Ubuntu 24.04でWebプロキシを設定するための完全かつ実用的なガイド

sudo apt update && sudo apt upgrade -y
sudo apt install squid apache2-utils dante-server nginx certbot nftables fail2ban -y

sudo apt install squid -y

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

http_port 3128
# limit logging size
access_log /var/log/squid/access.log squid

# ACLs
acl localhost src 127.0.0.1/32
acl localnet src 10.0.0.0/8    # internal network
acl allowed_ips src 203.0.113.0/24  # example allowed client range

# permissions
http_access allow localhost
http_access allow allowed_ips
http_access deny all

# caching
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 10000 16 256
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern . 0 20% 4320

# DNS
dns_v4_first on

sudo systemctl restart squid
sudo systemctl enable squid

acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
http_access allow SSL_ports

sudo apt install apache2-utils -y
sudo htpasswd -c /etc/squid/passwords username

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

acl blocked_sites dstdomain .youtube.com .facebook.com
http_access deny blocked_sites

cache_mem 512 MB
maximum_object_size 20 MB
cache_dir ufs /var/spool/squid 50000 16 256

sudo nano /etc/logrotate.d/squid
/var/log/squid/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    create 640 proxy proxy
    sharedscripts
    postrotate
        systemctl reload squid >/dev/null 2>&1 || true
    endscript
}

sudo apt install dante-server -y

logoutput: syslog
internal: 0.0.0.0 port = 1080
external: eth0
method: username none
user.privileged: proxy
user.notprivileged: nobody
client pass {
    from: 203.0.113.0/24 to: 0.0.0.0/0
    log: connect disconnect error
}
pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    protocol: tcp udp
    log: connect disconnect error
}

sudo systemctl restart danted
sudo systemctl enable danted

curl --socks5-hostname 127.0.0.1:1080 https://checkip.amazonaws.com

server {
    listen 80;
    server_name proxy.example.com;
    location / {
        proxy_pass http://127.0.0.1:3128;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

sudo certbot --nginx -d proxy.example.com

sudo nft add table inet filter
sudo nft 'add chain inet filter input { type filter hook input priority 0 ; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 3128 accept # squid
sudo nft add rule inet filter input tcp dport 1080 accept # dante
sudo nft add rule inet filter input icmp type echo-request accept

sudo sysctl -w net.core.default_qdisc=fq
sudo sysctl -w net.ipv4.tcp_congestion_control=bbr