Configuring Squid Proxy Delay Pools for Bandwidth Throttling

When operating enterprise proxy gateways or providing shared internet access across large administrative data centers, uncontrolled downloads can quickly saturate network interfaces. If a single workstation initiates massive ISO downloads or video streams, critical administrative traffic can experience severe latency.

Squid Proxy provides an incredibly powerful bandwidth management mechanism known as Delay Pools. By defining Access Control Lists (ACLs) and pairing them with delay classes, you can strictly throttle download speeds for specific subnets while granting unhindered bandwidth to critical infrastructure.

In this guide, I will walk you through structuring Squid ACLs across different data center zones, establishing Class 1 delay pools, calculating byte-per-second bandwidth parameters, and verifying proxy execution.

Prerequisites

You will need a Linux server running Squid Proxy with root privileges, alongside network access to manage proxy client configurations.

---

Step 1: Structuring Access Control Lists (ACLs)

Before defining bandwidth throttling rules, establish ACLs to classify incoming client connections based on their source IP subnets. In our enterprise environment, we isolate VDI client ranges across two distinct data centers (west-dc1 and east-dc1).

Create or update your Squid configuration /etc/squid/squid.conf:

# /etc/squid/squid.conf
# Define West Data Center 1 VDI Client Subnets
acl WestDc1Clients src 10.10.4.0/24 10.10.46.1/32

# Define East Data Center 1 VDI Client Subnets
acl EastDc1Clients src 10.12.4.0/24 10.12.46.1/32

---

Step 2: Configuring Delay Pools and Throttling Parameters

Squid delay pools utilize a bucket-and-fill mechanism. Bandwidth parameters are defined in bytes per second (not bits per second).

Bandwidth Calculation Formula

To limit a subnet to 90 Megabits per second (Mbps), calculate the equivalent bytes per second:

Bytes per second = (90,000,000 bits / 8) = 11,250,000 bytes/sec

Applying Delay Pools in squid.conf

We configure a single Class 1 delay pool to pool total bandwidth, restricting general web traffic while specifically exempting our critical VDI client subnets from throttling.

# /etc/squid/squid.conf
# Initialize 1 delay pool
delay_pools 1

# Assign Pool 1 to Delay Class 1 (Single aggregate bucket)
delay_class 1 1

# Apply Access Rules: Allow throttling for all traffic EXCEPT our critical VDI subnets
delay_access 1 allow !WestDc1Clients !EastDc1Clients
delay_access 1 deny all

# Set Bandwidth Throttling Parameters: Restrict pool to 11.25 MB/sec (90 Mbps)
delay_parameters 1 11250000/11250000

Reload the Squid proxy daemon to activate the delay pools:

systemctl reload squid

---

Step 3: Verifying Proxy Execution (CLI Testing)

To verify that your Squid proxy is actively accepting connections and correctly applying delay pool restrictions, initiate a test download using wget via the proxy interface:

# Initiate test download via Squid Proxy on port 8000
wget --no-check-certificate -e use_proxy=yes -e https_proxy=proxy.induslevel.com:8000 https://west-dc1-cacti.induslevel.com/cacti/testfile

References

• Squid Proxy Delay Pools Documentation