Proxy settings routing at hardware level

[exonetsystems]

Hi all, bit of an odd idea but hopefully this is feasible!

 

Our current ISP is the SWGfL, which we need not comment on *ahem*

 

We have enabled the transparent proxy service, but are finding it extremely unreliable. Having spoken to the powers that be, we've agreed that it does seem a step backward to start entering proxy settings again, even if it does make the connection outside more reliable!

 

I was thinking late last night (I'm sad like that) that maybe there was a way we could route all network traffic through another router or some other hardware device which had the SWGfL proxy embedded into it, sitting in between our network and the Cisco router that SWGfL provide.

 

I'd love to know if this is possible, and if anyone has done it before. Or just generally any input or advice on this topic would be helpful!

 

Thanks in advance!

[ijk]

Yes, you can use Squid to do this. Search for "Squid upstream proxy" or "cache peer".

[exonetsystems]

Yes, you can use Squid to do this. Search for "Squid upstream proxy" or "cache peer".

 

Thanks for your reply, will look into this!

[Jawloms]

I'm vaguely interested in this too. I thought I'd read somewhere that if you do this the clients get grumpy when you're using https as they can 'see' something in the middle and they warn you about certificates and the like. Is that correct?

[ijk]

I'm vaguely interested in this too. I thought I'd read somewhere that if you do this the clients get grumpy when you're using https as they can 'see' something in the middle and they warn you about certificates and the like. Is that correct?

 

For general proxying:

 

If it is just proxying then the proxy software can simply pass data between the client and the destination server.

 

If it is decrypt/inspect/encrypt then the proxy will present a dynamically generated certificate to the client on behalf of the server the client is attempting to reach. The proxy itself will have received/inspected/validated the certificate it received from the destination server.

 

For the latter to work the clients must trust the proxy, i.e. its CA certificate should be installed on the client.

 

In this case:

 

On reflection, I think there are going to be problems - authentication/filtering/transparent or not/trust of the upstream proxy - which make it unworkable. We have an internal proxy here, so I'm going to give it a whirl...

[exonetsystems]

For general proxying:

 

If it is just proxying then the proxy software can simply pass data between the client and the destination server.

 

If it is decrypt/inspect/encrypt then the proxy will present a dynamically generated certificate to the client on behalf of the server the client is attempting to reach. The proxy itself will have received/inspected/validated the certificate it received from the destination server.

 

For the latter to work the clients must trust the proxy, i.e. its CA certificate should be installed on the client.

 

In this case:

 

On reflection, I think there are going to be problems - authentication/filtering/transparent or not/trust of the upstream proxy - which make it unworkable. We have an internal proxy here, so I'm going to give it a whirl...

 

Hmm, yeah I see your point - much like the RM SSL certificate for Google search results. Not sure how it would handle things like that.

 

I'm going to speak to the SWGfL tomorrow if I get a chance, and see what they think. I mean my idea was basically some sort of router that we provide (not the SWGfL) that would have the SWGfL proxy embedded into it (proxy.swgfl.org.uk:8080) and route all traffic through it. I know it can be done with a VPN on most 'business' routers, so I would like to think the idea was at least feasible.

 

I'll see what take the SWGfL has on my idea, and if they can help in anyway but installing this method or something similar inside their Cisco routers that they give to the school?

 

I'm liking the idea of Squid, although having a PC or server sitting in between the LAN and WAN is a little scary. Saying that, a router could fail anytime, often without any means of recovery if backups weren't taken - at least you'd stand a chance of data recovery with a PC or server!

[Duke5A]

Our content filters are provided by the local government and are thus external. I wound up setting up a couple of Squid proxy servers (one for staff and the other student) and configuring the outside content filter as an upstream cache peer. Squid is setup to use Kerberos authentication so it can log web traffic by AD username and it is configured on the clients by means of a proxy pac file. It's actually been in place for four years now and I've never had any issues with it.

[ijk]

^ There you go.

[exonetsystems]

Our content filters are provided by the local government and are thus external. I wound up setting up a couple of Squid proxy servers (one for staff and the other student) and configuring the outside content filter as an upstream cache peer. Squid is setup to use Kerberos authentication so it can log web traffic by AD username and it is configured on the clients by means of a proxy pac file. It's actually been in place for four years now and I've never had any issues with it.

 

Very interesting! Especially the reliability, which is obviously a huge factor with anything that gets in the way of an internet connection these days! I have been looking into Proxy PAC files, and am going to be experimenting with them when we get the new server, although my ideal goal is to not have any client/server configuration - to have it basically act like your internet connection at home, as logging nor separate routes for staff/students and necessary in this particular instance.

 

I just need to learn a little about Squid now, as I have to say it looks to be slightly out of my depth!

 

Thanks for your continued help all!

[ijk]

my ideal goal is to not have any client/server configuration

 

In my experience clients experience fewer problems when they know that they are behind a proxy because the responses they get back from their requests match their expectations.

[exonetsystems]

In my experience clients experience fewer problems when they know that they are behind a proxy because the responses they get back from their requests match their expectations.

 

Makes absolute sense! Well I've got lots to play with and research, so thanks for all your help!

[Duke5A]

Very interesting! Especially the reliability, which is obviously a huge factor with anything that gets in the way of an internet connection these days! I have been looking into Proxy PAC files, and am going to be experimenting with them when we get the new server, although my ideal goal is to not have any client/server configuration - to have it basically act like your internet connection at home, as logging nor separate routes for staff/students and necessary in this particular instance.

 

I just need to learn a little about Squid now, as I have to say it looks to be slightly out of my depth!

 

Thanks for your continued help all!

 

Don't let Squid scare you. Setting it up for Kerberos can be tricky, but as a basic cache peer it's really simple. I used a minimal install of Ubuntu (shell only) and installed everything I needed from the repositories. You can host your proxy PAC off of the same box by installing Apache.

[exonetsystems]

Don't let Squid scare you. Setting it up for Kerberos can be tricky, but as a basic cache peer it's really simple. I used a minimal install of Ubuntu (shell only) and installed everything I needed from the repositories. You can host your proxy PAC off of the same box by installing Apache.

 

Thanks for the reassurance! I think I'm going to give the PAC and WPAD deployment a go first - seems like it may simpler! But I will report back if that doesn't work and I manage to do anything with Squid in my spare time (ha)!

 

Thanks for your help!