OCEAN ENDEAVOUR
CACHE SERVER SETUP AND MONITORING
The intent of this documentation is to provide details on how the Squid Proxy cache server was prepared.
Cache Server, in summary provides better network performance via faster network traffic and less
bandwidth consumption for your local networks when browsing online.
More details about the software can be found here: Click here for reference.
Preparing host machine
In Ocean Endeavour, we deployed the Cache server on a Virtual Machine on our host machine server OEN-
DC02 ([Link])
Create a new Virtual Machine and load the desired Linux platform, in our case Ubuntu 22.04.
Click here for reference.
Once you have successfully downloaded the ISO file, load it to your VM.
The settings and resources (CPU/RAM) of your virtual machine will depend on your host machine and the
administrator’s preference.
The Linux Ubuntu platform does not require that much resources.
Additional note:
Make sure that your Host server has a Virtual Switch, the virtual switch will allow multiple VLANs to pass
through your VMs. In our case, we wanted all VLAN traffic to pass through our Cache Server.
On your host physical machine, wired to the nearest LAN switch, make sure that the port on your LAN
switch is configured to allow trunk of all your desired VLANs.
And on your virtual machine (in our case cache server), under the Network Adapter settings, make sure
that you select the Virtual Switch that you created.
Also, under the Network Adapter settings, do not select the Enable virtual LAN identification. Because if
you do, the virtual machine will only accept the VLAN that you will declare. If kept unselected/disabled, the
virtual machine will accept all allowed VLAN traffic from the Virtual Switch.
Since we did not select/enable the “Enable virtual LAN identification” and specify any VLAN, the virtual
machine will be receiving IP from your Native VLAN network.
Once this is all set, start your virtual machine.
Note: If you are using a dedicated physical machine for your Cache server, make sure that the connected
LAN switchport is configured to allow all VLAN trunk traffic.
Virtual Machine setup
Once your virtual machine has loaded, just follow the step-by-step procedure. This will include naming
your virtual machine, creating credentials, etc.
We need to check the IP address that our virtual machine has got. To do this, depending on your platform,
you can use the command:
ip a
Here, you will find three essential things, the IP address, the Mac Address, and the interface name (eth0).
You can make a static IP reservation on your DHCP server by placing the virtual machine’s Mac address
and binding it to your desired IP address.
From your router/firewall, allow internet traffic to your Cache Server. We need this because we will need to
install updates and to download and install Squid Proxy and a monitoring package.
Our next step is to install updates on our virtual machine (Ubuntu 22.04)
Depending on your platform, issue the following command:
sudo apt update && sudo apt upgrade
This will install all necessary updates/upgrades on your virtual machine to run efficiently.
Optional:
After the update, you can also enable SSH access to your virtual machine. Every time you want to access
and configure your virtual machine, you need not to remotely access on your host server, but instead, you
can use SSH (putty) from any workstation.
To do this, issue the following commands:
sudo apt install openssh-server
sudo systemctl enable --now ssh
To check if SSH is running, issue the following command:
sudo systemctl status ssh
Once verified, reboot your virtual machine. Use the following command:
sudo reboot
Squid proxy setup
We will now install the Squid Proxy on our virtual machine. To do this, make sure that your virtual machine
has internet access, and issue the following command:
sudo apt install squid
Once done, you can check the status of your Squid server by issuing the following command:
sudo systemctl statu squid
If the status is inactive, you can issue the following command to start your Squid service:
sudo systemctl start squid
Likewise, you can stop your squid service (if necessary) by issuing the following command:
sudo systemctl stop squid
Note: Always make a backup of the configuration file. The configuration file of squid is located under
/etc/squid/[Link]
To do the backup, or make another config file, use the following command:
sudo cp /etc/squid/[Link] /etc/squid/[Link].backup1
Let me break down the line for better understanding.
sudo cp /etc/squid/[Link] /etc/squid/[Link].backup1
The “cp” is for copy, the line highlighted in blue is the location and file that we want to make a copy of, and
the line highlighted in green is the location and with a new filename ([Link].backup1).
