1

Is is possibile to use a transparent proxy to filter some domains without a man-in-the-middle approach? I would like to guarantee the certificate verification and user privacy, by other hand, I want to deny connection to some domain.

Is it possibile with a transparent proxy? Is it possibile with squid3?

3 Answers 3

2

A transparent proxy, by definition, sits man-in-the-middle. The client is unaware that the proxy exists and sends its requests to SSL-based sites as TCP SYNs to destination port 443.

If you specify the proxy explicitly the client will use the CONNECT verb (since it knows there's a proxy being used), which Squid access control lists (ACLs) can act upon.

No transparent proxy can reliably apply access control without doing man-in-the-middle. The best you can hope for would be acting upon the destination IP address which, frankly, will just give you headaches because you'll need to constantly maintain the list of IPs.

5
  • Ok, can I set up a gateway server to filter https connection to some domain? I don't need to cache https content, but just to filter it. If I'm not wrong the domain of https packet is not crypted.
    – Tobia
    Nov 11, 2014 at 12:09
  • If I am understanding you, you're asking if you can setup a traditional proxy and specify it explicitly for clients to use. If you specify the proxy (non-transparent) then the client will send the domain name unencrypted in CONNECT request. Nov 11, 2014 at 12:34
  • I need a transparent proxy (or firewall) to filter http and https connection, I don't need to get https content, just to filter it by hostname destination. How can be encrypted the hostname in https packet? How a gateway can redirect the connection?
    – Tobia
    Nov 11, 2014 at 12:41
  • @Tobia - I've done all I can. We have a language barrier here and neither of us are going to overcome it. Nov 11, 2014 at 12:48
  • I did not understand if you are speaking about my bad english (in this case I'm sorry, I will work on it) or about the tecnical terms confusion between proxy and firewall. You gave me a useful answer: a transparent proxy can not manage https without decrypting it, so I thought maybe for https I need something different from a proxy like a firewall to check just the hostname of the connection. Anyway thank you for your answer.
    – Tobia
    Nov 11, 2014 at 13:54
2

As Evan Anderson said in his answer, if you manually set the proxy in browsers then they'll make HTTPs go through the proxy (using CONNECT requests) and because the hostname in these requests is sent unencrypted you'll be able to apply ACLs to it.

However, currently there's nothing that forces the clients to use your proxy, so while you can't make it transparent you can outright block all direct HTTP/HTTPS connections and tell your users that they should use the proxy if they want to browse the web.

2

We have implemented HTTPS filtering with squid cache using the SNI. It works well in the transparent SSL mode. ACLs are implemented as well. We have integrated the squid box with Cisco ASA as WCCP server and its in production.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .