2

I am trying to create a captive portal using WifiDog, AuthPuppy and Squid. We want to provide access only to a selected number of resources, e.g 2-3 websites and the App Stores (Apple and Google).

While blocking and allowing http requests is easy: WifiDog has an option to redirect http to a transparent proxy. I whitelisted the required urls and the rest is blocked. But is there a similar way to do this for secure (https) connections?

Thanks a million for any suggestions.

1

1 Answer 1

2

Not easily.

By default, HTTPS connections are encrypted and you can't pass them through a proxy... what you could do is filter them by the destination IP, by allowing only some addresses and denying everything else using the firewall; however some servers use virtual hosts and host different websites under the same IP, so if the same server hosts both a whitelisted site and a blacklisted one you can't block only one of them.

However, a solution is to have the user's consent to configure the Squid server's IP to be the browser's proxy, in which case the traffic is still encrypted (it will be tunneled using CONNECT requests through the proxy) but the destination hostname will be in plaintext and you will be able to apply ACLs to that.

So a possible solution would be to redirect all HTTP traffic to a page explaining how to set the proxy server's address on the device, and block direct HTTPS traffic. Once users configure the proxy on their device, they'll be able to browse the web by your rules.


Oh and irrelevant to your question, but instead of obnoxious captive portals, have you considered using EAP to authenticate your users (and provide an open network only for new users to register and get their EAP credentials) ?

1
  • sounds bad. a malicious http proxy can sniff and poison the traffic. filtering https could be achieved with a filtering socks5h proxy, see also nimSocks
    – milahu
    Nov 29, 2023 at 22:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .