Transparent Proxy

[Michael]

Hello all,

 

Has anyone successfully setup a transparent proxy that will allow http, https and ftp with no configuration required on the client - including that of installing certificates or other?

 

If yes, what did you use - Centos, Ubuntu etc... and did you use Squid or TinyProxy for example?

 

And more crucially, can you provide instructions? I'm going round in circles and most of the online Wiki's are poorly written, don't work, are out of date or simply don't make any sense! Many thanks!

[DMcCoy]

I doubt it, you can't transparent proxy SSL, the best you can do is allow/deny the connection based on certificate domain info.

[SchoolsBroadband]

I doubt it, you can't transparent proxy SSL, the best you can do is allow/deny the connection based on certificate domain info.

 

 

Correct otherwise its not transparent

 

You can do man in the middle attacks if you install a certificate on each client though.

 

We use Lightspeed in transparent mode on our infrastructure and it works a treat.

 

Dave

[DMcCoy]

Correct otherwise its not transparent

 

You can do man in the middle attacks if you install a certificate on each client though.

 

We use Lightspeed in transparent mode on our infrastructure and it works a treat.

 

Dave

 

You can do MITM but I always felt it was a bit on the iffy side, even when I could have done it I didn't. It always seemed one step too far for me. Perhaps for a primary, and only for students is the time I might consider it.

 

Although no good in this instance, no client config

[Michael]

Thanks for confirming my suspicions - Wouldn't the alternative be to configure a firewall rule so 443 traffic bypasses the proxy altogether and goes straight to its destination? This would remove the need for both MITM and deploying a cert to all clients. The logic being the traffic is encrypted, so cannot be read anyway.

[craigw]

Can only speak for our setup - but it depends on what you are trying to filter and why.

With Bluecoat Proxy SG in transparent mode, the proxy is unable to see the header or URL request as the traffic is encrypted however it can see the IP of the destination. With most common sites (e.g. Facebook) this works OK as Bluecoat has a known IP list of face books servers and blocks without any need for SSL MITM. This works for most porn sites as well. The problem I have written about before is google. With the move of Google to nearly SSL for everything and with multiple services being served from the same IP addresses it is impossible to classify Google traffic as Search or Youtube or GAFE as it is all coming from the same IP range (at least that is how Bluecoat sees it). As such the only way we can get Bluecoat to do this is do a MITM for Google domains only and we can then filter traffic based on the URL and also inject the safe search URL appendage. Yes this does cause SSL errors and we have to push out the Bluecoat SSL cert using GPO as well as get the kids to manually install on their iPads. Painful - but until google gives us the option to bypass SSL for all google sites based on our school public IP - then I don't see an alternative.

Wally

[SchoolsBroadband]

@craigw you are right google has thrown up problems now they are all SSL.

 

This can still be sorted though. Get your DNS servers to force google to use the nossl option and then hey presto if your filtering product can support it you can enforce google safe search and do all the other lovely filtering you need. We do this by default on our infrastructure and it works very well indeed.

 

See https://support.google.com/websearch/answer/186669?hl=en

 

You then need to start thinking about blocking DNS access to other services such as opendns to ensure your clever pupils don't get round it that way

 

Feel free to contact me folks if you have any specific questions as we've a lot of experience with this.

 

Thanks

 

Dave

[exa_markd]

Yep Exa also support the nosslsearch DNS fix as we have a custom DNS service for SurfProtected customers..

 

Cheers

 

Mark

[tom_newton]

This is perfectly possible - you can easily transparently proxy HTTPS, and unless you want MITM, you won't need certs - but all you will get is domain names for blocking. I suspect Squid will do this out of the box - but you would need to be using version3, and I am not sure how common that is yet as standard on most distros.

 

It's even possible to use google's NOSSLsearch selectively without resorting to DNS...

[craigw]

David- the problem is two fold for us. Firstly this only addresses search - as according to google

"Utilizing the NoSSLSearch VIP will not affect other Google services outside of Search. Logging into Google Apps and authenticating to different services will continue to work (and will occur over SSL)."

 

So therefore we cannot filter SSL youtube traffic unless we do MITM.

 

Secondly as Bluecoat uses ISP DNS we are unable at present to add CNAME into the DNS records and confirmed with Bluecoat that they have nothing equivalent to a hosts file on the box that we could use instead.

Has anyone done this on their internal Windows 2008R2 AD integrated DNS? See this thread...I am not sure how you can get this to work

 

http://social.technet.microsoft.com/Forums/windowsserver/en-US/eebd5c3f-8d96-4014-9852-f3028c71d930/implementing-cname-wwwgooglecom-pointing-to-nosslsearchgooglecom-without-making-dns-server?forum=winserverDS

 

 

If someone has this running live I would be keen to see the config for the zone that you are using..

Cheers

Wally

[free780]

Can your mitm cert be a paid cert so it is already trusted?

[craigw]

The issue with MITM is not that it is a paid cert or not (I think) rather than that as a MITM process your browser says "hang on - this cert is saying it is from Google.com and it is NOT from google.com". Paid or not - your browser will still object until you install the cert effectively saying - hey no problems I still want to proceed and ignore the anomaly.

Wally