2

I've got many servers, and I want them to have the same IP when they request via the Internet. So I configured a Squid HTTP proxy server that works well for HTTP requests. The problem is that it does not work for HTTPS requests (the actual IP of my server appears...).

Do you have a solution for that?

Improve this question
3
  • What is the base operating system that squid runs on..?? Meanwhile, I'd suggest you install webmin for easier view and configuration or if the purpose it to act as proxy server along with some enhanced features, pfsense will do better. Having said that, I found this by googling which may server you.
    – AzkerM
    Apr 14, 2014 at 12:25
  • can you show your squid configuration?
    – c4f4t0r
    Apr 14, 2014 at 12:54
  • My server runs on Debian 7. I'll try webmin ! And thanks for the link !
    – maxime
    Apr 16, 2014 at 13:29

3 Answers 3

Reset to default
0

You need to use the SSL Bump functionality of Squid in order to be able to filter HTTPS. An easy method to implement this is to use QLProxy as it has the SSL Bump functionality enabled by default.

If you'd like to add it to your existing configuration, you can research it here

SIDE NOTE : SSL was developed, in part, to issue assurances to the connecting party that they are connecting to the service that they are expecting to connect to. Intercepting this transmission, which is what you're trying to accomplish, will break the integrtity of HTTPS and issue certificate warnings to your clients. This can be mitigated by distributing a trusted certificate to all your clients, however there is an ethical issue at play here as you are essentially eavesdropping on traffic that your clients assume is secure.

Improve this answer
2
  • He doesn't need a transparent proxy.
    – Diego Woitasen
    Apr 15, 2014 at 17:00
  • @diegows perhaps you'd care to share what you think he needs then rather than just stating what they "don't" need.
    – DKNUCKLES
    Apr 16, 2014 at 12:47
0

Here is now my ssl-bump rules are setup and it works without a problem:

http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump connection-auth=off generate-host-certificates=on dynamic_cert_mem_cache_size=8MB cert=/etc/squid/ssl/squid.pem key=/etc/squid/ssl/squid.key cipher=ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/squid_ssl_db -M 8MB
sslcrtd_children 50 startup=5 idle=1
ssl_bump server-first all
ssl_bump none localhost

Then just set both HTTP and SSL proxy to the server and port 3128.

Improve this answer
0

If you only want to forward requests through a static IP, the basic squid config (without ssl_bump) should work fine.

You use it this way combined with ACL rules and authentication:

https_port 8443 cert=/etc/certs/proxy-fullchain.pem key=/etc/ssl/private/proxy.key

So I can request through proxy server this way:

curl --proxy https://user:[email protected]:8443 https://target.example.com

If you need to intercept the connection to apply rules based on its content, so you'll need to intercept SSL Interception

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .