Thu 9 Apr 2009
Tunning Proxy-squid buat Warnet, bikin koneksi ngoss.. langsung Joss….
Posted by harinto under OpenBSD
[2] Comments
untuk para juragan yang punya warnet yang pake koneksinya lewat speedy di sini akan saya berikan sedikit tips dan trik supaya… low cost hight performance…
1). Alangkah baiknya jika.. anda tidak men-dial langsung lewat modem… tetapi menggunakan router (pengalaman saya pribadi dalam setahun saya sudah membeli sekitar 3 bh modem) selain *jare wong dermayue sih di awet-awet* kita juga bisa melakukan sedikit penghematan bandwith dengan tunning di squid sehingga… bikin koneksi joss 24jam full….
Oh iya… disini saya hanya akan menjelaskan… cara dial & tunning Squid pake OpenBSD OS sebagai router “kenapa tidak menggunakan mikrotik OS??” karena mikrotik OS berlisensi perlevel alias tidak gratis!!!
Lanjut ya…
1. Editlah ppp.conf nya
# /etc/ppp/ppp.conf default: set log Phase Chat LCP IPCP CCP tun command set redial 15 0 set reconnect 15 10000 pppoe0: set device "!/usr/sbin/pppoe -i sk0" disable acfcomp protocomp deny acfcomp set mtu max 1492 set mru max 1492 set crtscts off set speed sync enable lqr set lqrperiod 5 set cd 5 set dial set login set timeout 0 set authname userlogin@telkom.net set authkey passyangdikasihadminspeedy add! default HISADDR enable dns enable mssfixup
2. forward /etc/sysctl.conf
net.inet.ip.forwarding=1
aktifkan pf nya di /etc/rc.conf
pf enable=YES
3. dial koneksinya
# ppp -ddial pppoe0
4. jika berhasil terkoneksi maka openBSd akan membinding otomatis
tun0: flags=8051 mtu 1492 groups: tun egress inet 125.xxx.xxx.7 --> 125.163.72.1 netmask 0xffffffff
5. buatlah rules di firewallnya
#edit /etc/pf.conf
lan_net = "192.168.1.0/24" int_if = "xl0" ext_if = "tun0" # scrub all scrub in all # nat outgoing connections on each internet interface nat on $ext_if from $lan_net to any -> ($ext_if)
6. agar openbsd mendial secara otomasti pada saat startup aktifkan di /etc/rc.local
# aktifkan speedy ppp -ddial pppoe0
Oke… anda sekarang sudah cukup menghemat cost dan membuat awet modem anda, sampai disini ada pertanyaan??? kalo tidak ada kita lanjut ke proses tunning Squid 2.7 stable 4. Kenapa menggunakan squid 2.7?? karena squid 2.7-stable4 adalah fungsi zph yang sudah terintegrasi.
ZPH sendiri adalah Zero Penalty Hit, penjelasan-nya bisa dibaca di http://zph.bratcheda.org/ (http://zph.bratcheda.org/) dan bisa menyimpan mencache Youtube (streaming dan lain2)
1. unduhlah paket Squid2.7 stable 4 (atau bisa juga STABLE 4 keatas)
2. Extraklah di sembarang tempat
3. configlah Squidnya…
./configure \ --sysconfdir=/etc/squid \ --prefix=/usr \ --enable-async-io \ --enable-removal-policies=lru,heap \ --disable-delay-pools \ --disable-wccp \ --disable-wccp2 \ --enable-kill-parent-hack \ --enable-snmp \ --enable-default-err-languages=English --enable-err-languages=English \ --enable-linux-netfilter \ --disable-auth
4. lalu di
#make
( dudu di mek-mek kaya apa bae.. 
)
5. terus di
#make install
( dudu di mek terus di install )
6. Pada squid.conf masukan dibawah ini adalah hasil parsing td
acl all src all acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.1.0/24 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access deny all icp_access allow localnet icp_access deny all http_port 3128 transparent hierarchy_stoplist cgi-bin ? cache_mem 6 MB maximum_object_size_in_memory 32 KB memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA cache_dir aufs /nfs/cache 20000 16 256 maximum_object_size 64 MB cache_swap_low 98 cache_swap_high 99 access_log /var/log/squid/access.log squid cache_log /var/log/squid/cache.log cache_store_log none log_fqdn off storeurl_rewrite_program /etc/squid/store_url_rewrite acl store_rewrite_list url_regex ^http://(.*?)/get_video\? acl store_rewrite_list url_regex ^http://(.*?)/videodownload\? storeurl_access allow store_rewrite_list storeurl_access deny all cache allow store_rewrite_list acl QUERY urlpath_regex cgi-bin \? cache deny QUERY refresh_pattern ^http://(.*?)/get_video\? 10080 90% 999999 override-expire ignore-no-cache ignore-private refresh_pattern ^http://(.*?)/videodownload\? 10080 90% 999999 override-expire ignore-no-cache ignore-private refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 quick_abort_min 0 quick_abort_max 0 quick_abort_pct 98 acl apache rep_header Server ^Apache broken_vary_encoding allow apache vary_ignore_expire on cache_effective_user squid cache_effective_group squid log_icp_queries off ipcache_size 2048 ipcache_low 98 ipcache_high 99 memory_pools off reload_into_ims on coredump_dir /usr/var/cache pipeline_prefetch on
7.kalo sudah bikin swap cache dan jalankan squidnya
/sbin/squid -z
/sbin/squid -D
8.Aktifkan pada saat startup
/sbin/squid -sYD
9.Sisipkan redirect pada /etc/pf.conf, yang fungsinya meredirect protocol TCP dr locallan menuju squid
rdr on $lnt_if proto tcp from any to any port 80 -> 192.168.1.1 port 3128
selesai…. kalo belum berhasil… silahkan kirim messeg ke saya yah… 
source: http://www.indramayucc.org
