Hi folks,

@syncer I am the unofficial maintainer of the Squid-Cache RPM's and DEB packages and doing it for more then 4 years now.
These days network routers are actually Route Servers and only the low cost devices doesn't contains any form of proxy functionality on them.
If you need a simple IP router you don't need it and this is most of the use cases of YVOS to my knowledge.
However we might be able to compromise on something in the middle instead of ditching it or other proxies.
Squid-Cache is good for caching but very old so for filtering there are couple other more efficient solutions and also the nature of the Internet HTTP world have changed so caching is good only for very specific purposes...
So I think that it would be a nice to have but if it's possible to allow the admin configure Squid or another proxy outside of the configuration shell it would be a better solution.
Also if you want to intercept traffic into squid you can just use DNAT rules.

I use squid as a caching proxy to very considerably speed up patching and non-encrypted static web content. I also use the blacklists which are updated every day. While VyOS with Squid and Wifi is a very good integrated router for home and SOHO, I also use it as building bloc for sample firewalls you encounter in corporate environments in several showcases.

Meanwhile I learned how to successfully use DFS with the ATH10K driver. It is kind of a nasty driver to use as the makers put many obstacles into firmware and the driver module code to prevent "daisy chained" accidents related to setting wrong regulatory domains. RegDomain setting was not possible without Kernel config parameters "CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING" and "CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS". I guess that was the reason why hostapd always crashed when trying to use DFS.

@alainlamar thanks for detailed description!
I wish that all tasks were created in that way.

I suppose I should also mention that I am also using a proxy PAC file hosted on the internal lighttpd instance as well over HTTP (again, can't use HTTPS due to certificate trust issues for unknown client PC's) which is important due to DHCP server URL designation of a PAC/WPAD file currently.

Web proxies are relatively complex by nature and offer an attractive attack surface. I don't like having such software on routers at all, even if they are properly maintained. Better to relegate this functionality to a system which is external to the router.

With limited people in the project I think the "core" features for a router should be of priority. A lot of things is nice to have, but we need to have a good router.
IPv6 with VRRP, connection tracking, updated routing engine, IPv6 PD is stuff we need and requires a lot of design, implementation, testing and documentation.

@Asteroza thanks for feedback!

I do use squid in production, but without the hardcoded blacklists, rather my own local list only, and as an explicit proxy with a rejection message locally hosted as HTTP on the inbuilt lighttpd instance (can't serve HTTPS rejections because of certificate trust issues).