{"slug": "squid", "name": "Squid", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 5, "commenters": 5, "warners": 0, "score": 4.281, "rising": -1.64, "first": "2025-12-05", "latest": "2026-06-28", "why": "The great thing about using squid and disabling DNS is you can stop DNS and HTTP exfil, but still allow certain websites to be accessible.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 7, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 4, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "The great thing about using squid and disabling DNS is you can stop DNS and HTTP exfil, but still allow certain websites to be accessible.", "kind": "", "icon": true, "domain": "squid-cache.org", "github_repo": null, "official_url": "https://www.squid-cache.org", "pricing": "", "aliases": ["Squid"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 779377778, "item_id": 48711111, "url": "https://news.ycombinator.com/item?id=48711111", "by": "Bender", "date": "2026-06-28", "version": null, "stance": "recommend", "quote": "Over my Tinc VPN I like to use a Squid SSL Bump MitM proxy", "excerpt": "I use my own VPN mesh running Tinc [1] and some here use Wireguard. I've used corporate VPN's for work in the past. Never tried one of the commercial anonymizing VPN's. Article mentions proxies. Over my Tinc VPN I like to use a Squid SSL Bump MitM proxy so I can create ACL's and cache content in RAM on the proxy for friends to share. Some day I should make an article for setting up Tinc and Squid. And yeah, VPN's can", "context": "", "use_case": "caching proxy with ACLs", "switched_from": "", "story": "Don't Use VPN Servces"}, {"id": 777744336, "item_id": 48609021, "url": "https://news.ycombinator.com/item?id=48609021", "by": "Bender", "date": "2026-06-20", "version": null, "stance": "recommend", "quote": "One can install Squid on their router, generate a CA cert, sign their server certs with it", "excerpt": "That's already a thing. One can install Squid on their router, generate a CA cert, sign their server certs with it and install the CA into all the devices in the home. It's called Squid SSL Bump. [1] A small handful of sites still use public key pinning and will have to be added to exclusions in the configuration. The router must then be configured to only allow Squid HTTPS, Unbound DNS and Chrony NTP out to the inte", "context": "", "use_case": "HTTPS filtering on router", "switched_from": "", "story": "Think of the Children: How to Force Real ID for All Internet Traffic (2023)"}, {"id": 769203728, "item_id": 48075233, "url": "https://news.ycombinator.com/item?id=48075233", "by": "sunshine-o", "date": "2026-05-09", "version": null, "stance": "recommend", "quote": "I am wondering if that might be the most straightforward way to do this", "excerpt": "I am not surprised... I am unfamiliar with web caching proxies like squid [0] but I am wondering if that might be the most straightforward way to do this. So use squid and then have a batch job that go through /var/spool/squid every day and update your web archive according to some defined filters. - [0] https://www.squid-cache.org/", "context": "", "use_case": "web caching proxy", "switched_from": "", "story": "Google Broke reCAPTCHA for De-Googled Android Users"}, {"id": 766583696, "item_id": 47911481, "url": "https://news.ycombinator.com/item?id=47911481", "by": "Bender", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy.", "excerpt": "The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy. There are a handful of sites it will not work with due to them still using public key pinning but its a tiny list. I do not have it handy at the moment. Squid supports ACL's that can block URL patterns, domains, IP addresses, file extensions, mime types and much more. Here [1] is an out of date example. There are probably bette", "context": "", "use_case": "TLS-intercepting ad-block proxy", "switched_from": "", "story": "Firefox Has Integrated Brave's Adblock Engine"}, {"id": 742733568, "item_id": 46420848, "url": "https://news.ycombinator.com/item?id=46420848", "by": "fsmunoz", "date": "2025-12-29", "version": null, "stance": "recommend", "quote": "Part of the reason I chose Squid here", "excerpt": "I've used Caddy for some of my projects (e.g. https://github.com/fsmunoz/parlamentodb/blob/54e0b252485905e3ee25c12c562e1ec5b0e0296b/docker-compose.yml#L30 ), but not for this intercept approach you mentioned, I will give it a look! I'm not bothered by restart times but that's mostly because that has never been a priority... but one thing I have half-done is a controller that gathers per-namespace configs, and with th", "context": "", "use_case": "Kubernetes egress proxy", "switched_from": "", "story": "Kubernetes Egress Control with Squid Proxy"}]}], "caveats": [], "who": [{"by": "crimsonnoodle58", "context": "runs Kubernetes with custom whitelist controller", "url": "https://news.ycombinator.com/item?id=46420337", "date": "2025-12-29"}], "tags": [], "use_cases": ["caching proxy with acls", "https filtering on router", "web caching proxy", "tls-intercepting ad-block proxy", "kubernetes egress proxy", "kubernetes egress control"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46419659", "title": "Kubernetes Egress Control with Squid Proxy", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48711094", "title": "Don't Use VPN Servces", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48602817", "title": "Think of the Children: How to Force Real ID for All Internet Traffic (2023)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48067119", "title": "Google Broke reCAPTCHA for De-Googled Android Users", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47897891", "title": "Firefox Has Integrated Brave's Adblock Engine", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46204886", "title": "Rahm Emanuel says U.S. should follow Australia's youth social media ban", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 4}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 779377778, "item_id": 48711111, "url": "https://news.ycombinator.com/item?id=48711111", "by": "Bender", "date": "2026-06-28", "version": null, "stance": "recommend", "quote": "Over my Tinc VPN I like to use a Squid SSL Bump MitM