Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Squid proxy 3.1, all systems in the LAN connects to the internet through proxy. Direct connection is blocked using the iptables from the gateway server.

There are some devices which does not have options for auto proxy or manual proxy and can only connect to the internet directly. So I enabled transparent proxy in Squid and redirected packets for port 80 and 443 to Squid proxy using iptables.

Now the problem is it is working fine for HTTP port but HTTPS is not working. It is throwing "ssl_error_rx_record_too_long" error.

If it is not possible through transparent proxy can you please suggest me another solution.

Warm Regards

Supratik

share|improve this question

1 Answer 1

up vote 5 down vote accepted

HTTPS traffic can not be redirected transparently to a proxy. You need to find a way to configure the proxy settings on your devices. If it is not feasible, you have to forward HTTPS traffic directly to the Internet.

share|improve this answer
    
If I allow direct connection to those devices I need to restrict their bandwidth also. Is there any way to limit bandwidth through iptables? –  Supratik Jan 13 '11 at 11:25
    
@Supratik: to handle bandwidth you use tc. it's all explained in lartc.org (linux advanced routing and traffic control). set aside a couple of days to read it all. –  Javier Jan 13 '11 at 12:11
    
Yes, of course. Have a look at tc. tldp.org/HOWTO/Adv-Routing-HOWTO. –  Khaled Jan 13 '11 at 12:13
    
Thanks guys for all the information. I googled on this topic for some more time and found a link (rahulpahade.com/content/squid-transparent-proxy-over-ssl-https), this explains how you can allow HTTPS through transparent proxy and it really works. Only the issue here is if you use the normal openssl certificate it will always prompt you to add it to your certification exception list. Since I don't want to purchase a certificate now I decided to go with tc. –  Supratik Jan 18 '11 at 6:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.