To use the refresh patterns below, download the file and place it in the
same directory as squid.conf and then add a configuration directive in
squid.conf:
# include refresh patterns include /etc/squid3/refresh_patterns.conf
########################################################################### ## Copyright (C) Wizardry and Steamworks 2014 - License: GNU GPLv3 ## ## Please see: http://www.gnu.org/licenses/gpl.html for legal details, ## ## rights of fair usage, the disclaimer and warranty conditions. ## ########################################################################### refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i \.(yuv|tif|tga|gif|bmp|webp|tiff|png|jp(2|e|eg|g)|ico|ilbm|svg)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private reload-into-ims refresh_pattern -i \.(mid|midi|iso|mpg|jar|mpeg|qt|mov|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv|m4a)$ 43200 90% 432000 override-expire ignore-no-cache ignore-no-store ignore-private reload-into-ims refresh_pattern -i \.(deb|rpm|exe|bz2|Z|zip|lha|lzx|tar|txt|tgz|gz|inc|pdf|psd|ai|eps|ps|ram|rar|3ds|bin|cab|dll|7z|ppt|pps|ppsx|pptx|doc)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private reload-into-ims refresh_pattern -i \.index.(html|htm)$ 0 75% 10080 refresh_pattern -i \.(html|htm|css|js)$ 1440 75% 40320 refresh_pattern -i (cgi-bin|php|jsp|cgi|asx|asp|aspx) 0 0% 0 refresh_pattern . 0 50% 10080
The following directives block the via and delete the forwarded for
as well as blocking the header access.
########################################################################### ## Copyright (C) Wizardry and Steamworks 2016 - License: GNU GPLv3 ## ## Please see: http://www.gnu.org/licenses/gpl.html for legal details, ## ## rights of fair usage, the disclaimer and warranty conditions. ## ########################################################################### ## # Rules to anonymize http headers ## ## Request Header Rules # Content-Types that are acceptable for the response (replace this). request_header_access Accept deny all # Character sets that are acceptable (replace this). request_header_access Accept-Charset deny all # List of acceptable encodings (replace this). request_header_access Accept-Encoding deny all # List of acceptable human languages for response (replace this). request_header_access Accept-Language allow all # Acceptable version in time #request_header_access Accept-Datetime allow all request_header_access Authorization allow all #request_header_access Cache-Control allow all request_header_access Connection allow all # Needed for not breaking most websites. request_header_access Cookie allow all request_header_access Content-Length allow all request_header_access Content-MD5 allow all request_header_access Content-Type allow all # The date and time that the message was sent. #request_header_access Date allow all request_header_access Expect allow all # The email address of the user making the request. #request_header_access From allow all request_header_access Host allow all request_header_access If-Match allow all request_header_access If-Modified-Since allow all request_header_access If-None-Match allow all request_header_access If-Range allow all request_header_access If-Unmodified-Since allow all # Limit the number of times the message can be forwarded through proxies or gateways. #request_header_access Max-Forwards allow all # Initiates a request for cross-origin resource sharing. #request_header_access Origin allow all #request_header_access Pragma allow all request_header_access Proxy-Authorization allow all request_header_access Range allow all # Needed in order to not break some sites. request_header_access Referer allow all request_header_access TE allow all # The user agent string of the user agent (replace this). request_header_access User-Agent deny all # Ask the server to upgrade to another protocol. #request_header_access Upgrade allow all # Informs the server of proxies through which the request was sent. request_header_access Via allow all request_header_access Warning allow all # Needed for AJAX requests. request_header_access X-Requested-With allow all # Requests a web application to disable their tracking of a user. # request_header_access DNT allow all # Identifying the originating IP address of a client connecting with a proxy. #request_header_access X-Forwarded-For allow all # Identifying the original host requested by the client. request_header_access X-Forwarded-Host allow all # Identifying the originating protocol of an HTTP request request_header_access X-Forwarded-Proto allow all request_header_access Front-End-Https allow all request_header_access X-Http-Method-Override allow all # Allows easier parsing of the MakeModel/Firmware that is usually found in the User-Agent String of AT&T Devices. #request_header_access X-ATT-DeviceId allow all # Full description and details about the device currently connecting #request_header_access X-Wap-Profile allow all request_header_access Proxy-Connection allow all # Server-side deep packet insertion of a unique ID identifying customers of Verizon Wireless. #request_header_access X-UIDH allow all request_header_access X-Csrf-Token allow all #request_header_access X-Request-ID allow all #request_header_access X-Correlation-ID allow all request_header_access Other deny all request_header_access All deny all ## Response Header Rules reply_header_access Access-Control-Allow-Origin allow all reply_header_access Accept-Patch allow all reply_header_access Accept-Ranges allow all reply_header_access Age allow all reply_header_access Allow allow all reply_header_access