Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configure squid in pfsense 1.2.3, and was able to block http sites using a black list, but I was not able to block https sites.

Any solutions ?

share|improve this question
add comment

2 Answers

You can't proxy HTTPS with transparent proxying (see this).

But, of course, you may rebuild squid from sources for this MITM, like it described, for example, in this guide.

But I still don't understand why you can't lock sites with SSL encryption with squid - URLs aren't encrypted, and therefore you can add it to blacklist.

share|improve this answer
    
The first sentence there tells why. URLs are encrypted though. If you're MITMing the traffic it doesn't matter as that's part of what you're decrypting. But otherwise, it's impossible to see the URL in HTTPS. –  Chris Buechler Jan 11 '13 at 8:55
add comment

I got the same problem. This is a loop hole in SQUID, the only solution that I can do is to use internal DNS and declare domains extensions in the DNS server. Nobody can send test ping yahoo.com, but they can access yahoo in the browser as long as the proxy settings in browser is correct.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.