0

I installed and configured squid proxy as transparent proxy server. when i tried using firefox the proxy server works fine and i can access both ports https and http. but when i transparnet, i can access https websites only like https://google.com not http://google.com

Here is my squid.conf look like:

acl our_networks src 192.168.20.0/24
http_access allow our_networks
#Recommended minimum configuration:
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
#
acl SSL_ports port 443          # https
acl SSL_ports port 563          # snews
acl SSL_ports port 873          # rsync
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 631         # cups
acl Safe_ports port 873         # rsync
acl Safe_ports port 901         # SWAT
acl purge method PURGE
acl CONNECT method CONNECT


http_port 3128 transparent
icp_port 0

And here is my IPtable config 

$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.20.21:3128
#$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

What did I miss here? I'm running squid 2.7 stable 9

Thanks,

user169601
  • 1
  • 1
  • Heh. It means HTTPS is opening ok basically just due to you haven't intercepted it with Squid. – poige Apr 15 '13 at 17:26

1 Answers1

1

You're missing basic understanding of SSL :)

Transparent proxying of SSL connections is not possible, as your proxy will not be able to present the correct certificate, causing all browsers to display certificate warnings about every https website.

Besides that, your proxy config is also rather unsafe (it allows anyone from 192.168.20.0/24 to connect to any port anywhere) and you forgot to redirect port 443 (though as I said, it will only result in errors on the client).

Dennis Kaarsemaker
  • 19,277
  • 2
  • 44
  • 70