This configuration and setting has been tested and the Squid FreeBSD boxes are running at several colleges in Sydney, Australia. Each Squid FreeBSD box serves about 100+ nodes.

Requirements
Squid needs a lot of memory. More is better but 128 MB of memory is good to start with. Squid also needs fast disk storage. Use SCSI drives if you can, though IDE drives will do the job. Also have a FreeBSD 4.5 box setup and running! You will need to recompile the kernel with additional options and components.

1. Installing Squid
You can install Squid using Ports but you can’t play with configure options, so I’ll cover the steps to install from a tarball.

You can download the Squid source from http://www.squid-cache.org. The lastest version is squid-2.4.STABLE6-src.tar.gz. Run the following commands as root.

# cd /path/to/tarball
# tar zxvf squid-2.4.STABLE6-src.tar.gz
# cd squid-2.4.STABLE6
# ./configure –enable-delay-pools –enable-ipf-transparent ’
–enable-storeio=diskd,ufs –enable-storeio=diskd,ufs ’
–disable-ident-lookups –enable-snmp –enable-removal-policies
# make all
# make install

The explaination of configure script options are below:
–enable-delay-pools – Enable delay pools to limit bandwidth usage.

You need to enable the option in order to use Squid to limit bandwith usage. It will give fair bandwith usage for everybody. In my case, I don’t want one person sucking all of the available bandwidth by downloading a big movie, causing others to suffer.

–enable-ipf-transparent – Enable Transparent Proxy support for systems using IP Filter network address redirection.

With this option, you don’t have to configure the client’s browser proxy setting. Also it is a good way to force the client to use the proxy everytime.

–enable-storeio=diskd,ufs – Enable diskd

Improve disk I/O performance. According to the Squid FAQ, if you enable diskd you can gain a 400% increase of perfomance. However, you would need to recompile the kernel because your operating system must support message queues and shared memory.

–enable-removal-policies – Build support for the list of removal policies.

By default, Squid uses LRU, but there are two better policies: GDSF and LFUDA. See the Squid config for a more detailed explanation.

–disable-ident-lookups – This allows you to remove code that performs Ident (RFC 931) lookups.

Not really important. By the way, if you do transparent proxy, ident lookups won’t work.

–enable-snmp

Optional: enable this and you can monitor Squid with mrtg or rrdtool. How to do this is outside of this article’s scope. Perhaps in my next one.

2. Edit Squid Configuration File /usr/local/squid/etc/squid.conf

# Need for transparent proxy
# You need to –enable-ipf-transparent
http_port 3128
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

# Physical memory / 3
cache_mem 128 MB
# Max out Squid I/O perfomance, 15 GB cache and use Squid special diskd but you need to recompile the kernel
# To use disk you need to –enable-storeio=diskd,ufs
# Reasonable values for Q1 and Q2 are 72 and 64, respectively.
# Q1 value must bigger Q2
cache_dir diskd /usr/local/squid/cache 15360 16 256 Q1=72 Q2=64

# You can use normal ufs instead
#cache_dir ufs /usr/local/squid/cache 15360 16 256

# I dont want to log anything
# The reason is to save some expensive I/O operation.
cache_access_log /dev/null
cache_store_log none
cache_log /dev/null

# Cache replacement policy
# The heap GDSF policy optimizes object-hit rate by keeping smaller popular
# objects in cache, so it has a better chance of getting a hit. It achieves a
# lower byte hit rate than LFUDA, though, since it evicts larger (possibly popular)
# objects.
# The heap LFUDA ( Least Frequently Used with Dynamic Aging ) policy keeps
# popular objects in cache regardless of their size and thus optimizes byte hit
# rate at the expense of hit rate since one large, popular object will prevent
# many smaller, slightly less popular objects from being cached.
# You need to –enable-removal-policies
cache_replacement_policy GDSF

# Standard Access List
# I have two subnets, one for student and another one for admin
# Modify this according to your network
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl outgoing src 192.168.10.2/255.255.255.255
acl student src 192.168.0.0/255.255.255.0
acl admin src 192.168.1.0/255.255.255.0
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager
http_access allow localhost
http_access allow outgoing
http_access allow student
http_access allow admin
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all

icp_access allow localhost
icp_access allow student
icp_access allow admin
icp_access deny all

# Avoid caching cgi scripts
acl QUERY urlpath_regex cgi-bin
no_cache deny QUERY

acl magic_words1 url_regex -i 192.168
acl magic_words2 url_regex -i ftp .exe .mp3 .vqf .tar.gz .gz .rpm .zip .rar .avi .mpeg .mpe .mpg .qt .ram .rm .iso .raw .wav .mov

