1

Unable to make the default install of Squid listen on its default port of tcp/3128.

Squid Version 3.5.27 running on Ubuntu 18.04.4 LTS

Setup

apt install squid -y
service squid start

Default Configuration

root@proxy:/etc/squid# cat /etc/squid/squid.conf | grep -v ^# | grep -v ^$
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all
http_port 3128
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320

Listening Ports

root@proxy:~# netstat -plunt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31074/sshd
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      9102/systemd-resolv
udp        0      0 0.0.0.0:43440           0.0.0.0:*                           30521/(squid-1)
udp        0      0 127.0.0.53:53           0.0.0.0:*                           9102/systemd-resolv
udp        0      0 0.0.0.0:68              0.0.0.0:*                           9094/systemd-networ
udp6       0      0 :::47733                :::*                                30521/(squid-1)

Troubleshooting Part 1

So the default install is not working, I add some new ports 3129, 3130, 3131 with a variety of common options.

root@proxy:/etc/squid# cat /etc/squid/squid.conf | grep -v ^# | grep -v ^$
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all
http_port 3128
http_port 3129 transparent
http_port 0.0.0.0:3130
http_port 0.0.0.0:3131 transparent
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320

Troubleshooting Listening Ports

root@proxy:~# netstat -plunt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31074/sshd
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      9102/systemd-resolv
udp        0      0 0.0.0.0:57748           0.0.0.0:*                           30521/(squid-1)
udp        0      0 127.0.0.53:53           0.0.0.0:*                           9102/systemd-resolv
udp        0      0 0.0.0.0:68              0.0.0.0:*                           9094/systemd-networ
udp6       0      0 :::53094                :::*                                30521/(squid-1)

Troubleshooting Part 2

Previous was unsuccessful so running squid in foreground and specify exact modified configuration file

root@proxy:/etc/squid# service squid stop && pkill squid && sleep 1 && squid -N -d 9 -f /etc/squid/squid.conf
2020/06/05 06:55:27| Set Current Directory to /var/spool/squid
2020/06/05 06:55:27| Starting Squid Cache version 3.5.27 for x86_64-pc-linux-gnu...
2020/06/05 06:55:27| Service Name: squid
2020/06/05 06:55:27| Process ID 4430
2020/06/05 06:55:27| Process Roles: master worker
2020/06/05 06:55:27| With 1024 file descriptors available
2020/06/05 06:55:27| Initializing IP Cache...
2020/06/05 06:55:27| DNS Socket created at [::], FD 9
2020/06/05 06:55:27| DNS Socket created at 0.0.0.0, FD 10
2020/06/05 06:55:27| Adding nameserver 127.0.0.53 from /etc/resolv.conf
2020/06/05 06:55:27| Adding domain members.linode.com from /etc/resolv.conf
2020/06/05 06:55:27| Logfile: opening log daemon:/var/log/squid/access.log
2020/06/05 06:55:27| Logfile Daemon: opening log /var/log/squid/access.log
2020/06/05 06:55:27| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2020/06/05 06:55:27| Store logging disabled
2020/06/05 06:55:27| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2020/06/05 06:55:27| Target number of buckets: 1008
2020/06/05 06:55:27| Using 8192 Store buckets
2020/06/05 06:55:27| Max Mem  size: 262144 KB
2020/06/05 06:55:27| Max Swap size: 0 KB
2020/06/05 06:55:27| Using Least Load store dir selection
2020/06/05 06:55:27| Set Current Directory to /var/spool/squid
2020/06/05 06:55:27| Finished loading MIME types and icons.
2020/06/05 06:55:27| HTCP Disabled.

Troubleshooting Listening Ports

root@proxy:~# netstat -plunt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      31074/sshd
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      9102/systemd-resolv
udp        0      0 0.0.0.0:52552           0.0.0.0:*                           30521/(squid-1)
udp        0      0 127.0.0.53:53           0.0.0.0:*                           9102/systemd-resolv
udp        0      0 0.0.0.0:68              0.0.0.0:*                           9094/systemd-networ
udp6       0      0 :::56473                :::*                                30521/(squid-1)

Still not listening on tcp/3128, tcp/3129, tcp/3130, tcp/3131.

Unsuccessful.

1
  • Non-intercepting proxy mode needs domain resolution, squid is probably still waiting for dns test during your call to netstat. (check your posts tags, probably a typo)
    – anx
    Jun 7, 2020 at 10:44

3 Answers 3

1

Today I could not get squid to listen on port 3128 or any other port on a Ubuntu 20.04 host, no matter what I tried. I got it finally working with adding

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

to my sysctl settings. My IPv6 setup must have been very strange.

0
netstat -lnp | grep squid
udp        0      0 0.0.0.0:36147           0.0.0.0:*                           3524/(squid-1)      
udp6       0      0 :::34275                :::*                                3524/(squid-1)   

update sysctl.conf

To Load in sysctl settings

sysctl -p
 net.ipv6.conf.all.disable_ipv6 = 1
 net.ipv6.conf.default.disable_ipv6 = 1
 net.ipv6.conf.lo.disable_ipv6 = 1


systemctl restart squid

netstat -lnp | grep squid
 tcp        0      0 0.0.0.0:3128            0.0.0.0:*               LISTEN      3551/(squid-1)      
 udp        0      0 0.0.0.0:38988           0.0.0.0:*                           3551/(squid-1) 
2
  • How is this different to @stephan-s's answer?
    – Daniel K
    Feb 8 at 17:18
  • How is this different to the existing answer?
    – Daniel K
    Feb 8 at 17:19
0

The squid config is made for aliens, I wrestled with it for ages before I realized:

http_port 0.0.0.0:3128

and of course you must make sure UFW is okay with squid:

sudo ufw allow 3128/allow

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.