You can verify if the backup configuration file was successfully created by going to the target location. Issue
the command to access the location:
cd /etc/squid/
Type “ls” on the line to show list of items inside the location.
We can see that the backup configuration file ([Link].backup1) has been successfully created.
Configuring Squid
We can start to configure your squid through its “.conf” configuration file. The configuration file can be
found under /etc/squid/[Link]
Issue the following command to configure your Squid configuration file:
sudo nano /etc/squid/[Link]
You will find a lot of details here. You can take time and have a good read, but in our case, we will just work
around the important things for the setup.
First, we need to go to the “listening port” of the squid. This is important since we will be using this port
number and declaring it on our router/firewall for all traffic to use this port in communicating with the squid
service.
On the squid configuration file, you can control W (ctrl W) on your keyboard to search for a specific text/line.
This is a highly efficient approach since there are tremendous lines in the configuration file.
Search for the text http_port then press enter, keep on searching until you find the text shown below.
Any line that starts with a hashtag (#) is how they usually call it as “commented”, meaning, it is just for
notes and the system does not read it as a configuration line.
For the system to acknowledge the line “http_port 3128” as a valid configuration, we will remove the
hashtag on the starting line.
Now that this line has been “uncommented”, the system will now see this as a configuration input. This
line states that the listening port for our squid traffic will be using port 3128 (by default). You can change
this port number if deemed necessary.
Next, we will declare in the configuration file our desired local networks to access the squid service. Search
again for the configuration file using (crtl W), with using specific texts, go the section as shown below:
The uncommented lines (no hashtag) are already in the system by default. Add a local network by using the
following command:
acl v90 src [Link]/24
To break down the command:
acl v90 src [Link]/24 ,
acl – default syntax for access list
v90 – naming of your desired network (you can use any)
src – default syntax for declaring source
[Link]/24 – your subnetwork ending with prefix (/24 means subnet mask [Link])
See below sample of my declared local networks:
You can add a “commented” text on the same config line to provide notes.
This will not be counted as a configuration line.
After declaring your desired networks, we would need to have them allowed for http traffic. Search again
through the configuration file by using control W (ctrl W) and go to the section below:
Since this is an access control list, this means that the system will read/acknowledge the commands in
order starting from the upper line.
From the image shown, you can see there the config line “http_access deny all” this command is already
by default in the system. Any config before the “http_access deny all” is accepted by the system to be
allowed. Meaning that the last command that the system knows is to deny all http_access.
In our case, we will declare our configuration before the “http_access deny all”, so the system will allow
our configuration traffic before it denies all other traffic at the end.
Issue the following command to allow your declared network to have http_access to squid service:
http_access allow v90
Break down:
http_access allow v90
http_access – default syntx for declaring http_access
allow – default syntax to allow access
v90 – the name you have provided on your specific network
Once all is done, press control X (ctrl X) to exit the config file, then the system will ask you if you want to
save the changes, please press Y for yes, then the system will ask you if you want to save the changes on
the current configuration file (/etc/squid/[Link]), just press Enter key to confirm.
You will now return on the virtual machine’s command line terminal. This time restart the squid by issuing
the command: sudo systemctl retart squid
After, check the status of your squid service by issuing the command: sudo systemctl status squid
Redirecting proxy through Firewall
Now that we have completed the Cache server (Squid proxy), we need now to redirect all LAN traffic to our
Cache server. To do this, we need to access our Firewall.
Note: Always save your Firewall configuration first before making any changes.
In our case, we are using Sonicwall TZ570.
Navigate to Network> Web Proxy
Under Proxy Forwarding tab, place in the details of your Cache server, IP address of the server and the
listening port. Remember that the default listening port is 3128
If you change the listening port, then place the correct port number on the Proxy Web Server Port.