Alt-Svc allow all #reply_header_access Cache-Control allow all reply_header_access Connection allow all reply_header_access Content-Disposition allow all reply_header_access Content-Encoding allow all reply_header_access Content-Language allow all reply_header_access Content-Length allow all reply_header_access Content-Location allow all reply_header_access Content-MD5 allow all reply_header_access Content-Range allow all reply_header_access Content-Type allow all # The date and time that the message was sent. #reply_header_access Date allow all reply_header_access ETag allow all reply_header_access Expires allow all reply_header_access Last-Modified allow all reply_header_access Link allow all reply_header_access Location allow all reply_header_access P3P allow all #reply_header_access Pragma allow all reply_header_access Proxy-Authenticate allow all reply_header_access Public-Key-Pins allow all reply_header_access Refresh allow all reply_header_access Retry-After allow all reply_header_access Server allow all reply_header_access Set-Cookie allow all reply_header_access Status allow all # HSTS and cache #reply_header_access Strict-Transport-Security allow all reply_header_access Trailer allow all reply_header_access Transfer-Encoding allow all # Tracking Status Value, value suggested to be sent in response to a DNT(do-not-track). #reply_header_access TSV allow all # Ask the client to upgrade to another protocol. #reply_header_access Upgrade allow all reply_header_access Vary allow all reply_header_access Via allow all reply_header_access Warning allow all reply_header_access WWW-Authenticate allow all reply_header_access X-Frame-Options allow all reply_header_access X-XSS-Protection allow all reply_header_access Content-Security-Policy allow all reply_header_access X-Content-Security-Policy allow all reply_header_access X-WebKit-CSP allow all reply_header_access X-Content-Type-Options allow all reply_header_access X-Powered-By allow all reply_header_access X-UA-Compatible allow all reply_header_access X-Content-Duration allow all #reply_header_access Upgrade-Insecure-Requests allow all #reply_header_access X-Request-ID allow all #reply_header_access X-Correlation-ID allow all reply_header_access Other deny all reply_header_access All deny all # Ignore responses from different nameservers ignore_unknown_nameservers on # Turn off sending squid version information httpd_suppress_version_string on # Remove via and x-forwarded-for via off forwarded_for delete follow_x_forwarded_for deny all # Replace accept encoding request_header_replace Accept */* request_header_replace Accept-Encoding * request_header_replace Accept-Charset utf-8 request_header_replace Accept-Encoding gzip, deflate request_header_replace Accept-Language en-US
To use the settings, store the file in /etc/squid3/privacy.conf and then
include it in the main squid configuration file:
# include privacy settings include /etc/squid3/privacy.conf
Add the following to squid.conf:
# disable all logs access_log /dev/null cache_log /dev/null logfile_rotate 0
Some domains can be fetched directly through squid without sending the
request through the cache hierarchy. This can be achieved by using the
always_direct and, if never_direct is used, the never_direct
clause.
First we define an ACL for domains that we always fetch directly:
# domains always fetched directly acl direct_domains dstdom_regex "/etc/squid3/direct_domains.conf" # allow direct domains to bypass cache hierarchy always_direct allow direct_domains # this is here in case you pass all the traffic through # squid by using the directive: never_direct allow all never_direct deny direct_domains
and then in the direct_domains.conf file we include domain regexes. For
example, the direct_domains.conf file would contain the following:
(^|\.)paypal\..+?$ (^|\.)ebay\..+?$
which will attempt to directly fetch any sub-domain of paypal or ebay instead of passing it through the hierarchy.
Similar to bypassing cache hierarchies, add an ACL in squid.conf:
# domains to not cache acl cache_exceptions dstdom_regex "/etc/squid3/cache_exceptions.conf"
and then use the cache directive:
cache deny cache_exceptions
The cache_exceptions.conf must contain regex domains to match whose
responses will not be cached.
If you have a multi-homed server with a set of IPs, it is possible to route
web-traffic through a certain IP address by using ACLs and the
tcp_outgoing_address configuration key.
Suppose that we have the IP address 193.35.234.82, then we define an ACL
out_uk that processes domains from /etc/squid3/out_uk.conf and then
fetches through 193.35.234.82:
# domains to fetch through a given IP acl out_uk dstdom_regex "/etc/squid3/out_uk.conf" tcp_outgoing_address 193.35.234.82 out_uk
The /etc/squid3/out_uk.conf file should contain domain regexes, for
example, to access paypal through an UK address, the
/etc/squid3/out_uk.conf file would contain:
(^|\.)paypal\..+?$
With AdBlock being the paragon of human greed, it seems like you will have to manage domain blocking on your own. To prevent connections to any domain, create a list called, say, blocked.conf and then reference it in squid.conf before any ACL rules:
# domains to block (spam) acl blocked_domains dstdomain "/etc/squid3/blocked.conf" http_access deny blocked_domains deny_info TCP_RESET blocked_domains
The deny_info directive takes care to simply reset the connection with the blocked domain instead of showing an error message which makes it ideal for getting spam content out of the way.
A good list to start with domains for your blocked.conf is the Wizardry and Steamworks spam database.