Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Consider a firewalled network with the high-level requirement that normal web browsing should work, but nothing else (e.g. ssh and skype are forbidden). (Incoming connections are denied as a matter of course.)

What should be done to HTTP CONNECT traffic? At one extreme, it could allow everything through, which would make the firewall ineffective. At the other extreme, it could be blocked: would this completely block HTTPS? (Assume the firewall is not going to play man-in-the-middle hoping that clients wouldn't notice the fake certificates.)

In other words, what is the practical “normal” use of CONNECT, and what is a good approximation of restricting its use to the “normal” cases?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

HTTP CONNECT is intended for tunnelling and is not required. Blocking CONNECT has no impact on normal sites which generally handle GET, HEAD, and POST requests. Blocking of this sort would assume deep inspection of packets. A web proxy might be a more appropriate tool for this than a firewall.

HTTPS will not be blocked by blocking CONNECT. The encryption wraps the connection and the requests passes over the encrypted channel. As a result you won't be able to block CONNECT requests within HTTPS connections.

share|improve this answer
    
Thanks, you've answered the question I asked. Which I now realize is not at all the question I meant to ask. –  Gilles Sep 28 '10 at 18:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.