# Delay Pool
# For delay pool, you need to –enable-delay-pools
delay_pools 2

# I have ADSL 2Mbits line
# 2 mbits == 256 kbytes per second
# 256 KB/s, 5 KB/s
# It means 256 KB/s bandwith for the whole network, but 5 KB/s for each node, which is fair for everybody
delay_class 1 2
delay_parameters 1 256000/256000 5000/256000
delay_access 1 allow magic_words2
delay_access 1 allow student
delay_access 1 allow admin

# -1/-1 means that there are no limits for local traffic.
delay_class 2 2
delay_parameters 2 -1/-1 -1/-1
delay_access 2 allow magic_words1

# Cancel download if file is bigger than 1MB
reply_body_max_size 1024 KB

# snmp stuff
acl snmppublic snmp_community public
snmp_access allow snmppublic localhost
snmp_access deny all

# Change to your domain
# visible_hostname yourdomain.domain.com
# cache_mgr yourname@youremail.com

3. Create cache dir and create swap

# mkdir /usr/local/squid/cache
# chown nobody:nogroup cache
# /usr/local/squid/bin/squid -k parse
# /usr/local/squid/bin/squid -z

4. Configure transparent proxy with ipfilter
4.1 Edit /etc/rc.conf

# add these lines to enable ipfilter
ipfilter_enable="YES"
ipnat_enable="YES"
ipmon_enable="YES"
ipfs_enable="YES"

4.2 Edit /etc/ipnat.rules

# add this line
# I assume rl0 is your internal nic
# Redirect everything else to squid on port 3128
rdr rl0 0/0 port 80 -> 127.0.0.1 port 3128 tcp

5. Reconfigure kernel for squid diskd support
Consult the Freebsd Handbook for recompiling the kernel and add the following lines. Your kernel must have:

options SYSVMSG

You can set the parameters in the kernel as follows. This is just an example. Make sure the values are appropriate for your system:
options MSGMNB=8192 # max # of bytes in a queue
options MSGMNI=40 # number of message queue identifiers
options MSGSEG=512 # number of message segments per queue
options MSGSSZ=64 # size of a message segment
options MSGTQL=2048 # max messages in system

The following is the explanation of the kernel options from the Squid FAQ:

The messages between Squid and diskd are 32 bytes for 32-bit CPUs and 40 bytes for 64-bit CPUs. Thus, MSGSSZ should be 32 or greater. You may want to set it to a larger value, just to be safe.

We’ll have two queues for each cache_dir, one in each direction. So, MSGMNI needs to be at least two times the number of cache_dir’s.

I’ve found that 75 messages per queue is about the limit of decent performance. If each diskd message consists of just one segment (depending on your value of MSGSSZ), then MSGSEG should be greater than 75.

MSGMNB and MSGTQL affect how many messages can be in the queues at one time. Diskd messages shouldn’t be more than 40 bytes, but let’s use 64 bytes to be safe. MSGMNB should be at least 64*75. I recommend rounding up to the nearest power of two, or 8192.

MSGTQL should be at least 75 times the number of cache_dir’s that you’ll have.

Also you can tweak the kernel by commenting out unnecessary lines in the kernel config to gain extra perfomance. Then recompile the kernel.

6. Create start-up script /usr/local/etc/rc.d/squid.sh

#!/bin/sh

echo -n ’ Squid ’

case "$1" in
start)
/usr/local/squid/bin/squid -D
;;
stop)
/usr/local/squid/bin/squid -k shutdown
;;
restart)
/usr/local/squid/bin/squid -k reconfigure
;;
*)
echo "Usage: `basename $0` {start|stop|restart}"
;;
esac

7. All Done!
References

FreeBSD – http://www.freebsd.org/
Squid Web Proxy Cache – http://www.squid-cache.org/
Configuration Manual for Squid 2.4 Stable x – http://squid.visolve.com/
Linux Documentation Project – Bandwidth Limiting HOWTO – http://www.linuxdoc.org
Do-It-Yourself Caching: Squid 2.3 – http://www.bsdtoday.com/2000/February/Tutorials28.html
IP Filter Based Firewalls HOWTO – http://www.obfuscation.org/ipf/ipf-howto.html

Andi Salimun
18 Jul 2002

*.Kalo ingin nge-block dari sebuah alamat domain, lakukan cara sebagai berikut

echo ‘@domain.com’ >> /var/qmail/control/badmailfrom

.:GoodLuck:.

