$ sudo service squid3 {start|stop|restart}

To specify what to run, an upstart must have exec or script stanza. When the goal is to start two or more (multiple) instances of squid3, exec is meant to replace existing process image of /usr/sbin/squid3 executable, therefore will not start two instances.

Multiple squid3 instances started via upstart exec

As workaround we can have symbolic link to squid3 executable instead and add new upstart job configuration with exec call to the link. I need two instances running in the same machine due to the implementation design where the fist instance is HTTP proxy cache while the second one is accelerator/interceptor (reverse proxy) that serves default landing page telling user to use proxy (and how to do that). Hence, for the second instance I add:

lrwxrwxrwx 1 root root 6 May  3 09:25 /usr/sbin/squid3ins2 -> squid3
-rw-r--r-- 1 root root 1156 May  6 13:30 /etc/init/squid3ins2.conf

and for the first instance I add:

-rw-r--r-- 1 root root 298 May  3 10:13 /etc/init/squid3.override

squid3ins2 is our link and /etc/init/squid3ins2.conf contains exec call to it to run second squid3. For the first instance I choose to write an override (/etc/init/squid3.override) so that the original job configuration file is left intact. For the complete content of all files check my github v1.1 of the Squid integration. There, in details you’ll also find how both instances PID, log, etc. are differentiated by each instance config via the following directives:

http_port
cache_dir
pid_filename
cache_access_log
cache_log

1
2
3
4
5
6
7
8

WAN=wan0
LAN=eth1
IPTABLES=/sbin/iptables
 
$IPTABLES --flush                         # Flush all the rules in filter and nat tables
$IPTABLES --table nat --flush
$IPTABLES --delete-chain                  # Delete all chains that are not in default filter and nat table
$IPTABLES --table nat --delete-chain

the real script is just two command line below:

1
2

$IPTABLES --table nat --append POSTROUTING --out-interface $WAN -j MASQUERADE
$IPTABLES --append FORWARD --in-interface $LAN -j ACCEPT

Default route gateway is wan0 and /etc/resolv.conf is edited with relevant DNS. Internet works perfectly and then after squid is installed, I use the following /etc/squid.conf :

1
2
3
4
5
6

visible_hostname mithrandir
http_port 3128
cache_dir ufs /var/spool/squid 1000 16 256
cache_access_log /var/log/squid/access.log
acl intranet src 192.168.40.0/24
http_access allow intranet

It is pretty straightforward and simple, a listening proxy 192.168.40.40 in port 3128. It is also a router to the internet, NAT, via wan0.