Squid Web Cache wiki

Squid Web Cache documentation

πŸ”— WCCP2 and NAT on a private internal network

πŸ”— Outline

This network architecture isn’t very pretty because:

πŸ”— Diagram

WCCP diagram

πŸ”— Cisco Router Configuration

Router version: 2651 running 12.4(2)T1 C2600-TELCO-M, 96Mb RAM, 16Mb Flash

! Last configuration change at 16:26:40 UTC Sat Sep 2 2006
! NVRAM config last updated at 16:26:41 UTC Sat Sep 2 2006
version 12.4
service timestamps debug uptime
service timestamps log uptime
service password-encryption
hostname cacheboy-1
logging buffered 8192 debugging
no logging console
enable secret 5 <password>
no network-clock-participate wic 0
ip subnet-zero
ip wccp web-cache
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address
ip dhcp excluded-address
ip dhcp pool localnet
   domain-name home.cacheboy.net
   lease 30
no ip domain lookup
ip name-server
ip name-server
vpdn enable
vpdn-group 1
  protocol pppoe
interface FastEthernet0/0
 ip address
 duplex auto
 speed auto
 pppoe enable
 pppoe-client dial-pool-number 1
interface FastEthernet0/1
 ip address
 ip wccp web-cache redirect in
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
interface FastEthernet0/1.2
 description DMZ
 encapsulation dot1Q 2
 ip address
 no snmp trap link-status
interface Dialer1
 description ADSL
 ip address negotiated
 no ip redirects
 no ip unreachables
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 load-interval 30
 dialer pool 1
 dialer string <username>
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname <username>
 ppp chap password 7 <password>
 ppp chap refuse
 ppp pap sent-username <username> password 7 <password>
no ip http server
ip classless
ip route Dialer1
ip nat translation timeout never
ip nat translation tcp-timeout never
ip nat translation udp-timeout never
ip nat translation finrst-timeout never
ip nat translation syn-timeout never
ip nat translation dns-timeout never
ip nat translation icmp-timeout never
ip nat inside source list 11 interface Dialer1 overload
access-list 3 permit any
access-list 11 permit
access-list 11 permit
access-list 11 permit
access-list 11 permit
access-list 11 permit
access-list 12 permit
access-list 13 permit
dialer-list 1 protocol ip permit
snmp-server community <password> RO
line con 0
 speed 115200
 flowcontrol hardware
line aux 0
 transport input telnet
 stopbits 1
line vty 0 4
 password 7 <password>
ntp clock-period 17207619
ntp server

πŸ”— Squid Configuration

cache_effective_user adrian
# This is the standard port 80 web redirection service
wccp2_service standard 0
# Use the non-NAT'ted external interface to make web requests
# Talk the routers' internal interface for WCCP
# Two ports: is the local network interface where WCCPv2 interception
# will occur; localhost is where cachemgr talks to
http_port transparent vport=80
http_port localhost:3128
icp_port 3130
debug_options ALL,1
visible_hostname cindy.cacheboy.net
acl all src
acl lcl src
acl mgr src localhost
acl manager proto cache_object
http_access allow manager mgr
http_access deny manager
http_access allow lcl
miss_access allow all
http_access deny all
icp_access deny all
cache_mem 8 MB
cache_dir ufs /usr/local/squid/cache 512 16 64

πŸ”— Linux Server Configuration

/root/wccp.sh - run once at startup to enable WCCPv2 packet de-encapsulation and redirect

ifconfig gre0 inet netmask up
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/gre0/rp_filter
iptables -F -t nat
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i gre0 -p tcp -m tcp --dport 80 -j DNAT --to-destination

Kernel Version:

adrian@cindy:~$ uname -a
Linux cindy 2.6.17-1.2174_FC5xenU #1 SMP Tue Aug 8 17:36:31 EDT 2006 i686 GNU/Linux

⚠️ Disclaimer: Any example presented here is provided "as-is" with no support
or guarantee of suitability. If you have any further questions about
these examples please email the squid-users mailing list.

Categories: ConfigExample

Navigation: Site Search, Site Pages, Categories, πŸ”Ό go up