Tag Info

Hot answers tagged

8

Use netsed and iptables proxying. iptables -t nat -D PREROUTING -s yourhost -d desthost -p tcp --dport 80 -j REDIRECT --to 10101 then run: netsed tcp 10101 desthost 80 s/text-A/text-B Netsed: http://silicone.homelinux.org/projects/netsed/ NetSED is a small and handy utility designed to alter, in real time, the contents of packets forwarded through your ...


7

One big disadvantage to using a transparent proxy is that you're unable to force users to authenticate prior to gaining access without resorting to something more complex like a captive portal: http://en.wikipedia.org/wiki/Captive_portal You then risk breaking lots of tools that have no problem running properly configured with a regular proxy, and force ...


7

The issues you're seeing are the same that prevent the use of multiple certificates on a single IP address/port (without using Server Name Indication). In plain HTTP, your transparent proxy can tell which host the client wants to connect to by looking into the Host header. When the HTTPS MITM transparent proxy gets the request, it can't know which host ...


5

HTTPS traffic can not be redirected transparently to a proxy. You need to find a way to configure the proxy settings on your devices. If it is not feasible, you have to forward HTTPS traffic directly to the Internet.


5

If you want to filter on domain names, you have two possible ways: you could take the name from the CONNECT method issued by the client if it knows that it has to use a proxy for HTTPS conenctions and filter on that one (Squids supports that BTW). Or, if you really really need to do it transparently, you would need to look into the (encrypted) request ...


5

Actually you CAN use nginx as a transparent proxy http://pastebin.com/BDt2fXxF We are using nginx as proxy in my company since about 10 minutes and it's working perfect up to now (I'll see how to enable caching later).


5

You can do exactly this by using iptables to transparently proxy connections through a squid proxy, and then having squid re-write the http content for you.


5

Most likely their content filter, edge devices, or DNS servers are registering a lot of hits to chat.google.com (or whatever). If you're using SSL, then it's likely that they're only monitoring what you're connecting to and not the content of the chat itself.


4

The standard FOSS solution is squid with dansguardian or squidguard. The one thing to keep in mind about the transparent proxies, is that you cannot easily transparently proxy https. These days more and more of the bypass-proxies you find on the internet are using https. As for blacklists, this link seems to have a good list. It isn't free but we use ...


4

There are two approaches to MITMing SSL traffic: You get a single trusted SSL certificate that wildcards everything (subjectAltName:*, subjectAltName:*.*, and so on); or You get a trusted CA or intermediate certificate and create trusted certificates "on the fly" to present to clients. The former is easier to do, but the latter is better if you don't ...


3

YouTube has recently added support for caching their videos. This is specific for YouTube (ie. Viddler probably doesn't work for example), but it should also work with Squid with no extra modification.


3

First give it a read on this answer here. You will have to configure your firewall and use other means to provide proxying like automatic configuration. IPV6 doesn't provide any NAT so there's no interception of traffic, ergo no transparent proxying. Squid wiki has a Tproxy patch but seems like a hack to me, you can try but I never tested. Other solutions ...


3

Transparent proxies are also less good at handling https - the two options are to use SNI (which requires a recent browser) which will give accurate domain information, which can be used for monitoring, blocking or kicking off some sort of MITM, and reverse-dns which is possibly accurate enough for monitoring and not much else.


3

Just some basic info about this topic. There are only a few devices that I know of that can succesfully pull off this action. However they are not really available to the common public. I myself am using a Fortinet Fortigate with SSL Offloading. What it basically does is; it intercepts the SSL Connection made to the host and decrypts the connection in ...


3

I am not sure,but please take a look with this checklist: Edit the the squid.conf file and change the following line to enable transparent proxy mode: http_port 3128 to http_port 3128 intercept service squid restart service squid reload Add an entry to iptables NAT table to port-forward inbound traffic on the inside interface (LAN side) to the ...


2

Got it! I'm not sure if it's a bug in Snow Leopard, or some new security feature. But someone posted to the sshuttle mailing list the fix to the problem, which is simply this: sysctl -w net.inet.ip.scopedroute=0 Running that command makes the above set of commands (in the question posted above) work correctly as it did in MacOS 10.5. Thus, transparent ...


2

Particularly if you're allowing people to use their own computer, I don't know if a proxy is going to be any better from an anti-circumvention standpoint. There are lots of ways to work around proxies. If you want to prevent overuse, I think you're better off doing something at the network hardware level to keep people from connecting for too long in the ...


2

I've used SmoothWall as a gateway and transparent proxy, along with the Dan's Guardian module to implement filtering. Dan's Guardian is particularly nice, because it's out of the box configuration is fairly safe/strict, but doesn't rely on black/white lists (but those are available if you need them). There's a bandwidthd module that I've used for monitoring ...


2

It's not necessarily the ideal solution but I run ipCop and use the Advanced Proxy add-on to cache updates from an array of sources along with WSUS. It works brilliantly. The disadvantage is the add-on only works with ipCop and Smoothwall, but I feel it is worth mentioning.


2

I did a quick search and stumbled across this: http://www.lagado.com/proxy-test Maybe give that a shot?


2

If the request does not show up in the IIS logs then it is being served by a cache somewhere, either the client's local cache or a cache (proxy) somewhere in the request chain. Look at the response headers for a request on the client end and see if there are any Via: headers in there. A Via: header indicates that there is a proxy in the chain and there ...


2

Another one is that you can not bypass them. If your proxy is stuck or soemthing, the user can not just try to load a site without.


2

Delegate can work as Man-In-The-Middle proxy for HTTPS.


2

You can't do this. Nginx is a reverse proxy, and what you a describing is a forward proxy. Squid or Polipo are examples of these (although Squid can also be used as a reverse proxy).


2

Well transparent proxies don't work for SSL traffic unless you deploy an alternative trusted root to each device, so you lose many security and auditing benefits there, and introduce new ones. I would go with option 2, but using an explicit proxy, fire-walling everything else off. If internal machines don't use your proxy, they don't get access to the ...


2

I wouldn't bother setting up a transparent proxy. Instead simply run Squid on 127.0.0.1:3128 and then use the Net::HTTP::Proxy stuff for your API calls. Documentation here. I don't recommend pumping everything through a proxy to start, but moving over specific calls until you get comfortable with the setup. In regards to sizing your Squid cache, if you ...


2

Meowbify is in fact open source, so you can take a look at the code on github and inspire yourself as need be: https://github.com/mobify/meowbify It uses a pretty simple means of encoding the desired URL: cat/cats to designate http or https protocol, then the original hostname, then .meowbify.com, and then the path and query string as they are in the ...


2

Try this -- http://www.squid-cache.org/ The site is well documented and you will find a lot of resources online.


2

As far as I can tell tinyproxy simply does not support incoming HTTPS connections. It will permit you to access HTTPS sites by using the CONNECT method, but for that to be used, the browser/client must know that it is talking to a proxy server, and use the correct connection methods. The ConnectPort directives simply defines which ports it is permissible ...


2

No, you would not have to replace your firewall with the proxy. Your proxy should complement your firewall's services, not replace it. In order to ensure that all of your systems pass through the web proxy to browse the internet you would 1) configure the browser or operating system of each client to use the proxy. This is commonly done with either GPOs or ...



Only top voted, non community-wiki answers of a minimum length are eligible