LinuxQuestions.org - Transparent proxy

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Transparent proxy (https://www.linuxquestions.org/questions/linux-newbie-8/transparent-proxy-755054/)

Transparent proxy

I have a proxy server available for public access. I recently received a question about it saying:
...you proxy on port xxxx is transparent and therefore useless.

I thought transparent proxies were only used inside office networks mainly where browsers didn't have to know anything about the network settings. With this proxy, the browser has to be set up specifically access it on 80 or 8080 and it doesn't pass on the IP address of the user.

well you've mentioned numerous times that it's transparent, and I've said numerous times that it's generally a bad idea to do it transparently... where did this question come from? What is this proxy actually doing? It may relate to the fact that you can't transparently proxy ssl connections.

Quote:

Originally Posted by acid_kewpie (Post 3682191)

But it's NOT transparent, users have to enter the proxy details in their browser.
All the proxy does is accept requests and then passes them on with the proxy's IP.
The questions was from a random user, maybe they just think that because it's using port 8080, it's transparent. If it was transparent it would pass on the user's IP, which it doesn't.
Am I misunderstanding something about transparent proxies here?

a transparent proxy wouldn't pass on an IP, any normal implementation would still give the IP of the box. Does the config not specify transparent at all then? There are some online proxy testing tools which might show up some things of interest.

Quote:

Originally Posted by acid_kewpie (Post 3682304)

I don't have any transparent settings in the squid.conf
If I connect to the proxy and then go to what is my IP, it gives me the IP of the proxy.
Maybe the person sending the query got confused as it was a connection to port 8080 ?

The proxy isn't on the same LAN as anyone requesting pages from it so it can't be transparent...or can it?

So, it's not transparent?

I just went to:
http://www.hideyouripaddress.net/what_is_my_ip/

and it showed the server IP address but then below that it showed my real IP:
YOUR Proxy
Proxy Type: Transparent, Real IP: 86.xxx.xxx.xx

How is this possible?

you may be adding in headers like X-Forwarded-For. on the server, capture the outbound HTTP requests and show the headers to us. You can do this plenty of ways, I'd probably run tcpdump on the remote server with the -X option to dump the raw data.

Thanks for the link although it's slightly older, I am on v2.6 though squid is now up to 3. However, the example is similar in principle.
I found this in the config:

Code:

#  TAG: header_access

#      Usage: header_access header_name allow|deny [!]aclname ...

#

#      WARNING: Doing this VIOLATES the HTTP standard.  Enabling

#      this feature could make you liable for problems which it

#      causes.

#

#      This option replaces the old 'anonymize_headers' and the

#      older 'http_anonymizer' option with something that is much

#      more configurable. This new method creates a list of ACLs

#      for each header, allowing you very fine-tuned header

#      mangling.

#

#      You can only specify known headers for the header name.

#      Other headers are reclassified as 'Other'. You can also

#      refer to all the headers with 'All'.

#

#      For example, to achieve the same behavior as the old

#      'http_anonymizer standard' option, you should use:

#

#              header_access From deny all

#              header_access Referer deny all

#              header_access Server deny all

#              header_access User-Agent deny all

#              header_access WWW-Authenticate deny all

#              header_access Link deny all

#

#      Or, to reproduce the old 'http_anonymizer paranoid' feature

#      you should use:

 header_access Allow allow all

#              header_access Authorization allow all

#              header_access WWW-Authenticate allow all

#              header_access Proxy-Authorization allow all

#              header_access Proxy-Authenticate allow all

#              header_access Cache-Control allow all

#              header_access Content-Encoding allow all

#              header_access Content-Length allow all

#              header_access Content-Type allow all

#              header_access Date allow all

#              header_access Expires allow all

#              header_access Host allow all

#              header_access If-Modified-Since allow all

#              header_access Last-Modified allow all

#              header_access Location allow all

#              header_access Pragma allow all

#              header_access Accept allow all

#              header_access Accept-Charset allow all

#              header_access Accept-Encoding allow all

#              header_access Accept-Language allow all

#              header_access Content-Language allow all

#              header_access Mime-Version allow all

#              header_access Retry-After allow all

#              header_access Title allow all

#              header_access Connection allow all

#              header_access Proxy-Connection allow all

#              header_access All deny all

#

#      By default, all headers are allowed (no anonymizing is

#      performed).

#

#Default:

# none

I'm not really sure which one to pick.

...and this is my forwarded for

Code:



#  TAG: forwarded_for  on|off

#      If set, Squid will include your system's IP address or name

#      in the HTTP requests it forwards.  By default it looks like

#      this:

#

#              X-Forwarded-For: 192.1.2.3

#

#      If you disable this, it will appear as

#

#              X-Forwarded-For: unknown

#

#Default:

# forwarded_for on

I just added this to the conf and restarted but that website still picks up my personal PC's IP.

Code:

header_access From deny all

header_access Referer deny all

header_access Server deny all

header_access User-Agent deny all

header_access WWW-Authenticate deny all

header_access Link deny all

Is it possible that adding the header access tags could slow down the squid server?
Is it necessary for the header access tags to be omitted for complete privacy?
Worried about this part:
# WARNING: Doing this VIOLATES the HTTP standard. Enabling
# this feature could make you liable for problems which it
# causes.
#

I have changed this: # forwarded_for on
to
forwarded_for off
and that seems to stop the IP from being passed through.

in theory it can, but for the loads I expect you'd give it, no.

For complete privacy you might want to use something like privoxy instead of squid.

Now Facebook and I presume a lot of other sites present a warning on their landing page saying they can't recognise the browser and therefore it isn't compatible.
I suppose this is the privacy settings?

Would any of these pass over confidential details:
header_access From deny all
header_access Referer deny all
header_access Server deny all
header_access User-Agent deny all
header_access WWW-Authenticate deny all
header_access Link deny all

none of them pass the IP so do they really need to be on?