We are going to offer an App which will allow our customers to download some sort of audio guide for the castle I work for.

I would really like to not have every user who downloads the App (through my free WiFi we offer) in our castle, to download the whole audio files from the app server which is outside of our castle (it's outside of our network).

So my research results show that I need build a proxy to cache files that are used very often (in my case the MP3 data), so that I can keep my free WiFi bandwidth free for "dynamical" data.

I need to do this to

  • Control/Cage the load that goes over my network, so I does not effect my office network.
  • Keep the free WiFi working smoothly. We have a lot of customers and offer free WiFi. Our interior network works with 10GBit and our Internet bandwidth is around 1Gbit.

So using a proxy to distribute the MP3 files and not having to download them from the internet again and again is what I am looking for.


  • Is Squid the tool I'm looking for or is there anything better?
  • How do I force all free WiFi users to use the proxy automatically.
  • [Optional] Your experiences with this use case.

A Squid can be used for this, however there are some issues you should watch out for :

  • Squid doesn't yet support caching of partial content, so if your app uses range requests instead of downloading the whole file, you'll have some issues. You can configure Squid to fetch the whole file in the cache on a range request, but in this case it'll block until the whole file is downloaded - if the cached audio file is stale and a new copy needs to be downloaded, your app's users will have to wait for the server to download the whole file before the app can play it.

  • Your app should use HTTP to fetch the files, otherwise you'll have certificate errors if your proxy tries to intercept the HTTPS connections, unless you create a certificate for the proxy and make your app trust it but then everything else besides your app will also throw HTTPS certificate errors and you can't do anything about it, usually intercepting HTTPS is bad practice unless you make it clear to your users and make them install a certificate.

To force the client's traffic to pass through Squid without any configuration on their part you need to configure Squid as a transparent proxy, and then use some firewall magic on the gateway users use to reach the Internet to redirect all the HTTP traffic to your Squid server :

http_port 3128 intercept # enable transparent proxy mode

As for the gateway configuration it depends on what firewall is on there, for IPtables something like this should work assuming your Squid server is behind the same gateway as your users :

iptables -t nat -A PREROUTING -s <squid_server_IP> -p tcp --dport 80 -j ACCEPT # accept HTTP traffic from the Squid
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <squid_server_IP>:3128 # redirect your user's HTTP traffic to Squid
iptables -t nat -A POSTROUTING -j MASQUERADE # probably not needed since your gateway already has this

Your should take a look at Squid's documentation, they have some examples for configuring entreprise firewalls for this.

  • Thanks mate I was able to set the proxy up as needed. The key point was http_port 3128 intercept. – Harrys Kavan Nov 25 '14 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.