squid.conf.pre.local

# squid.conf.pre.local - advanced ipfire web proxy configuration file

http_port 192.168.10.11:3128 tproxy
https_port 192.168.10.11:3129 tproxy ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=40MB cert=/etc/squid/certs/squid.pem key=/etc/squid/certs/squid.key

acl allowrangeurl url_regex -i ^https?\:\/\/garena\.edge\.cdn\.starhub\.com\/.*
acl allowrangeurl url_regex -i ^https?\:\/\/file\.atlantica\.gemscool\.com\/UnitPatch\/NPatch\/.*
acl allowrangeurl url_regex -i ^https?\:\/\/patch\.gemscool\.com\/th\/patch\/.*
acl allowrangeurl url_regex -i ^https?\:\/\/update\.netmarble\.co\.id\/Elsword\/Patch/.*

range_offset_limit none allowrangeurl

request_header_access Range deny !allowrangeurl
reply_header_access Accept-Range deny !allowrangeurl
reply_header_access Content-Range deny !allowrangeurl
reply_header_access Range deny !allowrangeurl

acl ytHack url_regex -i \/pagead\/js\/lidar\.js
acl ytHack url_regex -i google\.com\/js\/bg\/.*\.js
deny_info http://pastebin.com/raw.php?i=ZKczrn1C ytHack
http_access deny ytHack

acl crome url_regex -i ^http:\/\/.*\.pack.google.com\/edgedl\/chrome\/win\/.*
acl crome url_regex -i ^http:\/\/cache.pack.google.com\/edgedl\/.*
acl crome url_regex -i ^http:\/\/www.google.com\/dl\/chrome\/win\/.*
http_access deny crome

strip_query_terms off

# cache swap
cache_swap_high 99
cache_swap_low 98

# fqdn and ipcache
fqdncache_size 4096
ipcache_size 4096

# qos for local cache - match dscp 12
qos_flows local-hit=0x30

# ssl bump
always_direct allow all
ssl_bump allow localhost
ssl_bump server-first all
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/ipfire/ssl_db -M 4MB
sslcrtd_children 50 startup=50

# addition @ PC Mikrotik
acl all-url url_regex -i .*
acl text-html rep_mime_type text/html
acl http302 http_status 302
store_miss deny all-url text-html
send_hit deny all-url text-html
store_miss deny all-url http302
send_hit deny all-url http302

# storeid *test*
acl urlrewrite dstdomain .fbcdn.net .akamaihd.net
acl speedtest url_regex -i speedtest\/.*\.(jpg|txt)\?.*
acl reverbnation url_regex -i reverbnation.*audio_player.*ec_stream_song.*$
acl utmgif url_regex -i utm.gif.*
acl playstoreandroid url_regex -i c.android.clients.google.com.market.GetBinary.GetBinary.*
acl idyoutube url_regex -i youtube.*(ptracking|stream_204|player_204).*(v\=|docid\=|video_id\=).*$
acl videoyoutube url_regex -i (youtube|googlevideo).*videoplayback\?
acl videoyoutube url_regex -i (youtube|googlevideo).*videoplayback\?
acl loop_302 http_status 302
acl getmethod method GET

store_id_program /usr/bin/perl /etc/squid/storeid.pl
store_id_children 50 startup=50
store_id_access deny !getmethod
store_id_access allow urlrewrite
store_id_access allow speedtest
store_id_access allow reverbnation
store_id_access allow utmgif
store_id_access allow playstoreandroid
store_id_access allow idyoutube
store_id_access allow videoyoutube
store_id_access deny all

store_miss deny videoyoutube loop_302
send_hit deny videoyoutube loop_302

refresh_pattern (akamaihd|fbcdn)\.net 14400 99% 518400  ignore-no-store ignore-private ignore-must-revalidate store-stale
refresh_pattern -i squid\.internal 14400 99% 518400  ignore-no-store ignore-private ignore-must-revalidate store-stale
refresh_pattern \.(jpg|png|gif|css|ico)($|\?) 14400 99% 518400  ignore-no-store ignore-private reload-into-ims ignore-must-revalidate store-stale
refresh_pattern . 0 99% 518400  ignore-no-store ignore-private reload-into-ims store-stale