OpenForum RSS: squid+SSL+HTTPS+iptables+transparent

squid+HTTPS -transparent (Ruldik)

Tue, 29 Jan 2013 09:53:58 GMT

>[�� ]
> -A PREROUTING -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --sport 1024:65535
> --dport 80 -j REDIRECT --to-ports 3128
> -A PREROUTING -s 192.168.0.0/24 -i eth0 -p tcp -m tcp --sport 1024:65535
> --dport 443 -j REDIRECT --to-ports 3129
> * �� Ubuntu 10.04 LTS
> * ��
> * �� - ��.
> �� , �� . ��
> �� https. �� , ��
> � �� ӣ - �� !

��, �� . �� ?

squid+HTTPS -transparent (bamper)

Wed, 05 Dec 2012 11:54:40 GMT

>[�� ]
> �� , �� :
> �� squid �� 3128 � 3129. � firewall � prerouting
> �� 80 �� 3128. � forward tcp ��.
> ��: �� proxy �� squid ��
> �� . � ��, ��
> 3129 �� .
> squid.conf:
> http_port 10.1.2.2:3128 transparent
> http_port 10.1.2.2:3129
> �� :)

�� , �� . �� :
1. �� squid � �� '--enable-ssl' �� , � �� .

2. �� >= libssl0.9.6 �� :
openssl genrsa -out /etc/squid/ssl/squid.key
openssl req -new -key /etc/squid/ssl/squid.key -out /etc/squid/ssl/squid.csr
openssl x509 -req -days 3650 -in /etc/squid/ssl/squid.csr -signkey /etc/squid/ssl/squid.key -out /etc/squid/ssl/s

squid+HTTPS -transparent (��)

Thu, 25 Oct 2012 06:21:49 GMT

> �� !!!! �� ݣ �� !!!!

�� - �� .
http://www.d90.us/toolbox/2009/05/26/adding-ssl-support-to-squid-package-on-ubuntu/

squid+HTTPS -transparent (peering)

Thu, 02 Aug 2012 11:43:34 GMT

>[�� ]
>
>
> Enable Transparent Proxy support for Linux
>
>
> (Netfilter)
> --enable-linux-tproxy Enable real Transparent Proxy support for Netfilter
>
>
> TPROXY (version 2).

�� squid 3 �� debian6 c �� --enable-ssl,, �� : ��
6 - ./configure
7 - debuild -us -uc -b

��

dpkg-source --after-build squid3-3.1.6
dpkg-buildpackage: �� (�� )
Now running lintian...
warning: lintian's authors do not recommend running it with root privileges!
E: squid3: possible-gpl-code-linked-with-openssl
Finished running lintian.

�� !!!! �� ݣ �� !!!!

download squid sources:

apt-get source squid

download squid build dependencies:

apt-get build-dep squid

download sources for openssh:

apt-get build-dep openssh

download

squid+HTTPS -transparent (Prince)

Mon, 16 Jul 2012 12:04:02 GMT

> 1� �� ģ� �� "https_port 192.168.0.254:3129 transparent"
> WARNING: transparent proxying not supported
> quid -v
> Squid Cache: Version 3.1.19
> ...configure options: '--enable-ssl' '--with-openssl=/usr/local' '--enable-ssl-crtd'...

� ��:
--enable-linux-netfilter
Enable Transparent Proxy support for Linux
(Netfilter)
--enable-linux-tproxy Enable real Transparent Proxy support for Netfilter
TPROXY (version 2).

squid+HTTPS -transparent (ice)

Mon, 18 Jun 2012 11:25:39 GMT

1� �� ģ� �� "https_port 192.168.0.254:3129 transparent"
WARNING: transparent proxying not supported

quid -v
Squid Cache: Version 3.1.19
...configure options: '--enable-ssl' '--with-openssl=/usr/local' '--enable-ssl-crtd'...

squid+HTTPS -transparent (samson)

Tue, 06 Mar 2012 13:07:18 GMT

�� tcp_outgoing_address (�� ) (ACL �� )

>[�� ]
> -A FORWARD -i eth+ -j ACCEPT
> -A FORWARD -o eth+ -j ACCEPT
> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
> -A FORWARD -s xx.xx.xx.xx -j ACCEPT
> [root@inetguard ~]#
> �� , �� xx.xx.xx.xx �� eth0,
> � �� , �� 80 ��
> ��. �� (�� iptables �ӣ ��, ��
> ��).
> �� ?

squid+HTTPS -transparent (LKRM)

Thu, 01 Mar 2012 12:31:08 GMT

�� !
�� , �� :
�� ,�� Σ� squid �� iptables.
eth0 ��
eth1 � ��
eth2 � �� , ��
��, �� .��.��.�� eth2, �� squid, �� , � �� .
�� squid, �� eth1.

�� iptables ��:
iptables --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCE

squid+HTTPS -transparent (Aksel)

Sat, 19 Nov 2011 09:01:15 GMT

>[�� ]
>> �� .
> �� ( ��
> � ��, �� , iptables ��, sslproxy_flags DONT_VERIFY_PEER ��,
> � � �� 302 found
> ((
> ��
> �� 3.1.14, �� --enable-ssl
> openssl 1.0.0.e
> �� ? �� , � ��
> ��...

�� ...
�� ... �� ... �� , (�� 3) � �� ...
�� ?