Configuring Squid to Accelerate/ACL RPC over HTTP

Warning: Any example presented here is provided "as-is" with no support or guarantee of suitability. If you have any further questions about these examples please email the squid-users mailing list.

Contents

  1. Configuring Squid to Accelerate/ACL RPC over HTTP
    1. Outline
    2. Setup
    3. Configuration
    4. Thanks to

Outline

Squid can be used as an accelerator and ACL filter in front of an exchange server exporting mail via RPC over HTTP. The RPC_IN_DATA and RPC_OUT_DATA methods communicate with https://URL/rpc/rpcproxy.dll, for if there's need to limit the access..

Setup

The example situation involves a single Outlook Web Access server and a single Squid server. The following information is required:

  • The IP of the Squid server (ip_of_squid)
  • The 'public' domain used for RPC Access (rpc_domain_name)
  • The IP of the Exchange (RPC) server (ip_of_exchange_server)
  • SSL Certificate to present to Exchange Server (/path/to/certificate)
  • SSL certificate to present to Clients (/path/to/clientcertificate)

Configuration

/!\

This configuration MUST appear at the top of squid.conf above any other forward-proxy configuration (http_access etc). Otherwise the standard proxy access rules block some people viewing the accelerated site. 

# Publish the RPCoHTTP service via SSL
https_port ip_of_squid:443 accel cert=/path/to/clientcertificate defaultsite=rpc_domain_name

cache_peer ip_of_exchange_server parent 443 0 no-query originserver login=PASS ssl sslcert=/path/to/certificate name=exchangeServer

acl EXCH dstdomain .rpc_domain_name

cache_peer_access exchangeServer allow EXCH
cache_peer_access exchangeServer deny all
never_direct allow EXCH

# Lock down access to just the Exchange Server!
http_access allow EXCH
http_access deny all
miss_access allow EXCH
miss_access deny all

Squid older than 3.1 also need to define several extension methods: 

# Define the required extension methods
extension_methods RPC_IN_DATA RPC_OUT_DATA

Thanks to

Thanks to Tuukka Laurikanien <t.laurikainen@ibermatica.com> for providing the information used in preparing this article.

CategoryConfigExample

ConfigExamples/Reverse/ExchangeRpc (last edited 2011-10-06 11:51:48 by Amos Jeffries)