Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configure squid in pfsense 1.2.3, and was able to block http sites using a black list, but I was not able to block https sites.

Any solutions ?

share|improve this question

You can't proxy HTTPS with transparent proxying (see this).

But, of course, you may rebuild squid from sources for this MITM, like it described, for example, in this guide.

But I still don't understand why you can't lock sites with SSL encryption with squid - URLs aren't encrypted, and therefore you can add it to blacklist.

share|improve this answer
The first sentence there tells why. URLs are encrypted though. If you're MITMing the traffic it doesn't matter as that's part of what you're decrypting. But otherwise, it's impossible to see the URL in HTTPS. – Chris Buechler Jan 11 '13 at 8:55

I got the same problem. This is a loop hole in SQUID, the only solution that I can do is to use internal DNS and declare domains extensions in the DNS server. Nobody can send test ping, but they can access yahoo in the browser as long as the proxy settings in browser is correct.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.