<div dir="ltr"><div><div><div><div>Hi Team,<br><br></div>I have done some modification as per thread and temporary removed Refresh pattern and have kept the Default refresh pattern ...<br><br></div>This is how my Configuration looks like .....<br><br><br><br># -------------------------------------<br># Access Control Lists<br># -------------------------------------<br>acl localnet src <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> # RFC1918 possible internal network<br><br>acl SSL_ports port 443<br>acl SSL_ports port 8443 # Telecom exclusion<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br><br># Common methods<br>acl CONNECT method CONNECT<br>acl PURGE method PURGE<br>acl GET method GET<br><br># Windows update acls<br>acl windowsupdate dstdomain <a href="http://sls.update.microsoft.com.akadns.net" target="_blank">sls.update.microsoft.com.akadns.net</a><br>acl windowsupdate dstdomain <a href="http://windowsupdate.microsoft.com" target="_blank">windowsupdate.microsoft.com</a><br>acl windowsupdate dstdomain .<a href="http://update.microsoft.com" target="_blank">update.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://download.windowsupdate.com" target="_blank">download.windowsupdate.com</a><br>acl windowsupdate dstdomain <a href="http://redir.metaservices.microsoft.com" target="_blank">redir.metaservices.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://images.metaservices.microsoft.com" target="_blank">images.metaservices.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://c.microsoft.com" target="_blank">c.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://www.download.windowsupdate.com" target="_blank">www.download.windowsupdate.com</a><br>acl windowsupdate dstdomain <a href="http://wustat.windows.com" target="_blank">wustat.windows.com</a><br>acl windowsupdate dstdomain <a href="http://crl.microsoft.com" target="_blank">crl.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://sls.microsoft.com" target="_blank">sls.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://productactivation.one.microsoft.com" target="_blank">productactivation.one.microsoft.com</a><br>acl windowsupdate dstdomain <a href="http://ntservicepack.microsoft.com" target="_blank">ntservicepack.microsoft.com</a><br><br># Windows update methods<br>acl wuCONNECT dstdomain <a href="http://www.update.microsoft.com" target="_blank">www.update.microsoft.com</a><br>acl wuCONNECT dstdomain <a href="http://sls.microsoft.com" target="_blank">sls.microsoft.com</a><br><br><br># SSL bump acl<br>acl net_bump src "/etc/squid/net.bump"<br><br># TLD acl<br>acl block_tld url_regex "/etc/squid/dstdom.tld"<br><br># -------------------------------------<br># Access parameters<br># -------------------------------------<br># Deny requests to unsafe ports<br>http_access deny !Safe_ports<br># Deny CONNECT to other than SSL ports<br>http_access deny CONNECT !SSL_ports<br><br># Only allow cachemgr access from localhost<br>http_access allow localhost manager<br>http_access deny manager<br>http_access deny to_localhost<br># Allow purge from localhost<br>http_access allow PURGE localhost<br>http_access deny PURGE<br><br><br># Block top level domains<br>http_access deny block_tld<br>deny_info TCP_RESET block_tld<br><br># Rule allowing access from local networks<br>http_access allow localnet<br>http_access allow localhost<br><br><br># ICP/HTCP access<br>icp_access allow localnet<br>icp_access deny all<br>htcp_access allow localnet<br>htcp_access deny all<br><br># 302 loop<br>acl text_mime rep_mime_type text/html text/plain<br>acl http302 http_status 302<br>store_miss deny text_mime http302<br>send_hit deny text_mime http302<br><br># Windows updates rules<br>http_access allow CONNECT wuCONNECT localnet<br>http_access allow CONNECT wuCONNECT localhost<br>http_access allow windowsupdate localnet<br>http_access allow windowsupdate localhost<br><br># SSL bump rules<br>acl DiscoverSNIHost at_step SslBump1<br># ICQ/MRA must splice first<br>acl NoSSLIntercept ssl::server_name_regex -i "/etc/squid/url.nobump"<br>ssl_bump splice NoSSLIntercept<br>ssl_bump bump net_bump<br>acl tls_s1_connect at_step SslBump1<br>acl tls_s3_server_hello at_step SslBump3<br><br># TLS/SSL bumping steps<br>ssl_bump peek tls_s1_connect # peek at the incoming TLS/SSL connect data<br>ssl_bump splice all # splice the stream: pass-through mode<br><br># And finally deny all other access to this proxy<br>http_access deny all<br><br># -------------------------------------<br># HTTP parameters<br># -------------------------------------<br><br># dhparams is before squid-3.5.12-20151222-r13967<br># tls-dh is AFTER squid-3.5.12-20151222-r13967<br>http_port 3127<br>http_port 3128 intercept<br># dhparams is before squid-3.5.12-20151222-r13967<br># tls-dh is AFTER squid-3.5.12-20151222-r13967<br>https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_certs/squid.crt key=/etc/squid/ssl_certs/squid.key options=NO_SSLv3 tls-dh=/etc/squid/dhparam.pem<br>sslproxy_capath /etc/ssl/certs<br># SINGLE_DH_USE is 3.5 before squid-3.5.12-20151222-r13967<br>#sslproxy_options NO_SSLv3,SINGLE_DH_USE<br># SINGLE_ECDH_USE is AFTER squid-3.5.12-20151222-r13967<br>sslproxy_options NO_SSLv3,SINGLE_ECDH_USE<br>sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS<br>sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/squid/ssl_db -M 4MB<br><br><br># Cache manager<br>cache_mgr <a href="mailto:mymail@gmail.com" target="_blank">mymail@gmail.com</a><br><br><br><br># Forces reload-into-ims<br>reload_into_ims on<br><br># Hide internal networks details outside<br>via off<br>forwarded_for delete<br><br># Do not show Squid version<br>httpd_suppress_version_string on<br><br><br># Prioritization of local hits<br>qos_flows tos local-hit=0x68<br><br># Specify local DNS cache<br>dns_nameservers 8.8.8.8<br><br>dns_v4_first on<br>ipcache_size 4096<br><br><br># -------------------------------------<br># Memory parameters<br># -------------------------------------<br>cache_mem 512 Mb<br><br>#memory_pools off<br><br>maximum_object_size_in_memory 1 MB<br><br># -------------------------------------<br># Tuning parameters<br># -------------------------------------<br>memory_replacement_policy heap LRU<br>cache_replacement_policy heap LFUDA<br><br>store_avg_object_size 85 KB<br># Default is 20<br>store_objects_per_bucket 32<br><br># Shutdown delay before terminate connections<br>shutdown_lifetime 15 second<br><br># SMP<br>#workers 2<br><br># -------------------------------------<br># Store parameters<br># -------------------------------------<br>maximum_object_size 8 Gb<br><br>cache_dir aufs /usr/local/cache 250000 16 256<br><br># -------------------------------------<br># Process/log parameters<br># -------------------------------------<br>#logformat my_squid %tl %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt<br>access_log daemon:/var/log/squid/access.log buffer-size=256KB<br># Don't log ICP queries<br>log_icp_queries off<br><br># Turn off internal log rotation<br>logfile_rotate 0<br><br>cache_log /var/log/squid/cache.log<br>cache_store_log none<br><br># Default is off<br>buffered_logs on<br><br>coredump_dir /var/core<br><br>pid_filename /tmp/squid.pid<br><br>strip_query_terms off<br><br># -------------------------------------<br># Content parameters<br># -------------------------------------<br>range_offset_limit none all<br><br># Default patterns<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320 reload-into-ims<br><br><br></div>-------------Config End ---------------<br><br></div><div>------------net.bump File -------------------<br><br><a href="http://google.com" target="_blank">google.com</a><br><a href="http://youtube.com" target="_blank">youtube.com</a><br><a href="http://reddit.com" target="_blank">reddit.com</a><br>-------------------------------<br><br></div><div>------------dstdom.tld file --------------<br><br><a href="http://yahoo.com" target="_blank">yahoo.com</a><br><a href="http://facebook.com" target="_blank">facebook.com</a><br><br>---------------------------------------<br></div><div><br><br></div><div>--------------- Url.nobump--------<br><br><a href="http://axisbank.com" target="_blank">axisbank.com</a><br><a href="http://hdfcbank.com" target="_blank">hdfcbank.com</a><br><br>------------------------------------------<br><br><br></div><div>Now issue is that I need to block yahoo and facebook but I am able to access the facebook website and yahoo is getting blocked ....<br><br></div><div>And also all Google website like google, gmail, youtube are working very slow it takes lots of time to load this websites but other Https websites like axisbank / hdfc etc are working properly ....<br><br></div><div>Also somtime website does not work with Chrome browser like Gmail but same is working in Mozilla Firefox but take time to load ......<br><br> <br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 18, 2016 at 8:07 PM, Alex Rousskov <span dir="ltr"><<a href="mailto:rousskov@measurement-factory.com" target="_blank">rousskov@measurement-factory.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 05/18/2016 05:05 AM, Sagar Malve wrote:<br>
<br>
> when we pass the Network through Squid the<br>
> Internet work very slow<br>
<br>
<br>
</span>In addition to other comments on this thread, please note that,<br>
according to my _ballpark_ estimates, Squid "ssl_bump bump" performance<br>
is about 10% of regular plain traffic forwarding performance and<br>
"ssl_bump splice step2" performance is about 30%.<br>
<br>
FWIW, we are working on significantly improving the latter:<br>
<br>
<a href="http://lists.squid-cache.org/pipermail/squid-dev/2016-May/005659.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-dev/2016-May/005659.html</a><br>
<a href="http://lists.squid-cache.org/pipermail/squid-dev/2016-May/005660.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-dev/2016-May/005660.html</a><br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
</blockquote></div><br></div></div>