How to Configure Squid Forward Proxy, SSL Bumping, and Access Control Lists on Ubuntu Server

In enterprise branch offices, development staging labs, and secure educational institutions, regulating outbound internet traffic, conserving WAN bandwidth, and auditing web usage are fundamental network security requirements. While direct edge firewalls can block IP addresses and TCP ports, they lack application-layer visibility into the URLs and resources being retrieved by client workstations.

To establish granular HTTP and HTTPS traffic control, network administrators deploy Squid on Ubuntu Server. Operating as an enterprise-grade forward caching proxy, Squid inspects client requests, enforces strict Access Control Lists (ACLs), caches static web assets locally to accelerate page loads, and performs SSL/TLS Dynamic Certificate Bumping (SslBump) to inspect encrypted HTTPS traffic without disrupting user workflows.

Architectural Overview: Forward Caching and the SslBump Engine

Squid operates between internal client endpoints and external internet destinations, executing a multi-stage request evaluation pipeline:

Engine Subsystem	Architectural Mechanism	Network Function
Forward Proxy Broker	Client Request Mediation (Port 3128)	Receives HTTP requests from LAN clients, validates client credentials or IP subnets against ACL rules, and fetches remote content.
Object Storage Cache	UFS / AUFS In-Memory & Disk Cache	Stores cacheable HTTP objects in memory buffers and on disk pools, serving repeated downloads (like OS updates or software packages) instantly.
SSL-Bump Peeking	SNI Server Name Indication Extraction	Examines the TLS Client Hello handshake to identify the destination domain name without decrypting payload data.
SSL-Bump Interception	Dynamic Subordinate CA Re-Signing	Terminates the inbound client TLS session and establishes an outbound TLS connection to the server, dynamically generating on-the-fly leaf certificates signed by a private internal CA.

Step 1: Installing Squid on Ubuntu Server

Update system repositories and install Squid alongside OpenSSL utilities:

sudo apt update && sudo apt install -y squid openssl

Verify that the Squid daemon is installed and active:

sudo systemctl status squid --no-pager

Step 2: Generating the Internal Root Certificate Authority (CA)

To inspect HTTPS traffic, Squid must dynamically mint signed SSL certificates for external domains. You must create an internal Root CA and distribute its public certificate to all corporate client machines.

# Create dedicated directory for Squid SSL assets
sudo mkdir -p /etc/squid/ssl
cd /etc/squid/ssl

# Generate private key for the CA
sudo openssl genrsa -out squidCA.key 4096

# Generate self-signed Root CA certificate valid for 10 years
sudo openssl req -new -x509 -days 3650 -key squidCA.key -out squidCA.pem \
  -subj "/C=GB/ST=London/L=London/O=Enterprise Network/OU=Security Operations/CN=Squid Security Proxy CA"

# Secure private key permissions
sudo chmod 400 squidCA.key
sudo chown -R proxy:proxy /etc/squid/ssl

Security Notice: The public certificate file squidCA.pem must be imported into the Trusted Root Certification Authorities store on client workstations (via Windows Active Directory Group Policy, macOS MDM profiles, or Ubuntu’s /usr/local/share/ca-certificates/).

Step 3: Initializing the Dynamic Certificate Cache Database

Squid uses a dedicated helper binary, security_file_certgen, to generate and cache dynamically minted domain certificates:

# Initialise SSL database directory (4MB cache pool)
sudo /usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB

# Assign ownership to the proxy system user
sudo chown -R proxy:proxy /var/spool/squid/ssl_db

Step 4: Configuring /etc/squid/squid.conf

Back up the default configuration file and author a clean, hardened production configuration:

sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.default
sudo nano /etc/squid/squid.conf

Insert the following configuration:

# /etc/squid/squid.conf - Hardened Forward Proxy with SSL-Bump

# -------------------------------------------------------------
# Network Listening Ports
# -------------------------------------------------------------
# Plain HTTP Forward Proxy Port
http_port 3128

# HTTPS Interception Port with SSL-Bump Engine
http_port 3129 ssl-bump cert=/etc/squid/ssl/squidCA.pem key=/etc/squid/ssl/squidCA.key generate-host-certificates=on dynamic_cert_mem_cache_size=4MB

# -------------------------------------------------------------
# SSL-Bump Certificate Generation Helper
# -------------------------------------------------------------
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB
sslcrtd_children 8 startup=2 idle=1

