Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to create an encryption-only proxy server. By this I mean, from anywhere in the world I'd like all of the company's laptops' Internet traffic to be encrypted and routed through this single server. Caching would be nice, but not required; encryption between laptop and server are the only requirement.

What are some ways to accomplish this setup? I've been reading up on Squid, but didn't find too much information on encryption. I assume there would be some SSL or SSH involved, but I'm really new to this area. Browsers would be the primary user of the connection, though supporting IM and e-mail clients would be nice as well. The clients would be Windows and nix, while the server could be anything open source.

Edit: It's been made clear that a VPN would be a better solution than a proxy. Before I accept an answer, could somebody comment on this:

What happens when the laptops are plugged into another corporate network? For example, the consultants sit down at ABC Company's office. They need to bring up an intrAnet site like for whatever reason. I believe intranet DNS servers would normally resolve this correctly. If I'm connected to this VPN would this work? I understand a browser connecting to proxy would have the same problem, but you could have two browsers: one via proxy, one not. Or would this not be an issue with VPN?

share|improve this question
up vote 5 down vote accepted

I agree w/ pjz-- it sounds like you're looking for a VPN.

OpenVPN is a great, no cost method of getting started w/ VPNs. It's stable and ready for production use, but even if you don't end up using it, it's a good tool with which to get familiar with VPNs. It's really easy to setup with static keys (for playing around), and only marginally more difficult to setup with certificates (for production use).

You say "Internet traffic" in your question, but it's unclear if that just means browsing web sites, or literally all IP traffic to the Internet. You can pass a "default gateway" route down to the client w/ OpenVPN such that their Internet-bound traffic will route down the OpenVPN "pipe" to the server, which could then put it onto the Internet.

If you only wanted HTTP/HTTPS to be routed down the OpenVPN (i.e. if they PING, run Skype, etc, that traffic can go straight to the Internet), you might consider deploying something like Squid Cache, too, and then configuring client browsers to use that proxy server such that traffic to the proxy was routed down the OpenVPN "pipe" only (i.e. put the proxy on a VPN-accessible IP address, but leave the client's default gateway alone). (You could even do a 'push “dhcp-option 252 ...' to push out a proxy autoconfiguraiton URL to clients via OpenVPN, I believe.)

You've got some options, depending on what you want to do.

re: your comment to pjz about Intranet site access

You're going to have to "pay the piper" on this somehow.

If you're just routing all their Internet-bound traffic down the VPN via a default gateway changeup any traffic to web servers on-subnet with them would still "go direct". If the Intranet web server was on a different subnet, though, their traffic to that subnet would go down the OpenVPN pipe instead of to the on-site router. That'd be bad.

If you did my suggestion above of pushing down a proxy-autoconfiguration script to clients via OpenVPN (or some other means) you could put "exceptions" in that file to cause the clients to "go direct". I typically do that in proxy-autoconfiguration files with:

if ( isPlainHostName(host) ) { return "DIRECT"; }

This causes host names w/o any dots in them to be accessed directly.

If you know a particular host (or wildcard matching pattern) that needs to be directly accessed:

if ( shExpMatch(url,"http://*")) { return "DIRECT"; }
if ( shExpMatch(url,"")) { return "DIRECT"; }

If you know where your users were going to be working you can put in exceptions into the proxy-autoconfiguraiion file prior to the fact. If not, though, you're going to have to reactively deal with such issues. If you don't know beforehand, though, you're asking for a solution that can "do the right thing" automatically. Unfortunately, computers do a horrible job with that. >smile<

I'd take the extra time with whatever you deploy to use proxy-autoconfiguration files. It gives you a centralized method (that can be updated "on the fly" w/o touching client computers) to control diverting HTTP traffic to a proxy server or letting it go directly to the Internet. They're amazingly handy for this kind of application.

share|improve this answer
+1 for the mini-tutorial – squillman Jul 10 '09 at 13:06
Thank you. The requirements - like the question - are still very unclear and you're presenting some great options. – rcampbell Jul 10 '09 at 13:13
In case you didn't see it, while you were editing your question re: Intranet access I was dropping an edit on re: the same thing... >smile< – Evan Anderson Jul 10 '09 at 13:19
" could put "exceptions" in that file to cause the clients to "go direct". I typically do that in proxy-autoconfiguration files..." this is exactly what we're looking for. All the times when the clients would need to "go direct" are known Intranet servers, so we could perhaps put in an exception to go direct for * – rcampbell Jul 10 '09 at 13:28
I expounded on the "exceptions" to "go direct" a little bit. – Evan Anderson Jul 10 '09 at 13:36

Sounds like you want a VPN more than a proxy server - or at least, what you want is most easily accomplished with a VPN server that all the laptops connect to. A proxy server doesn't (except for some specific application servers) encrypt traffic between its clients and itself, while that's the raison d' etre of a VPN server.

As far as VPN servers themselves go, I've had good luck running openvpn with linux, windows and mac clients.

share|improve this answer

"I'd like all of the company's laptops' Internet traffic to be encrypted and routed through this single server."

"Browsers would be the primary user of the connection, though supporting IM and e-mail clients would be nice as well."

The service and functionality you described is a VPN, although some people think of their VPN as network hardware providing a network-level service, and do not refer to it as a "server".

The VPN is the way to go, because you are talking about securing all traffic at the network-level and redirecting it to a single service-providing host.

The VPN will work on private corporate networks when you visit their site, as long that network allows access to the public network (and does not happen to block access to your VPN host's IP addresses).

The only limitation is that most VPN client software is "all-or-nothing", they wrap all of the traffic from your system (essentially, they refuse to trust anyone else's local network services). If you need to work on the local network and your network, the hip/easy workaround is to run your VPN connection on a small virtualized system (like VMWare), and have your main/host OS access the local access normally.

As for (web) proxies:

A long time ago, there were several kinds of application proxies, but the internet has made the common usage of "proxy" to be "web proxy". These proxies generally do not use encryption, although they could. But they are "web/internet" focused, they usually proxy HTTP, HTTPS, FTP and Gopher. They cannot do email or IM.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.