How to Set Up and Configure the HTTP Proxy

To set up and configure the HTTP Proxy, follow the steps provided in this article. After setting up the HTTP Proxy, you can configure log settings for the service. Because the integrated proxy service of the Barracuda CloudGen Firewall is based on Squid, you can also add generic squid.conf entries for configurations such as client IP forwarding, closing redundant client sessions, and customized HTTP and HTTPS ports. From the command line, you can verify the HTTP Proxy server configuration.

To enable the HTTP Proxy:

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > HTTP-Proxy > Service Properties.

2. Click Lock.

3. From the Enable Service list, select Yes.

   The remaining settings on the page were configured when the HTTP Proxy service was created. For more details on these general service IP address settings, see How to Assign Services.

4. Click Send Changes and Activate.

Specify the settings for connecting your system to the Internet.

1. Go to CONFIGURATION > Configuration Tree > Box > Administrative Settings.

2. From the Configuration menu in the left navigation pane, select HTTP Proxy. 

3. Click Lock.

4. From the Connection Type list, select how your system is connected to the Internet. You can select one of these options:

   • Direct Access – Your Barracuda CloudGen Firewall is directly connected to the Internet.

   • HTTP/S Proxy – Your Barracuda CloudGen Firewall is connected through an HTTP or HTTPS Proxy.

5. Specify the rest of the settings in the System HTTP Proxy Settings section.

6. Click Send Changes and Activate.

Select the operation mode for the HTTP Proxy and specify its network settings.

1. Go to CONFIGURATION  > Configuration Tree > Box > Assigned Services >  HTTP-Proxy > HTTP Proxy Settings.

2. Click Lock.

3. In the left menu click Basic Settings and configure the following settings:

   • Contact Mail – The admin proxy email address. This address is the contact that will be displayed within upcoming error messages.

   • Visible Hostname – The hostname that will be displayed within error messages. The visible hostname must be formatted as: "host.domain.tld". Special characters are not allowed. If you are running a forwarding/caching DNS server, the hostname MUST NOT be identical to the system hostname.

   • Proxy Mode – The mode that specifies how the proxy service handles requests. You can select one of the following modes:

     Mode	Description

     Mode	Description
     ForwardProxy	If requests received from a client must be directed to another server, select this mode. The HTTP Proxy then acts as a client and generates further requests to the server.
     TransparentProxy	All requests sent by clients are directed to the proxy server. With this mode, proxy authentication is only possible with the Barracuda DC Agent. With a transparent proxy, you must also create a forwarding firewall rule (App Redirect) or unblock the preconfigured TRANSPARENT-PROXY firewall rule to allow Internet access for your trusted LANs. For more details on configuring firewall rules, see Access Rules.
     ReverseProxy	The reverse proxy directs incoming requests from other servers to clients without providing the origin details. With this mode, you must also configure additional settings for the reverse proxy. For more details, see How to Set Up a Reverse Proxy.
     With the Transparent Proxy and Reverse Proxy modes, the proxy modes and access control lists for the proxyauthentication type are deleted.

4. In the left menu, click IP Configuration.

5. In the Network Settings section, specify the IP addresses and ports that you want to use. You can also configure SNMP monitoring. For more details on these settings, see HTTP Proxy Settings.

6. Click Send Changes and Activate.

To specify the log settings for the HTTP Proxy:

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > HTTP-Proxy > HTTP Proxy Settings.

2. In the left navigation pane, expand Configuration Mode and click Switch to Advanced View.

3. Click Lock.

4. In the Log Settings section, specify the log settings for the service. For more details on these settings, see HTTP Proxy Settings.

5. Click Send Changes and Activate.

If required, you can configure these miscellaneous settings for the HTTP Proxy:

• Use of extended passive FTP

• Number of CPU cores

• Use of the X-Forwarded-For header for requests

• Cache settings

• Size limit for files that will be processed

To configure these settings:

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services >  HTTP-Proxy > HTTP Proxy Settings.

2. In the left navigation pane, expand Configuration Mode and click Switch to Advanced View.

3. In the Misc. Settings section, configure the miscellaneous settings. For more details on these settings, see HTTP Proxy Settings.

4. Click Send Changes and Activate.

To apply web filter policies or to use virus scanning for HTTPS traffic enable TLS Inspection. To use TLS Inspection the Feature Level of the Forwarding Firewall must be set to 7.2 or higher. For more information, see TLS Inspection in the Firewall.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > HTTP-Proxy > HTTP Proxy Settings.

2. In the left menu, select TLS Settings.

3. Click Lock.

4. Select Enable TLS Inspection.

5. Import your root CA Certificate in PKCS12 format:

   1. Click on Ex/Import for the Root CA Certificate.

   2. Select Import from PKCS12 File and select your root CA certificate file on your computer.

6. (optional) In the TLS Inspection section, enter the Excluded Domains.

7. (optional) In the TLS Inspection section, enter domains that should always be trusted to the Allow List.

8. Click Send Changes and Activate.

To configure client IP forwarding, close redundant client sessions, and customize HTTP and HTTPS ports, add squid.conf entries in the advanced settings for the HTTP Proxy.

To add squid.conf entries:

First, enable expert settings for the Barracuda CloudGen Firewall:

1. Click the Options tab on the top left of Barracuda Firewall Admin and select Settings.

2. Expand Admin and CC Settings and select the Show Expert Settings check box.

3. To activate the settings, restart Barracuda Firewall Admin.

The squid.conf settings are visible in Barracuda Firewall Admin now. Continue with the following steps:

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services >  HTTP-Proxy > HTTP Proxy Settings.

2. In the left navigation pane, expand Configuration Mode and click Switch to Advanced View.

3. Click Lock.

4. From the Configuration menu in the left navigation pane, click Advanced.

5. In the Generic squid.conf Entries field, add the required squid.conf entries.

6. Click Send Changes and Activate.