Set monthly data limit for internet proxy (squid) users

internetPROXYsquid

We are using a squid proxy server (version 3.1.4) in our office environment on linux box. In total we are approximately 20 users and all are in one network and we have internet plan of 25GB/month. Now what we want is restrict each user to some size say 1GB/user/month (will be more better if it is more configurable, say 512MB for some users, 2GB for some users) , so that everyone get equal access.

I have searched a lot over internet like to restrict with bandwidth, or using maximum download size parameter reply_body_max_size, delay parameters. But cannot find what I want.

Is there any way to do this in squid or any other open source option?

Best Answer

I've been struggling to add this functionality as well. The problem with squish is, it's squishing users that is not supposed to be squished.

The workaround that I used was to use the daily data from lightsquid stored in /var/lib/lightsquid/report/<date>/.total. Since lightsquid data is updated every 10 minutes, it also gave my squid setup the ability of an almost "real-time" quota capability.

Related Solutions

Linux – How to Restrict Internet Access for a Particular User Using Iptables

I assume that users A and B are using the same Linux machine(s) where you are the administrator. (It's not completely clear from your question. If A and B are have their own computers which they are administrators on, it's a completely different problem.)

The following command will prevent the user with uid 1234 from sending packets on the interface eth0:

iptables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP
ip6tables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP

I recommend reading the Ubuntu iptables guide to get basic familiarity with the tool (and refer to the man page for advanced things like the mangle table).

The user will still be able to run ping (because it's setuid root), but not anything else. The user will still be able to connect to a local proxy if that proxy was started by another user.

To remove this rule, add -D to the command above.

To make the rule permanent, add it to /etc/network/if-up.d/my-user-restrictions (make that an executable script beginning with #!/bin/sh). Or use iptables-save (see the Ubuntu iptables guide for more information).

Routing internet on NAT server thru Squid proxy

To transparently intercept traffic use policy based routing via NAT to redirect the web traffic to the squid proxy, then intercept it.

Set policy routing on your GW or NAT box, adjust the ip's and interfaces to suit. Your diagram implies the first rule to allow your squid box access to the internet might not be needed.

iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s squidip
iptables -t mangle -A PREROUTING -j MARK --set-mark 8 -p tcp --dport 80
ip rule add fwmark 8 table 2
ip route add default via squidip dev eth0 table 2

Then intercept on the Squid Proxy. This rule can be more specific if there's any chance other data on port 80 needs to go through this box.
```
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3129
```
On the Squid box, squid.conf
```
http_port 3129 intercept
```

If you need to support IPV6, squid have a tproxy config example for CentOS.

Best Answer

Related Solutions

Linux – How to Restrict Internet Access for a Particular User Using Iptables

Routing internet on NAT server thru Squid proxy

Related Question