12
votes
Accepted
What exactly is a "transparent reverse proxy"?
Here it means that Caddy doesn't modify the request by stripping out the HTTP Host header when passing the request to your web server in Docker container.
These can be the reasons why it is required ...
- 36.1k
7
votes
Accepted
What is the best way to get PRECISE domain name from ip address logged in iptables log
I'm not sure i get the whole picture but since you are writing about websites i think you are using a tool that is not exactly suitable for the task.
imho you are looking for that information (the ...
- 262
6
votes
Configure squid 3.5 to use different parent proxies for different listening ports
Thanks for help, finally found working configuration (thanks guys from squid mailing list)
http_port 3128 name=port_3128
http_port 3127 name=port_3127
nonhierarchical_direct off
acl port_3128_acl ...
- 211
6
votes
Accepted
HAProxy TCP Transparent Mode Remote Servers
Transparent mode requires that the haproxy be the default gateway of the backend servers. Remote servers won't work.
- 23k
5
votes
What is the best way to get PRECISE domain name from ip address logged in iptables log
You are tackling this problem at the wrong layer. Literally, layer 4 when you should use layer 7.
Don't log TCP connections in iptables. Instead, capture HTTP traffic and inspect the Host header in ...
- 12.6k
5
votes
What is the best way to get PRECISE domain name from ip address logged in iptables log
You cannot easily determine what the user typed into their browser's URL bar using just an IP address log: You can't tell if someone accessing 104.16.13.13 got there by typing aviation.stackexchange....
- 79.6k
5
votes
What's the difference between transparent proxy and explicit proxy
How proxies work
How a transparent proxy works
The browser thinks it is talking to the web server, and the proxy intercepts this traffic, and performs whatever tasks it needs to.
How an explicit ...
- 1,126
5
votes
Migrate web server to new datacenter and new IP
I use the following migration process in these cases:
Change DNS TTL to minimum value
Wait for DNS TTL to update
Copy keys / certificates to new server
Put site to maintenance mode
Synchronise files/...
- 36.1k
4
votes
transparent SSL proxy myths and facts
I know this is an old question, but if the OP only wants to blacklist/whitelist certain domain names, they don't have to use a proxy at all, they could just use a DNS based blacklist.
setup your ...
- 2,615
4
votes
Accepted
How to forward HTTPS traffic through squid transparently?
but all the ones I found describe the creation of a certificate pair to decrypt/re-encrypt the traffic - something I do not want to do.
What you are asking for simply isn't possible because of how ...
- 130k
4
votes
NAT routing based on DNS name (reverse TCP proxy?)
Doing any kind of proxying based on the DNS hostname used also requires that the application protocol carries the host header in some way.
To my knowledge there are no such headers involved in FTP, ...
- 19.6k
4
votes
Accepted
Proxy Protocol with Nginx Reverse Proxy
You are looking in the wrong direction:
The listen 443 ssh http2 proxy_protocol; directive (cf. listen) enables the parsing of the Proxy Protocol on incoming connections. Your browser does not speak ...
- 5,547
3
votes
Accepted
Block HTTPS Traffic with Transparent Proxy Setup
Well... There is a lot to say about your iptables rules (for exemple the state ESTABLISHED should be first)... But about the specific problem you are asking for, remember that INPUT is for incoming ...
- 66
3
votes
Nginx transparent reverse proxy for https and http to another server
You simply need a new server block with the server_name set to the second domain and a proxy_pass in the location. If you need it to be https you can list either another certificate, or the same ...
- 31.2k
3
votes
Accepted
Transparent proxying a single docker container to another docker container
Thank you all for your time to answer. Basically what I'm trying to do is to proxy the outgoing/originated traffic of the 2nd container (NOTE: I'm NOT trying to proxy the incoming traffic, so cannot ...
3
votes
Local transparent proxy
Yes, it is possible. You can use policy routing in Linux machine to redirect traffic to squid proxy as shown in this page.
To summarize the steps:
Setup mangle rule in iptables to mark traffic to be ...
- 36.2k
3
votes
Squid Proxy using HTTPS
You need to compile the squid from source code with --enable-ssl-crtd --with-openssl, or simply install squid from this ppa https://github.com/diladele/squid-ubuntu, it already compiled with ssl ...
- 131
3
votes
Accepted
Nginx stream block with wildcard filtering of subdomains
You are looking for the hostnames keyword. With this keyword you can use *.example.com as a wildcard entry for example.com domain. Similarly as for server_name directive you can use .example.com for ...
- 2,616
2
votes
Transparent proxy and HTTPS with squid
We have implemented HTTPS filtering with squid cache using the SNI. It works well in the transparent SSL mode. ACLs are implemented as well. We have integrated the squid box with Cisco ASA as WCCP ...
- 21
2
votes
Accepted
Transparent squid proxy on ubuntu 14.04 server
This is quite simple given you already have a Ubuntu machine with 2+ NICs - you just need to have more or less recent Squid installed; all machines in your network must be using Squid box as default ...
- 534
2
votes
iptables with transparent proxy, how to pass the user IP
with this method you can avoid NAT packet alterations.
at iptables box
iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s squid-box
iptables -t mangle -A PREROUTING -j MARK --set-mark 3 ...
- 3,409
2
votes
Is HAProxy built with TPROXY on Ubuntu 14.04
Run haproxy -vv and look and look for OPTIONS = USE_LINUX_TPROXY=1
The packaged haproxy for ubuntu 14.04 is NOT built with TPROXY
- 199
2
votes
pfsense(2.3.1_5) Squid transparent proxy redirects internally hosted sites from http to https
It's not that Squid is changing it from HTTP to HTTPS, it's that NAT reflection doesn't apply to traffic initiated by the host itself (which is the case for Squid). Traffic from the LAN hosts would ...
- 2,978
2
votes
Local transparent proxy
No, it's not possible. You have to use nat if you wanna redirect traffic:
# iptables -A OUTPUT -t nat -p tcp --dport 80 -j DNAT --to 127.0.0.1:3128
- 1,226
2
votes
How to configure squid4 as transparent proxy?
Your iptables nat table should look like this:
-A OUTPUT -o lo -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i wlan0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A ...
- 5,547
2
votes
Accepted
Why an iptables NAT does not happen in the network namespace separated transparent proxy setup?
I have to assume that the transparent proxy is acting as a router, at least for ICMP, so will route back the ICMP echo where it came from (veth0).
Finding the problem
When reproducing your setup and ...
- 9,670
2
votes
Migrate web server to new datacenter and new IP
You may first want to decide (or estimate) what you want to sacrifice when you are moving:
Ease of the transition (if a lot of the points below are important, the transition will be a project instead ...
- 614
1
vote
Squid: curl: (52) Empty reply from server
Basically, one can run two kinds of (HTTP) proxies:
Normal: you need to configure each client (i.e. browsers) for using
it.
Transparent: Don't demand configuration, the hosts' traffic is
sent to ...
- 265
1
vote
Squid: curl: (52) Empty reply from server
You are hitting your proxy via curl not telling curl to use the proxy.. Try this
http_proxy=http://your.proxy.server:3120/ curl http://ya.ru
You can make it perminate for the session by
export ...
- 22.2k
Only top scored, non community-wiki answers of a minimum length are eligible