I'm thinking on setting a transparent caching proxy for that also handles SSL traffic, but as you may [obviously] know there's the certificate issue that makes it difficult...some devices requiring a wired config change, like the Apple TV or some devices not working altogether like cheap streamers or those that you setup in creative ways with an app hopping back and forth among SSIDs, like Amazon's Echo, Logitech's Harmony, speakers, Roku, etc. Anything not compatible with WPA2 Enterprise, basically.
So, I figured, what if the client seen by the server is not the actual client but in reality is the firewall doing NAT just in front of it, and that in turn is connected to a proxy, transparent or actually setting a regular proxy port 3128-type uplink, with the appropriate certs so there's the trust and no errors, therefore the real client wouldn't even know what's going on but just sees another hop to its destination.
Is this possible at all or just my wishful thinking? With every connection now being served over HTTPS, an HTTP cache is not that useful. I have tried to setup WPAD--if I'm not misspelling it--but my setup just won't allow it, besides, a transparent proxy sandwiched between firewalls, if it were possible, would required almost no setup, no route or NAT changes. Definitely no downtime.
In appliances like pfSense there's this external cache in the Squid package that goes to another server and back; virtualizing the servers and proxy in the same host would make the data processing super fast since it wouldn't touch a NIC. I'm really excited about my idea but before I do I'd really like to get informed since I'd be taking down a hypervisor to host the new servers.
Any advice is welcome and thanks!