# cd /usr/ports/security/checkpassword
# make all install clean
# echo “OPTIONAL_MANPATH /var/qmail/man” >> /etc/manpath.config
# makewhatis
# echo “127.0.0.1:allow,RELAYCLIENT=\”\”” > /etc/tcp.smtp

# echo “192.168.0.:allow,RELAYCLIENT=\”\”” >> /etc/tcp.smtp
# echo :allow >> /etc/tcp.smtp
# /usr/local/bin/tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp

EDIT dot.cshrc

Find the following line in dot.cshrc:

set mail = (/var/mail/$USER)

and modify the file as follows:

#set mail = (/var/mail/$USER)
setenv MAIL ~/Mailbox
setenv MAILDIR ~/Maildir
setenv MAILTMP ~/Maildir/tmp/tmpfile
alias mail '/var/qmail/bin/maildir2mbox;/var/qmail/bin/qail'
alias pine '/var/qmail/bin/maildir2mbox;/var/qmail/bin/pinq'
alias elm '/var/qmail/bin/maildir2mbox;/var/qmail/bin/elq'

EDIT dot.shrc

Append the following lines to the end of dot.shrc

MAIL=~/Mailbox
MAILDIR=~/Maildir
MAILTMP=~/Maildir/tmp/tmpfile
export MAIL MAILDIR MAILTMP
alias mail='/var/qmail/bin/maildir2mbox;/var/qmail/bin/qail'
alias pine='/var/qmail/bin/maildir2mbox;/var/qmail/bin/pinq'
alias elm='/var/qmail/bin/maildir2mbox;/var/qmail/bin/elq'

EDIT dot.qmail

Create the file dot.qmail and add this line:

./Maildir/

* Maildir

Execute the following command to make the Maildir directory:

# /var/qmail/bin/maildirmake /usr/share/skel/Maildir

* Create Maildir and .qmail

Execute the following commands for each existing user:

# cp -R /usr/share/skel/Maildir ~USERSNAME/
# chown -R USERSNAME ~USERSNAME/Maildir
# cp /usr/share/skel/dot.qmail ~USERSNAME/.qmail
# chown USERSNAME ~USERSNAME/.qmail

# qmail options
qmail_smtp_enable="YES"
qmail_pop_enable="YES"
qmail_enable="YES"

Create /var/qmail/rc:

#!/bin/sh

#
# This script starts and stops the qmail mail functions.
#

# Suck in the configuration variables.
if [ -r /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -r /etc/rc.conf ]; then
. /etc/rc.conf
fi

case "$1" in
start)
case ${qmail_smtp_enable} in
[Yy][Ee][Ss])
# Start the qmail smtp daemon
/usr/local/bin/tcpserver -H -R -c 255 -x /etc/tcp.smtp.cdb \
-u 82 -g 81 0 25 /var/qmail/bin/qmail-smtpd &
echo -n " qmail-smtp"
;;
esac

case ${qmail_pop_enable} in
[Yy][Ee][Ss])
# Start the qmail pop daemon
/usr/local/bin/tcpserver -H -R -c 255 0 110 \
/var/qmail/bin/qmail-popup HOSTNAME.DOMAIN \
/usr/local/bin/checkpassword /var/qmail/bin/qmail-pop3d \
Maildir &
echo -n " qmail-pop"
;;
esac

case ${qmail_enable} in
[Yy][Ee][Ss])
# Start qmail
exec env - PATH="/var/qmail/bin:$PATH" \
qmail-start ./Maildir splogger qmail &
echo -n " qmail"
;;
esac
;;
stop)
# Stop the smtp daemon
smtppid=`ps -axw | grep tcpserver | grep smtp | grep -v grep | awk '{ print $1 }'`
if [ "$smtppid" != "" ]; then
kill $smtppid
echo -n " qmail-smtp"
fi

# Stop the pop daemon
poppid=`ps -axw | grep tcpserver | grep popup | grep -v grep | awk '{ print $1 }'`
if [ "$poppid" != "" ]; then
kill $poppid
echo -n " qmail-pop"
fi

# Stop qmail
qmailpid=`ps -axw | grep qmail-send | grep -v grep | awk '{ print $1 }'`
if [ "$qmailpid" != "" ]; then
kill $qmailpid
echo -n " qmail"
fi
;;
*)
echo "Usage: `basename $0` {start|stop}" >&2
;;
esac

exit 0

chmod 750 /var/qmail/rc
# echo HOSTNAME.DOMAIN > /var/qmail/control/me
# echo HOSTNAME.DOMAIN > /var/qmail/control/rcpthosts
# echo DOMAIN >> /var/qmail/control/rcpthosts
# echo HOSTNAME.DOMAIN > /var/qmail/control/locals
# echo DOMAIN >> /var/qmail/control/locals
# echo HOSTNAME > /var/qmail/control/defaulthost
# echo DOMAIN > /var/qmail/control/defaultdomain
# echo DOMAIN > /var/qmail/control/plusdomain
# echo EMAILADDRESS > /var/qmail/alias/.qmail-root
# killall sendmail
# rm /var/run/sendmail.pid
# /usr/local/etc/rc.d/qmail.sh start
# ps -ax | grep tcpserver
# ps -ax | grep qmail
.:GoodLuck:.

