Home / server / Questions / 775736
Accepted
WoJ
Asked: 2016-05-10 11:58:58 +0800 CST

How to forward HTTPS traffic through squid transparently?

  • 772

I want to redirect all HTTP and HTTPS traffic to squid acting as a transparent proxy. This traffic will then be blocked or authorized (in bulk) during certain hours. Specifically I do not want to decrypt/reencrypt HTTPS traffic but push it as it.

The HTTP part works, a REDIRECT rule in shorewall transfers all traffic intended for destination port 80 to the listening 3128 squid port in transparent mode.

The same trick for port 443 does not work.

There are tutorials on how to set up transparent proxy for HTTPS traffic, but all the ones I found describe the creation of a certifcate pair to decrypt/reencrypt the traffic - something I do not want to do.

The squid wiki mentions CONNECT as a way to tunnel HTTPS traffic, but adding http_access allow CONNECT all to the configuration (and disabling the default deny) does not change anything.

Then some previous answers suggest that transparent HTTPS traffing is not possible without breaking the TLS tunnel.

Therefore: is there a way to configure squid so that HTTPS traffic rerouted to it via iptables is then transparently transferred, without any modification?

(I would just eventually block when some time rules are met (this is to say the the block is not going to be based on anything within the HTTPS stream itself))

squid https transparent-proxy

2 Answers

  1. Best Answer

    but all the ones I found describe the creation of a certificate pair to decrypt/re-encrypt the traffic - something I do not want to do.

    What you are asking for simply isn't possible because of how the https protocol works. Your options are:

    • Permit outgoing https through your firewall, and don't attempt to use any proxies
    • Configure clients to use your proxy/filter, and they will use HTTP CONNECT calls to the proxy.
    • Setup your proxy to be a man in the middle, and do sslbump.

    I would just eventually block when some time rules are met

    You can with the correct iptables modules filter based on the time of day. Perhaps you should just handle the time of day filtering in your firewall?

    • 4

  2. Two steps：

    1. install redsocks and make configuration to redirect any TCP connection (https connection is based tcp) from the listen port to HTTPS proxy port（HTTP/CONNECT eg. your squid http proxy port）
    2. build iptables with NAT,and redirect all connections to the listen port of redsocks you've set above(you could find examples in redsocks docs)

    However, for udp connections, redsocks has poor performance，you could try ss-redir as an alternative(TPROXY kernel module is needed).

    • 1