[ubuntu] squid transparent proxy cache questions

[RabbieBurns]

im attempting to use squid in transparent proxy mode simply as a cache for a slow internet link. Dont need any filterring / logging / authentication etc.

• 
  
• Do i actually need 2 network interfaces?
  
• Do i need 2 network cards or can I create a virtual sub interface?
  
• Can squid cache youtube? Ive read mixed reports.
  
• Is 20GB enough for a cache for 60 users? Is 512MB RAM enough for the box running ubuntu server?
  

 

Cheers

[dhicks]

Do i actually need 2 network interfaces?

 

If you're not using the Squid proxy for filtering and you're not worried about people being able to bypass the server then no, you can just set the server as a proxy in your browser settings (or set that via group policy for the whole domain).

 

Do i need 2 network cards or can I create a virtual sub interface?

 

I forget, offhand, exactly how to best set u Squid with one network card, but I know there's an easy-to-follow how-to. However, with network cards casting around £10, it'd proably be simple enough just to add a second network card and be done with it.

 

Can squid cache youtube? Ive read mixed reports.

 

I don't see why not, although I might be missing something - YouTube uses FLV files to display video, which are proper files capable of progreessive download, not streamed. Of course they might now have some kind of streaming service, you'd have to check.

 

Is 20GB enough for a cache for 60 users? Is 512MB RAM enough for the box running ubuntu server?

 

Not sure about the disk space - it does seem rather small, can't you just give your machine a larger harddrive? I find Debian, and therefore probably Ubuntu Server, runs okay in 512MB of RAM, although it struggles doing anything much with less than that.

[tom_newton]

No, and No. 1 interface fine.

Yes you can cache youtube, but not out of the box. This is against youtubes T&C.

20GB is far too much. You will spend too much CPU time managing it, and it will be full of stale data. 2-5Gb more sensible.

[CyberNerd]

i

[*]Do i actually need 2 network interfaces?

[*]Do i need 2 network cards or can I create a virtual sub interface?

[*]Can squid cache youtube? Ive read mixed reports.

[*]Is 20GB enough for a cache for 60 users? Is 512MB RAM enough for the box running ubuntu server?

 

Cheers

 

20GB - easily enough!

 

You don't need two interfaces.

We put the Squid cache in a DMZ.

The DMZ is accessible through the internal VLAN's

The Firewall has an exception for quid to access the internet, and for the internal networks to access the cache.

[Geoff]

VLANs would be another option if you wanted to use one network card but needed some sort of separation of traffic flows.

 

Youtube caching would work fine (although I'd like to hear what the issue is with the T&Cs and caching from @tom_newton).

 

20gb is fine, but I've only used such big caches when I needed to cache big files for a while (eg windows update with no local WSUS and slow broadband).

[morganw]

Remember that you cannot transparently proxy HTTPS without doing SSL interception with your own certificate. Everyone could get quite confused if "the internet" breaks everytime they try to login to a site.

[tom_newton]

Remember that you cannot transparently proxy HTTPS without doing SSL interception with your own certificate. Everyone could get quite confused if "the internet" breaks everytime they try to login to a site.

 

Actually you can... if you're willing to sacrifice a bit of accuracy in places...

[RabbieBurns]

this is just for a remote site with a very slow internet connection, with an unmanaged 3com switch, a couple of APs and 30 laptops.

 

I want transparent - not to set any browser settings for proxy. I just want to drop this box in between the switch and the internet to be a simple webcache, and the laptops use this as thier Default GW.

 

Not fussed if 443 isnt cached. Its just really to save bandwidth and speed up browsing.

 

20GB is the size of the entire HDD

 

Thanks for letting me know youtube will work. Had read that due to the dynamic CDN and random strings in the URLs it didnt work.

[RabbieBurns]

Ive just thought of a flaw in my plan. The reason Ive said I wasnt concerned about filtering/logging/authentication is because we have a UTM appliance box that does all this. But this does it based on IP address and usernames, however if this box sees all the web traffic only coming from 1 IP (the squid box) its going to break authentication etc.

 

Is there any way with squid to pass the source IP from the client through the proxy to the UTM appliance?

[tom_newton]

Yes - if the UTM supports it - you can pass the x-forwarded-for IP out of squid - this may or may not fix your authentication, depending on the type. NTLM & Kerberos can sometimes be passed through to an upstream proxy, and captive-portal based auth can work if the xff IP is honoured.

 

Does your UTM not do caching anyway?

[RabbieBurns]

the UTM is at the other end of an IPSec VPN over a slow ADSL. I want to put a local cache at the slow end. It will be NTLM auth as I dont think the FSAE collector works over the VPN.

[tom_newton]

As NTLM is connection based you might get away with it - I think there is a spot of tweaking and prodding you may have to do with squid, but can't remember the details...

[RabbieBurns]

I have got squid up and running in transparent mode on one interface working great. However the problem I had envisaged is as expected.

 

I have set the X-Forwarded-For directive to Truncate, but the UTM (its a Fortinet device) doesnt seem to recognise it. I get the NTLM popup for authentication the first time a client tries to access the internet, but this just associates that user with the IP of the squid box and every subsequent client is logged against this initial user.

 

Am I at a dead end here or is there anything I might be able to do to have a webcache in place without using it as a proxy ?

[zbjsy]

how did you get on with youtube caching? as want to look at doing it here