I need an encrypted TCP connection from multiple clients to a single port over the internet. Can this be realized with Squid?
We use a monitoring and client management solution in our company which is accessible over LAN and VPNs. It should be now accessible from external notebooks which don't use the company VPN. The communication must be encrypted (TLS). The clients authentication must use clients certificates. The communication is initiated by the clients and uses a single TCP port.
Results of my investigations
NGINX Plus seems to offer this feature but our admin prefers squid or apache. At the squid wiki I found that: Feature: HTTPS (HTTP Secure or HTTP over SSL/TLS) where TCP encrypting is mentioned. But I also found this warning:
It is important to notice that the protocols passed through CONNECT are not limited to the ones Squid normally handles. Quite literally anything that uses a two-way TCP connection can be passed through a CONNECT tunnel. This is why the Squid default ACLs start with deny CONNECT !SSL_Ports and why you must have a very good reason to place any type of allow rule above them.
This question Encrypt client connection with squid forward proxy using SSL is simlar, but doesn't treat reverse proxies / TLS termination proxies.
What I need to know
I have only basic knowledge about that technologies and our admin asked me for general feasibility.
- Can Squid be used for save encrypting of TCP connections?
- Can this be realized using authentication with client certificates?
- Or should it be used only for HTTPS connections?