# -------------------------------------------------------------
# Access Control Lists (ACLs)
# -------------------------------------------------------------
# Define allowed internal corporate subnets
acl corporate_lan src 192.168.1.0/24
acl corporate_lan src 10.0.0.0/16
acl localhost src 127.0.0.1/32

# Standard Safe Ports
acl Safe_ports port 80          # http
acl Safe_ports port 443         # https
acl Safe_ports port 21          # ftp
acl Safe_ports port 1025-65535  # unregistered ports
acl SSL_ports port 443          # https

# Deny requests to unknown ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

# Define domain filtering ACLs
acl blocked_domains dstdomain .gambling.example .warez.example .malicious.example
http_access deny blocked_domains

# -------------------------------------------------------------
# SSL-Bump Rules: Selective Peeking and Bumping
# -------------------------------------------------------------
# Bypass banking and health domains from decryption (Privacy Compliance)
acl bypass_ssl_domains dstdomain .chase.com .bankofamerica.com .hsbc.co.uk .nhs.uk

# Peek at SNI to determine hostname
ssl_bump peek all
ssl_bump splice bypass_ssl_domains
ssl_bump bump all

# -------------------------------------------------------------
# HTTP Access Rules
# -------------------------------------------------------------
http_access allow localhost
http_access allow corporate_lan
http_access deny all

# -------------------------------------------------------------
# Caching Storage Configuration
# -------------------------------------------------------------
# Allocate 256MB RAM cache and 5000MB disk storage
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 5000 16 256
maximum_object_size 100 MB

# Anonymise client IP headers for enhanced internal privacy
forwarded_for delete
via off

Step 5: Validating Configuration and Starting the Service

Validate the syntax of your configuration before reloading the daemon:

# Test configuration syntax
sudo squid -k parse

# Initialize cache directories
sudo squid -z

# Restart and enable Squid service
sudo systemctl restart squid
sudo systemctl enable squid

Step 6: Configuring Ubuntu Firewall (UFW)

Open the designated proxy ports for your internal LAN subnet:

sudo ufw allow from 192.168.1.0/24 to any port 3128 proto tcp comment "Squid HTTP Proxy"
sudo ufw allow from 192.168.1.0/24 to any port 3129 proto tcp comment "Squid HTTPS Proxy"
sudo ufw reload

Step 7: Validating Proxy Connectivity and Certificate Delivery

Test the forward proxy from a client machine using curl, explicitly passing the proxy address and the internal Root CA certificate:

curl -x http://192.168.1.10:3129 --cacert squidCA.pem -I https://www.wikipedia.org

Inspect the HTTP response headers:

HTTP/1.1 200 OK
Date: Sat, 24 Oct 2026 05:30:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive

To inspect real-time traffic filtering and cache hits on the Ubuntu server, tail the access log:

sudo tail -f /var/log/squid/access.log

Logs report: TCP_MISS/200 for remote queries, TCP_HIT/200 for cached files, and TCP_DENIED/403 for blocked domains.

Troubleshooting Squid Forward Proxy and SSL-Bump Failures

Consult this diagnostic reference table to debug startup faults and TLS handshake errors:

Issue / Error Symptom	Underlying Root Cause	Remediation Procedure
FATAL: mimeLoad: cannot open '/etc/squid/mime.conf'	Squid missing default MIME directory definitions after clean install.	Verify mime.conf exists under /etc/squid/ or reinstall the package using sudo apt install --reinstall squid-common.
Client browsers trigger SEC_ERROR_UNKNOWN_ISSUER.	The internal Root CA (squidCA.pem) has not been imported into the client operating system or browser trust store.	Distribute squidCA.pem via Active Directory GPO or deploy it into browser trust stores using fleet management tools.
Squid crashes with “sslcrtd_program … cannot open socket”.	Permissions on /var/spool/squid/ssl_db do not belong to the proxy user.	Run: sudo chown -R proxy:proxy /var/spool/squid/ssl_db and verify directory permissions are set to 700.
Mobile apps or desktop banking clients fail with SSL Handshake errors.	Applications utilize strict TLS certificate pinning, rejecting Squid’s dynamic subordinate certificates.	Add the domain to bypass_ssl_domains and use ssl_bump splice so the TLS session passes through untouched.

Configuring Squid forward caching with declarative Access Control Lists and dynamic SSL-Bump interception on Ubuntu Server delivers robust network governance, transparent caching optimization, and comprehensive security inspection across corporate infrastructure.