Building a Secure Authenticated Squid Proxy for the Home Lab

G'day mates! Following up on our previous networking deep-dives, it is time to add another layer of control to our infrastructure. Today, we are deploying a Squid proxy server. This is a brilliant way to manage, cache, and secure web traffic for specific devices on your network. We are going to lock it down with basic authentication and strict firewall rules so only your trusted machines can access it. Let's fire up the terminal and get stuck in!

Step 1: Install Dependencies and Lock Down the Firewall

First things first, we need to grab Squid, the Apache utilities for generating our passwords, and UFW (Uncomplicated Firewall) to secure the ports. Run the update and installation commands below.

Bash

sudo apt update

sudo apt install squid ufw apache2-utils

Once installed, we will create our authenticated user. In this example, we are calling the user rasp-zero-proxy. You will be prompted to set a secure password for this account as soon as you run the command.

Bash

sudo htpasswd -c /etc/squid/passwd rasp-zero-proxy

With the user created, we need to ensure the Pi is fortified. We will set UFW to deny all incoming traffic by default, allow outgoing traffic, and explicitly open up SSH (port 22) and the Squid proxy port (3128) for our local subnet, 192.168.3.0/24.

Bash

sudo ufw default deny incoming

sudo ufw default allow outgoing

sudo ufw allow ssh

sudo ufw allow 3128/tcp

sudo ufw allow from 192.168.3.0/24 to any port 22

sudo ufw allow from 192.168.3.0/24 to any port 3128

sudo ufw enable

sudo ufw status

Step 2: Backup the Original Configuration

Before we start hacking away at the Squid configuration file, it is an absolute lifesaver to make a backup. This ensures you can always revert to the factory settings if things go pear-shaped during the setup.

Bash

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original

 Step 3: Configure Authentication and Access Rules

Now it is time to edit the configuration file and tell Squid how to handle our network traffic and authentication requests.

Bash

sudo nano /etc/squid/squid.conf

Scroll right to the top of this file and drop in the following lines. This instructs Squid to use the password file we generated earlier and forces all users to authenticate before they can use the proxy.

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd

auth_param basic realm Squid Proxy Server

acl authenticated_users proxy_auth REQUIRED

Next, we need to define our trusted networks and apply the access rules. Add these lines, making sure 192.168.3.0/24 matches your local DHCP environment, and 100.64.0.0/10 covers your Tailscale mesh.

Ini, TOML

acl my_localnet src 192.168.3.0/24

acl tailnet src 100.64.0.0/10

 http_access allow authenticated_users

http_access allow my_localnet

http_access allow tailnet

Step 4: Restart the Service and Route Traffic

The configuration is sorted, so we just need to restart the Squid daemon and set it to launch automatically whenever the Pi boots up.

Bash

sudo systemctl restart squid

sudo systemctl enable squid

 As a final touch, if you are routing this proxy traffic through another node on your mesh, you can forcefully direct your Tailscale connection to an exit node while maintaining access to your local LAN devices. Just replace <EXIT_NODE_TAILSCALE_IP> with your target machine's IP.

Bash

sudo tailscale up --exit-node=<EXIT_NODE_TAILSCALE_IP> --exit-node-allow-lan-access=true

And there you have it! You now possess a highly secure, authenticated Squid proxy guarding your network traffic.

"If you've got any questions or need a hand wrangling your own setup, don't hesitate to reach out at [email protected] or connect with me via www.yazan.me. I'm always keen to help out!"