Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the following:

  1. Blacklist/whitelist domain names (not IP numbers). Content won't be filtered or modified at all.
  2. Force users through these lists. If I modify such settings in the web browsers, they can just undo it.

The following page tells I could pass the traffic unmodified, but it doesn't say how: iptables https transparent proxy with privoxy?

The following page shows an iptables rule for 443 which I myself couldn't get to work: http://alien.slackbook.org/dokuwiki/doku.php?id=slackware:proxy

The following page tells how to get this to work only with Squid: http://www.rahulpahade.com/content/squid-transparent-proxy-over-ssl-https

EDIT: One person says here: How do I use IPTABLES to create a HTTPS (443) passthrough around Squid? "The best thing for you to do is to block direct access to port 443 and tell your users that if they want to use HTTPS, they must configure their browser to use the proxy." But I just know how to block 443 completely, not to make it work under a proxy then.

share|improve this question
add comment

3 Answers 3

up vote 5 down vote accepted

If you want to filter on domain names, you have two possible ways: you could take the name from the CONNECT method issued by the client if it knows that it has to use a proxy for HTTPS conenctions and filter on that one (Squids supports that BTW). Or, if you really really need to do it transparently, you would need to look into the (encrypted) request headers.

If you want to see encrypted request headers, you need to have a key. If you want to have a key, you need a certificate which is a) trusted by the client to be the "correct" certificate and b) certifies every possible host (wildcard-everything).

So what you would need to do is

  1. set up a certificate for your proxy. It depends on your software how to do that - you might use stunnel to terminate the SSL connection at the proxy's side, have some filtering HTTP proxy behind it and re-establish SSL for all outgoing traffic using iptables DNAT targets and stunnel again. There might be "boxed" solutions for MitM SSL proxying as well.
  2. install the aforementioned certificate on all of your clients that are going use the proxy

Mostly, if you need transparent proxying it is because you do not want or cannot reconfigure the clients to use the proxy. If this is the case with your request as well, you probably would not have the option to install certificates on clients and mark them as "trusted". So even though there is a technical way for transparent SSL proxying, I suspect not much will be won for you.

share|improve this answer
    
This was enough to make it very clear to me the facts about transparent proxies. Thank you! –  Teresa e Junior Jun 17 '11 at 3:01
    
you're welcome. –  the-wabbit Jun 17 '11 at 6:56
    
How do you "... take the name from the CONNECT method issued by the client if it knows that it has to use a proxy for HTTPS conenctions and filter on that one"? –  Koveras May 22 '13 at 19:51
    
@davidkennedy85 with Squid pretty much the same way as you would filter for other access methods - just use the ACLs. Example: servercomputing.blogspot.de/2012/01/… –  the-wabbit May 22 '13 at 21:01
add comment

Delegate can work as Man-In-The-Middle proxy for HTTPS.

share|improve this answer
    
Thank you, it does indeed, but I couldn't get it to work! It seems it needs different iptables rules than the ones for port 80, or there's some option I can't figure out for Delegate. –  Teresa e Junior Jun 17 '11 at 4:38
add comment

For transparent mode, Inline IPS (Suricata, Snort) system can help you to block ssl sites.

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux

Block SSL Site Rules for Specific User:

drop ip any 443 -> 192.168.3.x any (content:".facebook.com"; msg:"Simplewall block facebook.com ";sid:7;rev:1;)

drop ip any 443 -> 192.168.3.204 any (content:".youtube"; msg:"Simplewall block youtube.com" ;sid:4;rev:1;)

Block File Download Rules Based on Extensions:

drop ip any any -> 192.168.3.63 any (msg:"File exe block"; fileext:"exe"; filestore ;sid:1;rev:1;)

drop ip any ssl -> 192.168.3.63 any (msg:"File mp3 block"; fileext:"mp3"; filestore ;sid:11;rev:1;)

drop ip any ssl -> 192.168.3.63 any (msg:"File pdf block"; fileext:"pdf"; filestore ;sid:21;rev:1;)

Try this out with Simplewall

Its very very simple to add block rule with Simplewall web interface.

You can also add rules under Simplewall => Content Filter use same rules for IPS along with http content filter.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.