Hi,

I am having problems with squid. I am using squid as a transparent proxy where i specify the proxy server and port 3128 on my internet browser. I am able to block http sites effectively, but when it's an https site then it doesn't work. It used to work before, but not it suddenly doesn't.

Please help me.

thanks.

you can't block https with a transparent proxy by hostname as the hostname is never seen by the proxy in the first instance. You could only block by IP.

Transparent proxies are rubbish. They always seem good at the start, but they are rubbish. make it proxy data correctly and you'll be fine.

As i know if you add proxy address and port at your web browser even transparent parent proxy also act as a normal proxy.

There is no client configuration required. This is the most popular reason for configuring transparent proxy

why do you setup your proxy as a transparent proxy?


refer this following link
http://www.linuxquestions.org/questi...-proxy-701710/

Hmm, yeah I missed that bit... not very transparent then is it..?!

Hi,

thank you all for your replies. I have reconfigured squid.conf where it is;
http_port 3128

with a deny all statement (all sites denied)for testing

iptables configured to allow port 3128

specifiying the squid box with port 3128, i receive the access denied page but if i change the url to https, it doesn't work.

Please assist.


@acid_kewpie,

could you recommend a proxy data filter for me? Is there an application you know which i could set up as a transparent https and http proxy?

Thanks.

Hi,

Transparent proxy and https don't go together, it just doesn't work http://tldp.org/HOWTO/TransparentProxy-2.html#ss2.3. If you want to use Squid with https you'll have to go with the 'normal' proxy and more, you have to compile Squid with -enable-ssl because the packages installable by package managers don't come with SSL enabled standard.

Kind regards,

Eric

As I already said, you can't transparent proxy http, as there is no mention of the website being connected to until after the secure connection is established. So unless you terminate and reencrypt the traffic on the proxy, as per EricTRA's comment, there's no way for squid to ever know what site you're trying to connect to. If instead you do a direct proxy connection that the browser is aware of, they will send a "CONNECT www.domain.com:443" request to the proxy asking for a connection to the website, which *can* be filtered just fine.

Thanks acid_kewpie. If i use squid in intercept mode where in my squid box would have two NICs, one connected inside and the other outside, would this be an effective method in filtering http, https, ftp, p2p traffic. If not, could you recommend a more easily managed system to replace the squid.

Thanks again.

You seem to keep asking the same question, and I seem to keep answering it. Your "problems" are with the HTTPS protocol, not your choice of software. Squid is an http proxy, and is very good for http/https/ftp. For p2p etc... it's not applicable.

Hey acid_kewpie,

I hope you are as tough in real life as your replies. You see, you keep on telling me what the squid can't do and i keep on asking you, what are my alternatives. You can't seem to offer me any. Why don't you just say you don't know. In your original reply where you said transparent proxies are rubbish, you never said exactly what isn't rubbish.

Squid is not rubbish, it's by far the most prolific web proxy in the history of the internet. it's how you're using it, in a transparent mode, that is rubbish. I'm not offering you alternatives because you don't need alternatives, you need to use squid better.

Couldn't agree more acid_kewpie, well said.

If you want to use transparent proxy, then where is the use of proxy going to since it has no extra's to offer, no HTTPS, no authentication, just 'hiding' the fact that you have a proxy and cache and accelerate things.

If you really do want a transparent proxy, for whatever your reasons are you can have a look at this:
Howto 1
Howto 2
but don't use HTTPS in the same sentence with transparent proxy.

Just follow the advice already given and use Squid better.

Kind regards,

Eric

Off topic a bit, I'd never seen a mechanism to do auth on transparent proxies either, but where I currentlly work does do this. Whatever bits of tin they are using spoofs an HTTP connection as the desired domain, and demands authentication credentials apparently from that site, but with a description of "internet_authentication". Bit ugly and you end up having stored passwords for each site that you first connect to without a session (and it is of course a bog standard IP based session with timeout, no clever cookie interception possible I don't think). It's fairly ugly and you need to be careful how you use it, but at least once I authenticate in firefox, my tor and yum connections also get permitted through the proxies without configuring them, so that's something of a win.

Wow, that's a first for me. Didn't know that one. But seems that they at least have to set up some security since on a HTTP you can have man-in-the-middle issues very easy. But then again, if they had a need for it, coded it and use it, who am I to point a finger.

Kind regards,

Eric

Well I would think it's there for people who think that transparency is a good thing.... I was certainly there a few years back, but realised I was wrong before putting the money down. I would doubt that whilst pre-sales would love it, the developers of whatever product it is would not be so boastful after being forced to give in and code a hack as a feature.