I know the SSL issue has been beaten to death

I'm using DNS redirect to force my clients to use my intercept proxy. As we all know, intercepting HTTPS connection is not possible unless I provide a fake certificate. What I want to achieve here is to allow all HTTPS requests connect directly to the source server, thus bypassing Squid:

  • HTTP connection> Proxy by Squid
  • HTTPS connection> Bypass Squid and connect directly

I spent the past few days goolging and trying different methods but none worked so far. I read about SSL tunneling using the CONNECT method but couldn't find any more information on it.

I tried a similar method in using RINETD to forward all traffic going through port 443 of my Squid back to the original IP of www.pandora.com. Unfortunately, I did not realize all other HTTPS requests are also forwarded to the IP of www.pandora.com. For example, https://www.gmail.com also takes me to https://www.pandora.com

Since I'm running the Intercept mode, the forwarding needs to be dynamic and match each HTTPS domain name with proper original IP. Can this be done in Squid or iptables?

Lastly, I'm directing traffic to my Squid server using DNS zone redirect. For example, a client requests www.google.com, my DNS server directs that request to my Squid IP, then my transparent Squid will proxy that request. Will this set up affect what I'm trying to achieve? I tried many methods but couldn't get it to work.

Any takes on how to do this?

  • 1
    Wouldn't it be easier to just not intercept port 443 connections in the first place? (or have I missed someting?) – SmallClanger Jun 26 '11 at 22:32
  • @ SmallClanger , can you tell me how not to intercept 443 connections? By default, all web request are routed to my Squid using DNS redirecting. I will be a very happy man if you can show me how to not intercept 443. Thank you!! – Nicolo Jun 27 '11 at 2:31

As long as your dns server responds with the squids IP for all queries, the traffic will go there.

There are other ways other than responding with the squids IP for dns queries using redirects, like Cisco's WCCP, netfilter's redirect and surely similar mechanism for most other firewalls and routers.

  • So there is no way to allow SSL pass through under the DNS method? I can't use other firewall method to redirect traffic because the scenario I'm using is not a corporate network. My clients are scattered all over the world. My competitor is using the same method but he was able to allow https access with valid SSL certificate (i.e. no warning). – Nicolo Jun 27 '11 at 12:16
  • @Nicolo you tell your users that all domain names resolve to your Squid server. While Squid can inspect unencrypted traffic to see the intended destination of HTTP/1.1 requests (but not HTTP/1.0 traffic which doesn't mandate a Host: header) it is impossible for Squid to decrypt HTTPS traffic to find out the intended destination. So no matter what you do it is game over if you give fake IP addresses via DNS to your clients. Interception is usually done via redirect rules on a router (e.g. Linux and iptables). This is why you are being queried as to why you don't just redirect port 80. – PP. Aug 15 '13 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.