Hi

I was wondering if it is possible to perform the following with https request:

1) using squid, perform content filtering using squidguard (meaning allow or block the website)

2) If it is allowed, bypass squid and let the https connection move along without interfere


The reason i want to do this is becase i would like to bypass the https traffic from squid in order to avoid the fuzz of proxying https but at the same time not lose the content filtering

Thanks

how can you possibly filter content with a service you are not using?!?!

Hello again acid_kewpie

As you can tell i am still messing around with squid and https ... well i was just trying to see if there is any "patent" that can be done.

For instance if squid could perform content filtering..some sort of firewalling a requested URL and if not in blacklist let it pass through...but as far as i understood by your replay my thought is not even logical ... rolf...

One last question

A friend of mine told me, which could be just silly rumors, that PFsense could successfully block any http/https traffic as well as handling properly https connections. Meaning that the user could type..for example, facebook.com and could access the site normally, and if you added facebook as black list it would then block it.

Are you aware of such function?

thanks

handling properly? what does that mean? PFsense uses squid for web proxying, so there's no special feature in that distro.

What you seem to be defining there is just straight forward ACL config.

What i mean "properly" is that it does the job i am trying to achieve but i just confirmed that it is a myth! As i found out by the below post

http://forum.pfsense.org/index.php?topic=62256.0


the pfsense box should act as a certificate authority

I "partially" found my problem & solution"

Squid3 can handle https by creating tunnels with the CONNECT method. When i opened the SSL port on my firewall and added the below (which in most cases is a default) it all worked flawlessly (it also blocks https sites from squidguard imports) !

The reason https CONNECT method was not working was/is because squid3 is "chained" with ziproxy. Squid3 forwards requests to ziproxy so i can have both content filtering and compression hence my new challenge now is how to make this CONNECT method of squid3 to worke wth ziproxy!

Thanks for the assistance

you can't. Read up (as I've previously urged you to) about what the CONNECT method is. It permits an encrypted tunnel between the browser and the end server meaning you can not filter the content.

Hi acid

i think i am using the wrong terminology since the biggining of the thread.
When i said content filtering i ment the service of squidguard, meaning the service where you filter which URLs should pass from the proxy.

I guess this is not content filtering.. :-S

the HOST is all that comes through a CONNECT method. You can filter the site as a whole, but you can't filter the PATH section of the URI, only the HOST.

Chris

the way my setup is now, i have:

|client (transparent)|------>|squid|------->|ziproxy|-----(internet/web)

(squid is "chained" to ziproxy)

do you know if it is possible to configure squid to use chain/request from ziproxy only for non-ssl pages (HTTP) and use CONNECT method without using ziproxy for HTTPS pages?

Thanks

Found it! I had to enter the below on my config file:

Now everything works as desired !

Thnaks alot for your help!!

But how you can block any https site. You already allow https request as I am seeing. #http_access allow CONNECT SSL_ports
+++++++++++++
Imtiaz
+++++++++++++

Hi Imtian

I am allowing https connections but prior that i am using squidguard to determine if the URL is in the blacklist, if it is, then it wont get through