maximum-client-connections 500

# 3. Optimize refresh patterns for frequently accessed objects
set service webproxy refresh-patterns pattern \.jpg$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.png$ min 1440 percent 50 max 10080
set service webproxy refresh-patterns pattern \.css$ min 1440 percent 80 max 43200
set service webproxy refresh-patterns pattern \.js$ min 1440 percent 80 max 43200

# 4. Add DNS caching
set service dns forwarding cache-size 10000

# 5. Increase the number of authentication processes
set service webproxy authentication children 20

# 6. Configure logging for critical events only
set service webproxy access-log disable

commit
save

# Restart to apply the memory changes
restart service webproxy

5. Transparent proxy does not intercept traffic

Symptoms: Clients bypass the proxy; websites open without filtering.

Checks:

# Check the NAT redirect
show nat destination

# Check transparent mode
show configuration service webproxy | grep transparent

# Check the firewall (make sure it does not block port 80/443)
show firewall

Solution:

# 1. Make sure transparent is enabled
set service webproxy listen-address 192.168.1.1 transparent

# 2. Check the NAT redirect for HTTP
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth1
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 192.168.1.1
set nat destination rule 10 translation port 3128

# 3. For HTTPS (if SSL Bump is used)
set nat destination rule 20 destination port 443
set nat destination rule 20 inbound-interface eth1
set nat destination rule 20 protocol tcp
set nat destination rule 20 translation address 192.168.1.1
set nat destination rule 20 translation port 3129

# 4. Make sure NAT is applied before the firewall
set firewall group network-group LAN_NETWORKS network 192.168.1.0/24

commit
save

Verification on the client:

# Check that requests go through the proxy
# Linux
curl -v http://example.com
# There should be a Via: squid header

# Windows
nslookup example.com
# The IP should resolve through the VyOS DNS forwarding

6. SquidGuard blocks needed sites

Symptoms: Legitimate work sites are blocked by the content filter.

Checks:

# View the blocked requests
show log webproxy blocked tail 50

# Check the SquidGuard configuration
show configuration service webproxy url-filtering squidguard

Solution:

# 1. Add the domain to the whitelist
set service webproxy url-filtering squidguard local-ok-domain worksite.com
set service webproxy url-filtering squidguard local-ok-url 'worksite.com/app'

# 2. Create a rule for a specific user group
set service webproxy url-filtering squidguard rule allow-managers source-group 192.168.1.0/28
set service webproxy url-filtering squidguard rule allow-managers allow social-media

# 3. Temporarily disable a category for testing
delete service webproxy url-filtering squidguard block-category problematic-category

# 4. Update the category databases (may help with false positives)
run update webproxy blacklists

commit
save

# Restart to apply the SquidGuard changes
restart service webproxy

Integration with other systems

Zabbix - proxy monitoring

# On VyOS, enable SNMP for Zabbix
set service snmp community public authorization ro
set service snmp listen-address 192.168.1.1

commit
save

Zabbix template:

  • Squid Proxy Template (built into Zabbix)
  • Metrics: active connections, cache hit ratio, number of objects

Custom monitoring script:

#!/bin/bash
# /config/scripts/squid-stats.sh
# Get Squid statistics for Zabbix

case "$1" in
    connections)
        squidclient -p 3128 mgr:info | grep "Number of clients accessing cache" | awk '{print $NF}'
        ;;
    hit_ratio)
        squidclient -p 3128 mgr:info | grep "Request Hit Ratios" -A 2 | tail -1 | awk '{print $2}' | tr -d '%'
        ;;
    cache_size)
        squidclient -p 3128 mgr:storedir | grep "Current Size" | awk '{print $3}'
        ;;
esac

Grafana - statistics visualization

Prometheus exporter for Squid:

# On VyOS, install squid_exporter
sudo curl -L https://github.com/boynux/squid-exporter/releases/download/v1.10.4/squid-exporter-linux-amd64 -o /usr/local/bin/squid_exporter
sudo chmod +x /usr/local/bin/squid_exporter

# Create a systemd service
sudo tee /etc/systemd/system/squid-exporter.service > /dev/null <<EOF
[Unit]
Description=Squid Exporter for Prometheus
After=network.target

