Currently, my IPtable indiscriminately sends all incoming request to my Squid transparent proxy. However, since I need SSL to work, I need a way to avoid intercepting SSL traffic.
- example.com -> IP= 100.100.100.1
- http access to example.com -> Send to Squid proxy
- https access to example.com -> Intercept request for 100.100.100.1:443; instead of sending it to Squid proxy, redirect it back to the ip of example.com 100.100.100.1
Is it possible to do this in iptable? Thanks!
Edit: I'm adding more information about my setup.
- DNS Server
- Squid Box
Due to specific requirement, I have to send traffic to the Squid transparent proxy using DNS redirection rather than typical router/gateway redirection.
- User Requests www.example.com
- DNS server points www.example.com to Squid Server
- Squid server intercepts www.example.com request
Current IP Table Rules
- Forward Port 80 to Port 3128 (Squid port)
- Forward Port 443 to Port 3128 (Squid Port)
Apparently, you are using a typical router/gateway to forward traffic to Squid, you can just forward port 80 and ignore 443 because 443 traffic will go directly, bypassing Squid.
Unfortunately, with my current setup, if I don't forward 443, any https connection will simply timeout.
The only solution now is to intercept all 443 request, map the each domain with each unique IP address, and send the request back to the original source IP.
I tried using Rinetd to forward 443 to the original website's IP address. Unfortunately, this method will forward all my 443 traffic to only 1 IP address because it won't differentiate the request IP.
I need to find a way to map each IP with each domain so when I visit gmail.com, it will forward to the IP of gmail; when I visit hotmail.com, it will forward me to the IP of hotmail.com