<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello, <br class="">So what I am trying to accomplish here is to basically have a whitelist of domains that is allowed via http/https. If the UID is squid,apache, or root then basically you will bypass squid and anything is allowed. This was working well on 3.4.2 however once I moved to 3.5.10 it no longer works properly. I also noticed that there are “new” features peek,slice etc which is probably my issue since I was not using it. I have tried several combination and have only gotten it to work for http traffic. All https traffic is currently being blocked by the configuration. Below are my configurations. I don’t need to "inspect" any of the traffic just want to have a whitelist of allowed domains if you are not UID squid,apache, or root via http/https. Any help would be appreciated !!<br class=""><br class=""><br class="">##### IPTABLES<br class="">$iptables -L -t nat<br class="">Chain PREROUTING (policy ACCEPT)<br class="">target prot opt source destination<br class=""><br class="">Chain POSTROUTING (policy ACCEPT)<br class="">target prot opt source destination<br class=""><br class="">Chain OUTPUT (policy ACCEPT)<br class="">target prot opt source destination<br class="">natoutlogaccept tcp -- anywhere anywhere multiport dports http,https owner UID match squid<br class="">natoutlogaccept tcp -- anywhere anywhere multiport dports http,https owner UID match apache<br class="">natoutlogaccept tcp -- anywhere anywhere multiport dports http,https owner UID match root<br class="">REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 3401<br class="">REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 4827<br class=""><br class="">Chain natoutlogaccept (3 references)<br class="">target prot opt source destination<br class="">LOG all -- anywhere anywhere LOG level debug prefix `nat out iptables accept '<br class="">ACCEPT all -- anywhere anywhere<br class=""><br class=""><br class="">##### Squid.conf<br class=""><br class="">sslproxy_cert_error allow all<br class="">sslproxy_flags DONT_VERIFY_PEER<br class="">sslcrtd_program /usr/lib64/squid/ssl_crtd -s /home/squid/ssl_db -M 4MB<br class="">sslcrtd_children 50<br class=""><br class="">https_port 4827 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/certs/squid.aarp.org.crt key=/etc/squid/certs/squid.key<br class=""># HTTPS forward port<br class="">https_port 127.0.0.1:6887 cert=/etc/squid/certs/squid.crt key=/etc/squid/certs/squid.key<br class=""><br class="">http_port 3401 transparent<br class=""># HTTP forward port<br class="">http_port 127.0.0.1:6886<br class=""><br class="">logformat squid %tl.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %[un %Sh/%<a %mt<br class="">access_log /var/log/squid/access.log squid<br class=""><br class="">always_direct allow all<br class="">cache deny all<br class="">cache_dir ufs /home/squid/cache 100 16 256<br class=""><br class="">acl step1 at_step SslBump1<br class="">acl step2 at_step SslBump2<br class="">acl step3 at_step SslBump3<br class="">acl nobumpSites ssl::server_name "/etc/squid/allowed_domains/allowed_domains"<br class=""><br class="">ssl_bump peek step1 all<br class="">ssl_bump splice nobumpSites<br class="">ssl_bump bump<br class=""><br class="">acl http proto http<br class="">acl https proto https<br class=""><br class="">acl port_80 port 80<br class="">acl port_443 port 443<br class=""><br class="">http_access allow http port_80 nobumpSites<br class="">http_access allow https port_443 nobumpSites<br class=""><br class="">http_access deny all<br class=""><br class="">##### allowed_domains<br class="">.<a href="http://cnn.com" class="">cnn.com</a><br class="">.<a href="http://google.com" class="">google.com</a><br class="">.<a href="http://facebook.com" class="">facebook.com</a><br class="">….etc <br class=""><br class="">#### squid log<br class="">TAG_NONE/403 350 HEAD <a href="https://www.facebook.com/" class="">https://www.facebook.com/</a> - HIER_NONE/- text/html<br class="">TCP_MISS/200 593 GET <a href="http://www.cnn.com/" class="">http://www.cnn.com/</a></body></html>