#config FIREWALL
ERROR: version of config(8) does not match kernel!
config version = 500013, version required = 600002

Make sure that /usr/src/usr.sbin/config is in sync
with your /usr/src/sys and install a new config binary
before trying this again.

If running the new config fails check your config
file against the GENERIC or LINT config files for
changes in config syntax, or option/device naming
conventions

Solution ::

# cd /usr/src/usr.sbin/config
# make depend all install clean

silakan rebuild kernel

-dh-
.:GoodLuck:.

Solutions ::
Hi Dimas,

cd /usr/ports/mail/qmail && make config

Pilih OUTGOINGIP *atau* QMTPC (sesuai kebutuhan), di sisi saya, hanya
patch QMAILQUEUE saja.

Regards
Bd

.:GoodLuck:.

#MASTER_SITE_BACKUP?= \
# ftp://ftp.freebsd.org/pub/FreeBSD/ports/distfiles/${DIST_SUBDIR}/
#MASTER_SITE_BACKUP}

#Indonesia (Thx to CBN)
#MASTER_SITE_BACKUP?= \
# ftp://freebsd.cbn.net.id/pub/FreeBSD/ports/distfiles/${DIST_SUBDIR}/
#MASTER_SITE_BACKUP}

#Luar Negeri (Thx to MIT)
#MASTER_SITE_BACKUP?= \
# http://cvsup3.freebsd.org/FreeBSD/ports/distfiles/${DIST_SUBDIR}/
#MASTER_SITE_BACKUP}
.:GoodLuck:.

defaultrouter=”10.252.1.1″
gateway_enable=”YES”
named_enable=”YES”
squid_enable=”YES”
sendmail_enable=”NONE”
sendmail_enable=”NO”
apache22_enable=”YES”
sendmail_submit_enable=”NO”
sendmail_outbound_enable=”NO”
sendmail_msp_queue_enable=”NO”
clear_tmp_enable=”YES”
#if_vlan_load=”YES” –> ada di /boot/loader.conf
saver=”logo”
scrnmap=”NO”

hostname=”firewall.ptpn-11.com”
ifconfig_bge0=”inet 192.168.0.254 netmask 255.255.255.0″
ifconfig_xl0=”inet 10.252.1.3 netmask 255.255.0.0″
#ifconfig_rl0=”inet 192.168.10.111 netmask 255.255.255.0″

keymap=”us.iso”
linux_enable=”YES”
sshd_enable=”YES”
usbd_enable=”NO”

pf_enable=”YES” # Enable PF (load module if required)
pf_rules=”/etc/pf.conf” # rules definition file for pf
pf_flags=”” # additional flags for pfctl startup
pflog_enable=”YES” # start pflogd(8)
pflog_logfile=”/var/log/pflog” # where pflogd should store the logfile
pflog_flags=”” # additional flags for pflogd startup
gateway_enable=”YES” # Enable as LAN gateway

cloned_interfaces=”vlan0 vlan1 vlan2 vlan3 vlan4 vlan5 vlan6″

ifconfig_vlan0=”inet 192.168.10.254 netmask 255.255.255.0 vlan 10 vlandev bge0″
ifconfig_vlan1=”inet 192.168.11.254 netmask 255.255.255.0 vlan 11 vlandev bge0″
ifconfig_vlan2=”inet 192.168.12.254 netmask 255.255.255.0 vlan 12 vlandev bge0″
ifconfig_vlan3=”inet 192.168.13.254 netmask 255.255.255.0 vlan 13 vlandev bge0″
ifconfig_vlan4=”inet 192.168.14.254 netmask 255.255.255.0 vlan 14 vlandev bge0″
ifconfig_vlan5=”inet 192.168.15.254 netmask 255.255.255.0 vlan 15 vlandev bge0″
ifconfig_vlan6=”inet 192.168.16.254 netmask 255.255.255.0 vlan 16 vlandev bge0″

.:GoodLuck:.

#IPFW
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_FORWARD
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT

# options Bandwidth Management
options DUMMYNET
options BRIDGE
options HZ=1000

#IPF “Don’t Use
# options IPFILTER
# options IPFILTER_LOG
# options IPFILTER_DEFAULT_BLOCK
# options RANDOM_IP_ID

# PF Device ENABLE
device pf
device pflog
device pfsync

# ALTQ ENABLED
device bpf # default
options INET # default
options INET6 # default
#options RANDOM_IP_ID
#options PFIL_HOOKS
options ALTQ
options ALTQ_CBQ # Class Bases Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
options ALTQ_NOPCC # Required for SMP build

#—– VLAN ENABLE
device vlan

.:GoodLuck:.