系統版本：Cent OS 6.9
1.安裝 squid 並開機啟動
yum -y install squid //yum 方式安裝
chkconfig --level 35 squid on //在3、5級別上自動執行squid服務
2.修改squid 配置檔案並修改為如下配置 vi /etc/squid/squid.conf
# Recommended minimum Access Permission configuration:
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 3128 transparent
# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /mnt/squid 1000000 16 256
cache_mem 300000 MB
maximum_object_size_in_memory 1 MB
maximum_object_size 2 GB
max_filedesc 45000
logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
access_log /var/log/squid/access.log combined
cache_log /var/log/squid/cache.log
hierarchy_stoplist cgi-bin ?
#acl QUERY urlpath_regex cgi-bin ?
acl BIGMEDIA urlpath_regex -i .rmvb$ .avi$ .mpg$ .mkv$ .rm$
#acl WEBMAIL dstdom_regex -i "/usr/local/squid/etc/webmails"
#cache deny WEBMAIL
#cache deny QUERY
cache deny BIGMEDIA
cache allow all
cache_swap_high 95
cache_swap_low 90
cache_mgr 123@123.com
cache_effective_user squid
quick_abort_min -1 KB
range_offset_limit -1
refresh_pattern -i .htm$ 5 20% 1440
refresh_pattern -i .html$ 5 20% 1440
refresh_pattern -i .jpeg$ 60 50% 4320 reload-into-ims
refresh_pattern -i .jpg$ 60 50% 4320 reload-into-ims
refresh_pattern -i .png$ 60 50% 4320 reload-into-ims
refresh_pattern .flv?start 0 0% 0
refresh_pattern .flv?ref 0 0% 0
refresh_pattern .f4v?ref 0 0% 0
refresh_pattern .mp4?ref 0 0% 0
refresh_pattern .flv? 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
refresh_pattern .flv$ 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
refresh_pattern .f4v? 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
refresh_pattern .mp4? 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
refresh_pattern .m4v? 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
refresh_pattern .swf$ 1440 99% 10080 reload-into-ims ignore-reload ignore-no-cache
# Leave coredumps in the first cache dir
coredump_dir /home/squid01
# Add any of your own refresh_pattern entries above these.
#refresh_pattern .(jpg|png|gif|mp3|xml)1440 50% 2880 ignore-reload
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|?) 0 0% 0
refresh_pattern . 0 20% 4320
其他相關命令
檢查命中率 squidclient -h 127.0.0.1 -p 3128 mgr:info
檢視訪問情況 tail -f /var/log/squid/access.log
檢視命中情況 tail -f /var/log/squid/access.log | grep HIT
3.檢查 squid 配置是否正常，如沒問題則啟動服務
squid -z //根據反饋提示修改配置檔案
service squid start
chkconfig squid on
4.編輯iptables 檔案，插入如下配置並重啟
vi /etc/sysconfig/iptables
service iptables restart
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 //重定向ros路由過來的內網80埠的流量到 squid的3128埠 根據實際情況調整來源網段
COMMIT
注意：如果快取使用外部掛載儲存，請關閉 SElinux
setenforce 0 && sed -i `s/SELINUX=enforcing/SELINUX=disabled/g` /etc/selinux/config
RouterOS 上面的配置 根據實際情況修改為IP地址
ip route add dst-address=0.0.0.0/0 gateway=192.168.1.2 routing-mark=squid check-gateway=ping //新增一條預設路由到代理伺服器並新增標籤為squid，用ping的方式檢查閘道器 根據實際情況調整來源網段
ip firewall address-list add address=192.168.1.1 list=noproxy //加入閘道器地址和代理伺服器地址
ip firewall address-list add address=192.168.1.2 list=noproxy
ip firewall mangle add src-address=192.168.1.0/24 dst-address-list=noproxy protocol=tcp dst-port=80 action=mark-routing new-routing-mark=squid //把來源內網段80埠的流量轉發到代理伺服器上面並排除之前加入的閘道器和伺服器IP