[squid-users] Transparent HTTPS Squid proxy does not work!

Bud Miljkovic bud_miljkovic at trimble.com
Mon Oct 16 18:51:46 UTC 2023


Let me try one more time.


Here is my system configuration:

{HW-Box} --> Local Server{ (eth0[port 444]) -----+

   |
          +-----------------------------------------------------+
          |
          |
          +-----> ([3129] Transparent Squid proxy) ---> (eth1[port443]) }--+

                                  |

 +------------------------------------------------------- ---+
                                     |
                                     +->--{ INTERNET Server }

The setup and the problem:
   - The HW box tries to establish an HTTPS transparent connection with a
server located within Internet.

   - It uses the Local Server and send its request via eth0 interface.

   - The request is Pre-routed from eth0, port 443, to the Transparent
Squid proxy (v3.5.25), listening at port 3129.

   - For testing purposes, the Squid proxy is configured to pass only the
HTTPS traffic transparently via the eth1 interface, using sing the
`tcp_outgoing_address <ip_addr>` directive.  Please see the squid-ota.conf
file content below.

   - While testing, I am monitoring the eth1 output via tcpdump and I get
the following:

     # tcpdump -i eth1 port 443 -n -X -q -w tcp_dump_24
       tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture
size 262144 bytes
       0 packets captured
       1 packet received by filter
       0 packets dropped by kernel
       3 packets dropped by interface

   - But nothing is detected!?

   - From the above it appears that there is no eth1 output at port 443?

I have included the printouts of the `iptables -nvL` and `iptables -nvL -t
nat` commands.

Can someone tell me what I have done wrong here and perhaps suggest a
solution?


Cheers,
Bud


=========================
Squid configuration file:

# 1) Visible hostname
visible_hostname ctct-r2

# 2) Initialize SSL database first
sslcrtd_program /usr/libexec/ssl_crtd -s /var/lib/ssl_db -M 4MB

# 3) Listen to incoming HTTP traffic
http_port 3128

# 4) Block all HTTP traffic
http_access deny all

# 5) Listen for incoming HTTPS traffic and intercept it
https_port 3129 intercept ssl-bump cert=/etc/squid/ssl_cert/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=4MB

# 6) Pass the SSL (HTTPS) traffic trasparently throught
ssl_bump splice all

# Do not use caching
# cache_dir ufs /var/volatile/log/squid/logs 100 16 256

# 7) Send out all HTTPS traffic to destination server via given IP address
tcp_outgoing_address 10.3.19.92

===============================================
# iptables -nvL

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination
 8827  680K ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0            ctstate RELATED,ESTABLISHED
    7   438 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0            icmptype 8 ctstate NEW
    2   138 ACCEPT     all  --  lo     *       0.0.0.0/0
0.0.0.0/0
    0     0 DROP       all  --  *      *       0.0.0.0/0
0.0.0.0/0            ctstate INVALID
1218K  299M APP_RULES  all  --  *      *       0.0.0.0/0
0.0.0.0/0            ctstate NEW
1218K  299M OS_RULES   all  --  *      *       0.0.0.0/0
0.0.0.0/0            ctstate NEW
  134 28053 REJECT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            reject-with icmp-port-unreachable
14014  841K REJECT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            reject-with tcp-reset
    0     0 REJECT     all  --  *      *       0.0.0.0/0
0.0.0.0/0            reject-with icmp-proto-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  wlan1  wlan1   0.0.0.0/0
0.0.0.0/0
    9   559 REJECT     all  --  *      *       0.0.0.0/0
0.0.0.0/0            reject-with icmp-host-unreachable

Chain OUTPUT (policy ACCEPT 39073 packets, 2757K bytes)
 pkts bytes target     prot opt in     out     source
destination
  125 11932 ACCEPT     all  --  *      *       10.3.19.92
0.0.0.0/0

Chain APP_RULES (1 references)
 pkts bytes target     prot opt in     out     source
destination
    0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:20
    0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:21
    0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:80

Chain DEV_RULES (2 references)
 pkts bytes target     prot opt in     out     source
destination
    5   300 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            tcp dpt:1534
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            tcp dpt:2345
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            udp dpt:1534
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            udp dpt:2345

Chain EXTERNAL_RULES (2 references)
 pkts bytes target     prot opt in     out     source
destination
1190K  298M DROP       all  --  *      *       0.0.0.0/0
0.0.0.0/0

Chain INTERNAL_RULES (2 references)
 pkts bytes target     prot opt in     out     source
destination
13930  794K ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            udp dpt:53
    8  2540 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            udp dpt:67
    1   328 ACCEPT     udp  --  *      *       0.0.0.0/0
0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            tcp dpt:80

Chain OS_RULES (1 references)
 pkts bytes target     prot opt in     out     source
destination
28092 1666K DEV_RULES  all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
    0     0 DEV_RULES  all  --  wlan1  *       0.0.0.0/0
0.0.0.0/0
28087 1666K INTERNAL_RULES  all  --  eth0   *       0.0.0.0/0
0.0.0.0/0
    0     0 INTERNAL_RULES  all  --  wlan1  *       0.0.0.0/0
0.0.0.0/0
1190K  298M EXTERNAL_RULES  all  --  eth1   *       0.0.0.0/0
0.0.0.0/0
    0     0 EXTERNAL_RULES  all  --  wlan0  *       0.0.0.0/0
0.0.0.0/0

=====================================================
iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT 1234K packets, 306M bytes)
 pkts bytes target     prot opt in     out     source
destination
   96  5760 REDIRECT   tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:443 redir ports 3129
13943  837K REDIRECT   tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:80 redir ports 3128

Chain INPUT (policy ACCEPT 13972 packets, 798K bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 62 packets, 4650 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain POSTROUTING (policy ACCEPT 14103 packets, 566K bytes)
 pkts bytes target     prot opt in     out     source
destination
    0     0 MASQUERADE  all  --  *      eth1    192.168.168.0/24
0.0.0.0/0
    0     0 MASQUERADE  all  --  *      eth1    192.168.192.0/24
0.0.0.0/0
    0     0 MASQUERADE  all  --  *      wlan0   192.168.168.0/24
0.0.0.0/0
    0     0 MASQUERADE  all  --  *      wlan0   192.168.192.0/24
0.0.0.0/0
==================================================

-- 
Budimir Miljković BSc E | He
Senior Development Engineer
Civil Construction Field Systems
Trimble

11-17 Birmingham Drive, Christchurch, Canterbury, 8024
New Zealand
+64 3 963-5550 Direct
+64 21 419-024 Mobile

www.trimble.com

This email may contain confidential information that is intended only for
the listed recipient(s) of this email. Any unauthorized review, use,
disclosure or distribution is prohibited. If you believe you have received
this email in error, please immediately delete this email and any
attachments, and inform me via reply email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20231017/f15c4145/attachment.htm>


More information about the squid-users mailing list