0

We run a few society websites behind a University firewall that mandates that all traffic goes through an internal squid cache / proxy.

While export http_proxy= works perfectly in the shell I'm wondering if there's a similarly easy way to force PHP applications, such as MediaWiki and Wordpress to use and recognise that environment variable. We're running Debian 5.

I found a way to do it once without having to use a local transparent proxy... I just can't remember how.

2 Answers 2

2

This could be achieved through using iptables / netfilter http://www.netfilter.org/

2
  • I've gotten this far: iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination ###.###.###.###:3128 However as soon as that rule is added, the web site falls over as it forwards inbound traffic to the cache. Is there a way to modify that rule so that it only applies to outbound traffic?
    – oliland
    Jun 27, 2010 at 18:07
  • This works for HTTP, but isn't effective for HTTPS; the question is really asking for an application-level fix within PHP.
    – Paul Gear
    Aug 7, 2016 at 23:06
0

On the router, only allow outgoing port 80 connections (or possibly **all* ports) from the squid box (and other whitelisted servers). For preference you might want to think about how to prevent address spoofing (e.g. using IPSEC or a VPN between the whitelisted machines and the router).

C.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .