| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081 |
- $OpenBSD: README-main,v 1.7 2015/09/10 13:00:10 sthen Exp $
- +-----------------------------------------------------------------------
- | Running ${FULLPKGNAME} on OpenBSD
- +-----------------------------------------------------------------------
- General configuration
- =====================
- The sample configuration in ${SYSCONFDIR}/squid.conf is a simple version
- with only the most essential options. By default, only RAM-based cache is
- used, un-comment the cache_dir line to enable a persistent disk cache
- ("swap"); this is normally kept in ${LOCALSTATEDIR}/cache and must be
- initialized with "squid -z" before starting the daemon. If you need to
- place it elsewhere, create the directory and make sure it is owned and
- writable by user _squid, group _squid.
- Logs are stored in ${LOCALSTATEDIR}/logs; access logs on a busy cache will
- grow rapidly so rotate them as necessary (use "squid -k rotate").
- See ${TRUEPREFIX}/share/examples/squid/squid.conf.documented for a complete
- annotated file, similar to the standard squid.conf in previous versions
- of Squid, however in many cases the defaults will suffice.
- The HTML error pages can be easily themed by editing the style-sheet in
- ${SYSCONFDIR}/errorpage.css.
- System resource limits
- ======================
- The default system resource limits for file-descriptors are insufficient
- for a moderately busy proxy. It may also be necessary to increase the
- memory limits. You can add a service-specific class to /etc/login.conf:
- squid:\
- :datasize=1500M:\
- :openfiles=4096:\
- :tc=daemon:
- When started by rc.d(8) (i.e. via pkg_scripts in rc.conf.local or from
- "${RCDIR}/squid start") the appropriately-named login class is used
- automatically.
- If you are using /etc/login.conf.db (not usually recommended) then be
- sure to rebuild it.
- There is also a kernel limit on the number of open file descriptors,
- sysctl kern.maxfiles. In some circumstances you may also need to raise
- this; if this is required, pay particular attention to testing and
- monitoring your system.
- Interception Proxying with PF
- =============================
- To configure an interception (a.k.a. "transparent") proxy, Squid should
- be configured in ${SYSCONFDIR}/squid.conf to bind to a specific address,
- for example:
- http_port 127.0.0.1:3127 intercept
- On the machine running Squid, add a firewall rule similar to this:
- pass in quick log inet proto tcp to port 80 divert-to 127.0.0.1 port 3127
- If the machine running Squid is already acting as a router/firewall
- for your client machines, there is no other special configuration.
- However if Squid is running on a separate machine, the router must be
- configured to pass HTTP traffic to Squid. You can use a rule like this
- on the router:
- pass in quick from 10.77.3.5
- pass in quick inet proto tcp to port 80 route-to (vr2 10.77.3.5)
- (this example assumes Squid is running on 10.77.3.5 reachable over
- the vr2 interface).
- If the proxy server is running on the same subnet as the clients, the
- return traffic from the proxy will go directly back to them without
- ever hitting the firewall, which means the states will never get updated
- and may fill-up your pflog(4) with blocked attempts. To circumvent this
- the "no state" option needs to be specified for the route-to rule:
- pass in quick inet proto tcp to port 80 route-to (vr2 10.77.3.5) no state
|