Enable the Bypass Proxy Servers Upon Proxy Server Failure
The description is very straightforward, enable this so that if your Cache server is inactive then internet
access will still be available for your LAN bypassing the Cache server.
Click Accept to save.
Monitoring Squid Service
Once the Cache server (Squid proxy) and Firewall web proxy redirection is all set, we need now to verify if
traffic is indeed passing through our Cache server.
On your Cache server, open the terminal and issue the following command.
sudo tail -f /var/log/squid/[Link]
Break down:
sudo tail -f /var/log/squid/[Link]
tail – default syntax to output the last line of the file
-f – default syntax to continuously follow the output
/var/log/squid/[Link] – location of the access log file of squid
This command will continuously display the current traffic passing through squid service. There is a lot of
information you can find on this log, importantly is the IP address of the device, URL traffics, and the text
HIT which would mean the squid cached, and 200 means successful transaction.
If you don’t see any of the logs appearing, re-check this documentation for configurations.
If you are troubleshooting your squid service and need to stop it, you can issue the following command:
sudo systemctl stop squid
Stopping your squid proxy service will not affect the web access traffic of the clients in your network
because we have enabled the feature in the Firewall to bypass proxy if the service is not available.
You can start again the squid service by issuing the command:
sudo systemctl start squid
Monitoring proxy cache traffic via NTOPNG
NTOPNG is a network monitoring package that is available in Linux platforms. It enables us to see a
graphical representation of the logs aside from the traffic logs that we see in our terminal.
Click here for reference.
To set up NTOPNG, go to your Cache server’s terminal and issue the following command to install:
sudo apt install ntopng
Once installation is completed, we will now need to configure the NTOPNG configuration file. Access
NTOPNG configuration file by issuing the following command:
sudo nano /etc/[Link]
The line “-i=eth0” is by default “commented” meaning with a hashtag. Remove the hashtag in order for the
system to count it as a valid command.
Take note on the interface name, in our case it is “eth0”, on other platforms it could be different. We will be
needing this detail when we configure the NTOPNG settings.
The line “-w=3000” is the listening port for NTOPNG web gui.
Once done, control X (ctrl X) to exit, then save.
Enable the listening port 3000 of NTOPNG to the Cache server’s firewall by issuing the following command:
sudo ufw allow 3000
Start the NTOPNG service by issuing the following command:
sudo systemctl start ntpong
Check NTOPNG service if running by using the following command:
sudo systemctl status ntpong
Once all is set and running, open a browser and type in the IP address of your Cache server along with the
listening port of NTOPNG.
[Link]:3000
Place in the default credentials, then it will ask for you to change your password. Please take note of the
new credentials in your Master File.
This is how the dashboard of NTOPNG would appear.
And other information that might help you monitor the network.
Modifications
In Ocean Endeavour we have local http web pages that we need to access such as our Firewall web GUI.
By default, squid proxy is blocking all non-secure http destinations.
The “uncommented” line http_access deny !Safe_ports is already in the system by default.
You might get this notification message
You can “comment” or put a hashtag on this line and it will allow all non-secure web access. Depending
on your environment, allowing access to all non-secure webpage access can be beneficial or not.
Or, if you don’t’ want to allow access to all non-secure web pages, you can add the port number of your
GUI right after the IP address:
Ip address:443
It will directly open your web interface as well.
This concludes the guidelines and tutorial of our Cache Server using Squid Proxy and NTOPNG monitoring
tool here in Ocean Endeavour.
The system is at its earliest form, meaning, no other in-depth modification has been made.
It is still under continual monitoring and is ready for future modifications to enhance network performance
and efficiency.
This approach is cost-effectively free and very reliable.
All credentials for this setup are saved in the Cloud drive under IT – Technical Documentation Master File.
Hoping readers will learn something from this documentation. Thank you.
Prepared by:
Arturo Pacardo Jr.
IT Officer
Ocean Endeavour
05-May-2025