proxy", "excerpt": "I use my own VPN mesh running Tinc [1] and some here use Wireguard. I've used corporate VPN's for work in the past. Never tried one of the commercial anonymizing VPN's. Article mentions proxies. Over my Tinc VPN I like to use a Squid SSL Bump MitM proxy so I can create ACL's and cache content in RAM on the proxy for friends to share. Some day I should make an article for setting up Tinc and Squid. And yeah, VPN's can", "context": "", "use_case": "caching proxy with ACLs", "switched_from": "", "story": "Don't Use VPN Servces"}, {"id": 777744336, "item_id": 48609021, "url": "https://news.ycombinator.com/item?id=48609021", "by": "Bender", "date": "2026-06-20", "version": null, "stance": "recommend", "quote": "One can install Squid on their router, generate a CA cert, sign their server certs with it", "excerpt": "That's already a thing. One can install Squid on their router, generate a CA cert, sign their server certs with it and install the CA into all the devices in the home. It's called Squid SSL Bump. [1] A small handful of sites still use public key pinning and will have to be added to exclusions in the configuration. The router must then be configured to only allow Squid HTTPS, Unbound DNS and Chrony NTP out to the inte", "context": "", "use_case": "HTTPS filtering on router", "switched_from": "", "story": "Think of the Children: How to Force Real ID for All Internet Traffic (2023)"}, {"id": 769203728, "item_id": 48075233, "url": "https://news.ycombinator.com/item?id=48075233", "by": "sunshine-o", "date": "2026-05-09", "version": null, "stance": "recommend", "quote": "I am wondering if that might be the most straightforward way to do this", "excerpt": "I am not surprised... I am unfamiliar with web caching proxies like squid [0] but I am wondering if that might be the most straightforward way to do this. So use squid and then have a batch job that go through /var/spool/squid every day and update your web archive according to some defined filters. - [0] https://www.squid-cache.org/", "context": "", "use_case": "web caching proxy", "switched_from": "", "story": "Google Broke reCAPTCHA for De-Googled Android Users"}, {"id": 766583696, "item_id": 47911481, "url": "https://news.ycombinator.com/item?id=47911481", "by": "Bender", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy.", "excerpt": "The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy. There are a handful of sites it will not work with due to them still using public key pinning but its a tiny list. I do not have it handy at the moment. Squid supports ACL's that can block URL patterns, domains, IP addresses, file extensions, mime types and much more. Here [1] is an out of date example. There are probably bette", "context": "", "use_case": "TLS-intercepting ad-block proxy", "switched_from": "", "story": "Firefox Has Integrated Brave's Adblock Engine"}, {"id": 742733568, "item_id": 46420848, "url": "https://news.ycombinator.com/item?id=46420848", "by": "fsmunoz", "date": "2025-12-29", "version": null, "stance": "recommend", "quote": "Part of the reason I chose Squid here", "excerpt": "I've used Caddy for some of my projects (e.g. https://github.com/fsmunoz/parlamentodb/blob/54e0b252485905e3ee25c12c562e1ec5b0e0296b/docker-compose.yml#L30 ), but not for this intercept approach you mentioned, I will give it a look! I'm not bothered by restart times but that's mostly because that has never been a priority... but one thing I have half-done is a controller that gathers per-namespace configs, and with th", "context": "", "use_case": "Kubernetes egress proxy", "switched_from": "", "story": "Kubernetes Egress Control with Squid Proxy"}, {"id": 742725392, "item_id": 46420337, "url": "https://news.ycombinator.com/item?id=46420337", "by": "crimsonnoodle58", "date": "2025-12-29", "version": null, "stance": "recommend", "quote": "The great thing about using squid and disabling DNS is you can stop DNS and HTTP exfil, but still allow certain websites to be accessible.", "excerpt": "We use squid for egress control on Kubernetes and have also written a controller that runs in a sidecar container next to squid that monitors for custom CRD's, such as a whitelists. The controller then updates squid.conf and reloads squid. This allows pods/namespaces to define their own whitelists. The great thing about using squid and disabling DNS is you can stop DNS and HTTP exfil, but still allow certain websites", "context": "runs Kubernetes with custom whitelist controller", "use_case": "Kubernetes egress control", "switched_from": "", "story": "Kubernetes Egress Control with Squid Proxy"}, {"id": 739390832, "item_id": 46211927, "url": "https://news.ycombinator.com/item?id=46211927", "by": "hellojesus", "date": "2025-12-09", "version": null, "stance": "recommend", "quote": "I'd push the implementation to the router and force root certs on devices", "excerpt": "To that extent can't kids just pop in a live USB and get a totally ephemeral and open os? I'd push the implementation to the router and force root certs on devices and have all clients run through your proxy or drop the packets. That way even live usbs will not get network access. Have some separate, hugely locked down network for kids' friends. Maybe put a separate honeypot network up with some iot devices on it wit", "context": "", "use_case": "HTTPS interception proxy", "switched_from": "", "story": "Rahm Emanuel says U.S. should follow Australia's youth social media ban"}, {"id": 738684960, "item_id": 46167810, "url": "https://news.ycombinator.com/item?id=46167810", "by": "Bender", "date": "2025-12-05", "version": null, "stance": "recommend", "quote": "would be to use a Squid SSL Bump proxy.", "excerpt": "The easiest route here in my opinion aside from DNS services that claim to block adult content would be to use a Squid SSL Bump proxy. It's along the lines of what you are suggesting and requires installing a self signed CA cert on the client but gives you centralized management of what domains, URLs, file types, times of day, URL patterns are allowed/permitted as well as a memory and disk cache to reduce bandwidth. ", "context": "", "use_case": "home content filtering proxy", "switched_from": "", "story": "Fighting the age-gated internet"}]}