The web proxy in ClearOS is a high-performance proxy caching server for web clients, supporting HTTP, FTP and some lesser known protocols. The software not only saves bandwidth and speeds up access time, but also gives administrators the ability to track web usage via web-based reports.
If you are new to ClearOS and/or setting up a proxy server, you may want to refer to the Guide to Setting up Web Proxy, Content Filter and Access Control Guide.
<note warning>Please note that the Proxy/Content Filter and Gateway Management apps are mutually exclusive. If you have the Proxy/Content Filter running, you should not use Gateway Management and vice-versa</note>
If your system does not have this app available, you can install it via the Marketplace.
You can find this feature in the menu system at the following location:
<navigation>Gateway|Content Filter and Proxy|Web Proxy</navigation>
If you would like to require a username/password for web access, you can enable user authentication.
<note warning>User authentication cannot be used in conjunction with transparent mode. If you require user authentication, then non-transparent mode is required. This is not a limitation of the software, but a limitation of the way the web protocol was designed!</note>
In transparent mode, all web requests from the local network automatically pass through the proxy. The advantage: no configuration changes are required on the workstations. The disadvantage: secure web sites (HTTPS) can not flow through the proxy.
Since network traffic needs to be intercepted before going out the Internet, this his mode is only available when ClearOS is configured as a gateway.
<note warning>These days, in Transparent Mode, the proxy is becoming less and less effective as the internet increasingly using https. Google now prefers to return https links rather than http links. The transparent proxy con only intercept http traffic and not https traffic. It is now only recommended to use one of the Non-Transparent modes only.</note>
The Performance Level indicates the size of network that your system can support. The Community Edition is designed for home/small networks and is already optimized for 10 users or less. The Professional Edition does automatic optimization based on available system resources.
The maximum size on your hard disk to use for the proxy server cache.
Any file (image, web page, PDF, etc) above the maximum object size will still go through the proxy but will not be cached. Large files (for instance, a movie file) can take up a lot of space in your proxy cache. If you have a cache size of 2 Gb and two people happen to download 1 Gb files at the same time, then these two files would replace everything else in your cache. You can limit the maximum object size to prevent this kind of scenario.
If you want to limit downloads of large files (for instance, movies) you can set a maximum size. Any file above this size limit will get blocked.
<note tip>If your internet connection is fast you will need a very fast disk to keep up or you will need to run the Proxy cacheless. See the Optimizing Performance for Proxy and Content filter guide.</note>
In some circumstances, you may need to by-pass the proxy server. Typically, this is required for web sites that are not proxy-friendly. Some notable examples:
You can use the following format for the bypass:
<note tip>Bypassing the proxy for a particular Website name may not be a good idea. As an example, google.com resolves to lots of different IP addresses. If you bypass “google.com”, it will look up the IP it maps to and bypass that single IP. Next time, if google resolves to a different IP it will not be bypassed. For google.com you would need to bypass a whole list of subnets.</note>
If you are running the proxy in non-transparent mode, then you also have to adjust your web browser's proxy server settings. The web site or IP address that you add to the ClearOS web proxy bypass list should also be added to your browser's proxy exception list. See the Non-Transparent Proxy and Content Filter Bypass guide.
Some sites, especially those with logins, do not play well with the proxy and need to be exempted. You may be able to spot these by using the guide here to look for DENIED messages. Then try whitelisting the resulting FQDN.
<note warning>Never whitelist a domain and subdomain of the same domain at the same time or the proxy will refuse to start e.g do not have subdomain.example.com and sub-subdomain.example.com in the whitelist at the same time. Having subdomain1.example.com and subdomain2.example.com at the same time is OK.</note>
In non-transparent mode, you must change the settings on all the web browsers running on your local network. The following describes the steps for configuring Internet Explorer, but other browsers have similar procedures. In Internet Explorer
In the Proxy Server settings box, specify your ClearOS IP address and the proxy port (see next section). You may not be able to access websites on your system or local network unless you select bypass proxy server for local addresses.
Which Port Should I Use?
So which port should be configured in your web browser's proxy settings?
From the Squid Web Proxy FAQ:
Question: Can I make my regular FTP clients use a Squid cache?
Answer: It's not possible. Squid only accepts HTTP requests.
If you see the message Requested web page or file is too large in your web browser, change the Maximum Download File Size parameter described above.