#
# Recommended minimum configuration:
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 443         # https
acl http_port port 80
acl https_port port 443     # https only
acl CONNECT method CONNECT
acl intermediate_fetching transaction_initiator certificate-fetching
# http_access allow intermediate_fetching
#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# This default configuration only allows localhost requests because a more
# permissive Squid installation could introduce new attack vectors into the
# network by proxying external TCP connections to unprotected services.
http_access allow localhost

# The two deny rules below are unnecessary in this default configuration
# because they are followed by a "deny all" rule. However, they may become
# critically important when you start allowing external requests below them.

# Protect web applications running on the same server as Squid. They often
# assume that only local users can access them at "localhost" ports.
http_access deny to_localhost

# Protect cloud servers that provide local users with sensitive info about
# their server via certain well-known link-local (a.k.a. APIPA) addresses.
http_access deny to_linklocal

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
#Whitelist
acl whitelist dstdomain "/etc/squid/whitelist"
acl whitelist dstdomain "/etc/squid/whitelist_transparent"
acl allowed_https_sites dstdomain "/etc/squid/whitelist"
acl allowed_https_sites dstdomain "/etc/squid/whitelist_transparent"
acl allowed_https_sites dstdomain "/etc/squid/whitelist_https"
acl allowed_https_sites dstdomain "/etc/squid/whitelist_transparent_https"
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
proxy_protocol_access allow localnet
proxy_protocol_access deny all
http_access allow whitelist http_port
http_access allow allowed_https_sites https_port
http_access allow http_port
# Handling HTTP requests
http_port 3129 intercept
# Handling HTTPS requests
https_port 3130 intercept tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=[tls-cert-path] tls-key=[tls-key-path] cipher=[cipher-setting] options=[option-setting] tls-dh=[pem-path]
# Start up for squid process
http_port 3131
http_access allow https_port
http_access deny all
# strict setting
host_verify_strict on
# SSL_BUMP
sslcrtd_program [sslcrtd-program-setting]
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3
ssl_bump bump all

# And finally deny all other access to this proxy
http_access deny all

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid-transparent

# logrotate
logfile_rotate 10

# logformat
debug_options ALL,1 33,2 28,9
logformat myformat %tl %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt %ssl::>sni %{Host}>h %ssl::bump_mode
access_log /var/log/squid/access-transparent.log myformat
pid_filename /var/run/squid-transparent.pid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320