Here's my network configuration:
The proxy server is running Ubuntu with Squid on port 3128 and DansGuardian on port 8080.
I'd like to force all clients to use the proxy server - specifically, port 8080 - for any HTTP/HTTPS access.
However, I don't want to transparently redirect because that doesn't work for HTTPS. I don't mind configuring each client, and I don't mind that each client knows it's using a proxy server. I just don't want the clients to be able to surf the web without the proxy settings.
How do I do this? Can I just drop packets if the client isn't configured to use the proxy server on port 8080?
I tried using iptables to drop packets that had a dport other than 8080, but that rejected too much I think and I could no longer access anything.
I re-wrote this question so that it's not iptables specific, but I am not against using iptables at all. I just want to attract a wider range of possible solutions.
I think I may have given some the wrong impression. Just to be clear, I'm not at all interested in filtering HTTPS traffic (i.e., looking taking packets apart at the proxy and inspecting the contents). I'm more interested in blocking sites with DansGuardian, whether it's over HTTP or HTTPS (by looking at the destination of the packets).
Based off of Alexandru-Florin Vintil's suggestion below, here's what I'm currently doing:
# Redirect HTTP traffic to port 8080 (DansGuardian) iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080 # Check TCP and UDP traffic against whitelist iptables -A FORWARD -i eth1 -p tcp --dport 443 -j whitelist iptables -A FORWARD -i eth1 -p udp --dport 443 -j whitelist # Drop all other HTTPS traffic iptables -A FORWARD -i eth1 -p tcp --dport 443 -j DROP iptables -A FORWARD -i eth1 -p udp --dport 443 -j DROP # Drop all traffic aimed straight at the proxy iptables -A FORWARD -i eth1 -p tcp --dport 3128 -j DROP iptables -A FORWARD -i eth1 -p udp --dport 3128 -j DROP iptables -A FORWARD -i eth1 -p tcp --dport 8080 -j DROP iptables -A FORWARD -i eth1 -p udp --dport 8080 -j DROP
In a nutshell, redirect HTTP traffic to port 8080, drop all HTTPS traffic that isn't whitelisted (in a separate chain), and drop all traffic that explicitly uses the proxy. Without the last rule, a client can access any website using HTTPS as long as they configure their browser to use the proxy, because then the destination port is 8080 and not 443. So even dropping all traffic bound to 443 doesn't block HTTPS altogether.