Home / server / Questions / 807770
In Process
John
Asked: 2016-10-08 10:05:08 +0800 CST

Squid Not Blocking SSL HTTPS Properly

  • 772

So my goal here it to block only certain youtube channels.

If I do:

acl block_youtube dstdomain .youtube.com
http_access deny block_youtube

it blocks any access to youtube.

if I do:

acl block_youtube url_regex -i ^https://www.youtube.com/watch\?v=v2AC41dglnM
http_access deny block_youtube

it doesn't block that particular page, even though I see this in my access_log.

475862685.876      0 100.100.100.100 TAG_NONE/200 0 CONNECT www.youtube.com:443 - HIER_NONE/- -
1475862686.359    412 100.100.100.100 TCP_MISS/200 51182 GET https://www.youtube.com/watch\?v=v2AC41dglnM - HIER_DIRECT/216.58.192.238 application/json

Any one have any idea how to resolve this?

proxy squid blocking

2 Answers

  1. As the youtube you try to block is in HTTPS, you have a problem. The proxy don't decapsulate the HTTPS to know the URL and the content, so, it is able to drop the connection. To solve your problem, you must see the SSL Bump solution of Squid. It is not enable by default because of licence issues, but you can easily recompile the package. The problem of this solution is that the client must know the authority of certification used in the proxy, and this authority is local and allow to create a certificate for all the https sites. So you need to deploy the autority on all the PC.

    http://wiki.squid-cache.org/Features/SslBump

    • 1

  2. Did you figure out how to block the Youtube channels? I'm working on something similar. Regarding your regex, you can use a site like https://regex101.com/ to test your regex against string values.

    • 0