[Service]
Type=simple
User=nobody
ExecStart=/usr/local/bin/squid_exporter -squid-hostname localhost -squid-port 3128
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable squid-exporter
sudo systemctl start squid-exporter

Prometheus scrape config:

scrape_configs:
  - job_name: 'squid'
    static_configs:
      - targets: ['192.168.1.1:9301']

Grafana Dashboard ID: 12240 (Squid Proxy Metrics)

SIEM integration (Splunk/ELK)

Sending logs to Splunk:

# Configure rsyslog to forward Squid logs
sudo tee -a /etc/rsyslog.d/50-squid.conf > /dev/null <<EOF
module(load="imfile")

input(type="imfile"
      File="/var/log/squid/access.log"
      Tag="squid-access"
      Severity="info"
      Facility="local6")

if $syslogtag == 'squid-access' then {
    action(type="omfwd"
           Target="splunk.corp.local"
           Port="514"
           Protocol="tcp")
}
EOF

sudo systemctl restart rsyslog

ELK Stack - Logstash filter for Squid:

filter {
  if [type] == "squid" {
    grok {
      match => { "message" => "%{NUMBER:timestamp}%{SPACE}%{NUMBER:duration} %{IP:client_ip} %{WORD:squid_result}/%{NUMBER:http_code} %{NUMBER:bytes} %{WORD:http_method} %{NOTSPACE:url} %{NOTSPACE:user} %{WORD:hierarchy_code}/%{IP:server_ip} %{NOTSPACE:content_type}" }
    }
    date {
      match => [ "timestamp", "UNIX" ]
    }
    geoip {
      source => "server_ip"
    }
  }
}

Best practices

  1. CA security with SSL Bump

    • Protect the CA private key with a password
    • Store the CA on separate offline media
    • Limit the use of SSL Bump to critical cases only (DLP, malware inspection)
    • Inform users about the monitoring policy

  2. Cache performance

    • Cache size: 100-200 MB per user
    • Cache memory: 10-20% of the disk cache size
    • Use an SSD for the cache when there are >100 users
    • A hit ratio of >30% is a good indicator

  3. LDAP authentication

    • Use a dedicated service account with minimal privileges
    • Do not use an administrator’s personal account
    • Cache credentials (60-120 seconds)
    • Configure failover to a second DC

  4. Content filtering

    • Update the SquidGuard category databases regularly (weekly)
    • Use a whitelist for critical business applications
    • Create a procedure for requesting a site unblock
    • Log all blocks for auditing

  5. Transparent proxy

    • Inform users about the presence of a proxy
    • Provide an alternative (VPN) for excluded devices
    • Do not use it for critical applications without testing
    • Monitor DNS performance in transparent mode

  6. High Availability

    • Use VRRP for automatic failover
    • Synchronize the configuration between nodes (automation)
    • Do not synchronize the cache (each node is independent)
    • Use a PAC file with multiple proxies

  7. Logging and auditing

    • Retain logs for at least 90 days (depending on requirements)
    • Use centralized logging (syslog, ELK)
    • Regularly analyze top domains and users
    • Set up alerts for anomalous activity

  8. Bandwidth Management

    • Prioritize business applications (CRM, email)
    • Limit streaming and social networks during working hours
    • Exclude video conferencing (Zoom, Teams) from the limits
    • Monitor the effectiveness of delay pools

  9. Updates and maintenance

    • Regularly update VyOS and Squid (security patches)
    • Test updates on the backup node before production
    • Back up the configuration before making changes
    • Schedule maintenance windows for updates

  10. Monitoring and alerting

    • Monitor: CPU, memory, hit ratio, number of connections
    • Set up alerts for proxy unavailability
    • Monitor LDAP authentication (number of failures)
    • Use Grafana to visualize trends

Conclusion

Squid-based webproxy in VyOS provides powerful capabilities for managing web traffic, ensuring security, and optimizing the performance of corporate networks. A properly configured proxy with caching, authentication, content filtering, and high availability significantly improves security, performance, and control over internet usage in an organization.

Reviewed by OpenNix LLC · Last updated on
Monitoring Service in VyOSConfig Sync