Does Webmin write changes to squid.conf immediately when I click Save?

Yes. Webmin writes directly to squid.conf on save, but changes only take effect after you click Apply Configuration (reconfigure) or restart the squid service.

Can I use Squid as a transparent proxy so clients don't need manual proxy settings?

Yes, but transparent interception requires additional NAT rules to redirect port 80 traffic to Squid's port and a separate HTTPS bump configuration for port 443. That is a more advanced setup beyond basic caching.

How much disk space should I allocate to the cache?

A general rule is no more than 80% of available disk space on the partition. For a small office LAN, 4–20 GB is usually adequate. Very large caches have diminishing returns without matching RAM.

Is it safe to run Webmin on a public-facing server?

Webmin on port 10000 should be firewalled to trusted IPs only or accessed via an SSH tunnel. Never expose Webmin directly to the internet without strict IP allowlisting.

Why does the Squid module show a different version than what is installed?

Webmin reads the Squid binary path set in Module Config. If there is a mismatch, update the Squid executable path in Module Config to point to the correct binary, typically /usr/sbin/squid.

Configure a Squid Proxy with Webmin

Squid is a battle-tested caching proxy that reduces bandwidth usage, speeds up repeated web requests, and lets you enforce access policies on a network. Webmin gives you a browser-based interface to manage Squid without hand-editing /etc/squid/squid.conf every time. This guide walks through installing both, wiring up the Webmin Squid module, configuring a basic caching setup, and verifying everything works.

Prerequisites

You need a server running a supported Linux distro with a static IP on your LAN, root or sudo access, and Webmin already installed. If Webmin is not yet installed, follow the official Webmin installation docs first — it is outside the scope of this guide. Webmin listens on port 10000/tcp by default; confirm you can reach it before continuing.

Step 1: Install Squid

Install Squid from your distribution's official repositories. The package name is squid across all major distros.

Debian / Ubuntu

sudo apt update
sudo apt install squid -y

Fedora / RHEL 9 / Rocky Linux 9

sudo dnf install squid -y

Arch Linux

sudo pacman -S squid

After installation, enable and start the service via systemd:

sudo systemctl enable --now squid

Confirm it is running:

sudo systemctl status squid

You should see active (running) in the output. Squid defaults to listening on port 3128.

Step 2: Open the Squid Port in Your Firewall

Clients on your LAN need to reach port 3128. Adjust this to match whatever firewall tool your distro uses.

UFW (Debian / Ubuntu)

sudo ufw allow 3128/tcp
sudo ufw reload

firewalld (Fedora / RHEL / Rocky)

sudo firewall-cmd --permanent --add-service=squid
sudo firewall-cmd --reload

nftables (Arch / manual setups)

sudo nft add rule inet filter input tcp dport 3128 accept

Make the nftables rule persistent by saving your ruleset according to your distro's convention (e.g., /etc/nftables.conf).

Step 3: Load the Squid Module in Webmin

Webmin auto-detects installed services. Log into Webmin at https://<your-server-ip>:10000 and navigate to Servers → Squid Proxy Server. If you do not see it listed, the module may need to be refreshed.

Go to Webmin → Webmin Configuration → Webmin Modules.
Click Refresh Modules (or install from the Standard Modules list if missing).
Return to Servers — Squid should now appear.

If Webmin cannot find the Squid configuration file, click Module Config inside the Squid module and set the path to /etc/squid/squid.conf manually, then save.

Step 4: Configure Basic Caching Options

Inside the Squid module, click Cache Options. These are the most impactful settings for a simple LAN proxy:

Cache directory (cache_dir): Set the path (/var/spool/squid is the default), the total cache size in MB, and the number of first-level and second-level subdirectories. A starting point for a small office: 4096 MB, 16 L1 dirs, 256 L2 dirs.
Maximum object size: Objects larger than this are not cached. 512 MB is reasonable for general use; lower it to 4–16 MB if you only want to cache web pages.
Minimum object size: Leave at 0 unless you want to skip caching tiny objects.
Memory cache size (cache_mem): RAM reserved for in-transit and hot objects. Set to roughly 25% of available RAM, e.g., 256 MB on a 1 GB server.

Click Save after editing each section. Webmin writes changes directly to squid.conf.

Step 5: Set Access Controls

By default, Squid only allows connections from localhost. You must add an ACL for your LAN subnet and permit it, or clients will receive 403 Access Denied.

In the Squid module, click Access Control.
Under Access Control Lists, click Add ACL. Give it a name such as localnet, choose type Client IP Address, and enter your subnet, e.g., 192.168.1.0/24. Save.
Under Proxy Restrictions, click Add Proxy Restriction. Set the action to Allow and select the localnet ACL you just created. Save.
Make sure the localnet allow rule appears above the default all deny rule in the list. Drag or reorder if needed — Squid evaluates rules top-down.

Step 6: Initialize the Cache Directory and Restart Squid

Squid requires its cache directory structure to be created before it can use it. Run this once from the command line:

sudo squid -z

Then restart Squid so the new configuration takes effect:

sudo systemctl restart squid

You can also trigger a restart from within Webmin by clicking Apply Configuration at the top of the Squid module page. Webmin calls squid -k reconfigure, which reloads most settings without a full restart, but after changing the cache directory a full restart is required.

Step 7: Verify the Proxy Is Working

From a client machine on the same subnet, test the proxy with curl:

curl -x http://<proxy-server-ip>:3128 http://example.com -I

A successful response includes an HTTP status line (e.g., HTTP/1.1 200 OK) and an X-Cache or X-Squid-Error header from Squid. The first request will be a cache miss (MISS); repeat the command and it should return HIT.

Check the access log on the server to confirm traffic is flowing through:

sudo tail -f /var/log/squid/access.log

Each line shows the timestamp, client IP, HTTP status code, and URL. A line containing TCP_MISS is a fresh fetch; TCP_MEM_HIT or TCP_HIT confirms caching is active.

Troubleshooting

Webmin shows "Squid is not running"

Run sudo squid -k parse to check for configuration syntax errors. Webmin will sometimes write a broken line if an ACL entry uses unexpected characters. Fix errors in /etc/squid/squid.conf and run sudo systemctl start squid again.

Clients get 403 Access Denied

The ACL or proxy restriction order is wrong, or the client IP is outside the defined subnet. Re-check the ACL subnet and confirm the allow rule is above the final deny-all rule in the Proxy Restrictions list.

Cache misses on every request

If you changed cache_dir but did not run sudo squid -z, the directory structure does not exist and Squid falls back to memory-only caching. Run squid -z and restart.

SELinux blocking Squid on RHEL/Rocky

Check the audit log:

sudo ausearch -m avc -ts recent | grep squid

If denials appear, the cache directory may be labeled incorrectly. Restore the default label:

sudo restorecon -Rv /var/spool/squid