How to Route Only Certain Websites Through a VPN with Squid Proxy

Routing certain websites through a VPN using Squid Proxy can enhance your browsing privacy and security. By configuring Squid Proxy, a powerful caching and forwarding HTTP proxy server, in conjunction with a VPN, you can ensure that only specific websites or IP addresses are routed through the VPN tunnel. In this article, we will walk through the detailed process of setting up Squid Proxy to route traffic to selected websites via a VPN.

Prerequisites

Before starting, ensure the following:

• A Squid Proxy server installed and running on your network
• A VPN service or your own VPN server set up
• Access to the server’s configuration files (root or sudo privileges)
• Basic knowledge of Linux and command-line interface

Step 1: Install and Configure Squid Proxy

Squid Proxy must be installed and configured properly. Begin by installing Squid on a Linux server, such as Ubuntu:

sudo apt update
sudo apt install squid

Once Squid is installed, configure it by editing the configuration file located at /etc/squid/squid.conf.

sudo nano /etc/squid/squid.conf

Basic configuration changes will allow Squid to forward requests, but more detailed rules are required to specify the routing through the VPN.

Step 2: Define VPN and Regular Traffic Routes

Next, you will create routing rules that identify which traffic goes through the VPN and which goes through the regular internet connection. This is done by using iptables to mark traffic based on the destination website or IP address. Start by defining routing rules for specific domains or IPs in your Squid Proxy configuration.

acl vpn_sites dstdomain .example.com
http_access allow vpn_sites

The above ACL (Access Control List) rule defines which websites should be routed through the VPN. Replace example.com with your desired domain names.

Step 3: Set Up IP Routing for VPN Traffic

Now that Squid knows which traffic should be routed through the VPN, we need to set up IP routing to ensure this. Use iptables to configure the routing table:

# Mark traffic to be routed through VPN
sudo ip rule add from all to 192.168.1.0/24 table 100
sudo ip route add default via 10.8.0.1 dev tun0 table 100

Here, 192.168.1.0/24 is the network from which you want to route traffic through the VPN, and 10.8.0.1 is the VPN gateway IP. Adjust these values based on your network setup.

Step 4: Configuring Squid to Use VPN Interface

Squid should now forward requests based on the routing marks you’ve set. To configure Squid to send requests through the VPN, adjust the tcp_outgoing_address directive to bind Squid to the VPN’s network interface:

tcp_outgoing_address 10.8.0.1

Replace 10.8.0.1 with your VPN’s local gateway IP. This ensures that traffic to the specified websites is routed via the VPN interface.

Step 5: Testing the Configuration

After saving the changes to the Squid configuration and restarting the Squid service, test the routing by visiting the specified websites. You can use the curl command to verify that traffic is being routed through the VPN:

curl -I https://www.example.com

Check the IP address that the server sees by visiting the website. If everything is set up correctly, the server should detect the VPN’s IP address for the specified websites and your regular IP for other traffic.

Step 6: Final Adjustments and Security Considerations

For security and performance, you may want to fine-tune your Squid settings. Disable unnecessary access controls and configure Squid to only accept connections from trusted networks. Additionally, be aware that any DNS queries should also be routed through the VPN to avoid leaks. You can modify the /etc/squid/squid.conf file to forward DNS requests:

dns_nameservers 10.8.0.2

Here, 10.8.0.2 is the DNS server provided by the VPN.