<div dir="ltr">I have installed squid as my router and below are my iptable rules<div><br></div><div><div> 675 39972 DNAT tcp -- eth1 * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:80 to:<a href="http://192.168.0.200:3127">192.168.0.200:3127</a></div><div> 0 0 REDIRECT tcp -- eth0 * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:80 redir ports 3127</div><div> 0 0 REDIRECT tcp -- eth0 * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:443 redir ports 3129</div><div> 2022 120K DNAT tcp -- eth1 * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:443 to:<a href="http://192.168.0.200:3129">192.168.0.200:3129</a></div><div><br></div><div>Chain INPUT (policy ACCEPT 7028 packets, 770K bytes)</div><div> pkts bytes target prot opt in out source destination </div><div><br></div><div>Chain OUTPUT (policy ACCEPT 2317 packets, 146K bytes)</div><div> pkts bytes target prot opt in out source destination </div><div><br></div><div>Chain POSTROUTING (policy ACCEPT 2317 packets, 146K bytes)</div><div> pkts bytes target prot opt in out source destination </div><div> 5923 688K MASQUERADE all -- * eth0 <a href="http://192.168.0.0/24">192.168.0.0/24</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, May 17, 2016 at 4:21 PM, admin <span dir="ltr"><<a href="mailto:admin@tisiz72.ru" target="_blank">admin@tisiz72.ru</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="font-size:10pt;font-family:Verdana,Geneva,sans-serif">
<p>I have the same config, but in my logs domain names</p>
<p> </p>
<div> </div>
<p> </p>
<p>Reet Vyas писал 2016-05-17 15:48:</p><div><div class="h5">
<blockquote type="cite" style="padding:0 0.4em;border-left:#1010ff 2px solid;margin:0">
<div dir="ltr">
<div dir="ltr" style="font-size:12.8px">Here is my txt file, as of now its working but I am getting secure connection failed, I want to know if we can customize error message like Access Denied .
<div> </div>
<div>In logs I am not getting full URL PFA logs for same. What I have to change in peek and splice ssl bump to get full URL ?</div>
</div>
<div style="font-size:12.8px">
<div><img src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif" alt=""></div>
<div> </div>
<div>Logs:</div>
<div> </div>
<div>
<div>3481340.025 0 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://31.13.79.220:443" target="_blank">31.13.79.220:443</a> - HIER_NONE/- -</div>
<div>1463481340.037 0 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://31.13.79.220:443" target="_blank">31.13.79.220:443</a> - HIER_NONE/- -</div>
<div>1463481352.675 98653 192.168.0.11 TCP_TUNNEL/200 4567 CONNECT <a href="http://74.125.68.100:443" target="_blank">74.125.68.100:443</a> - ORIGINAL_DST/<a href="http://74.125.68.100" target="_blank">74.125.68.100</a> -</div>
<div>1463481403.492 240049 192.168.0.188 TCP_TUNNEL/200 244 CONNECT <a href="http://216.58.199.133:443" target="_blank">216.58.199.133:443</a> - ORIGINAL_DST/<a href="http://216.58.199.133" target="_blank">216.58.199.133</a> -</div>
<div>1463481403.519 240205 192.168.0.188 TCP_TUNNEL/200 244 CONNECT <a href="http://74.125.130.189:443" target="_blank">74.125.130.189:443</a> - ORIGINAL_DST/<a href="http://74.125.130.189" target="_blank">74.125.130.189</a> -</div>
<div>1463481411.577 240235 192.168.0.66 TCP_TUNNEL/200 1832 CONNECT <a href="http://74.125.68.239:443" target="_blank">74.125.68.239:443</a> - ORIGINAL_DST/<a href="http://74.125.68.239" target="_blank">74.125.68.239</a> -</div>
<div>1463481411.688 240430 192.168.0.66 TCP_TUNNEL/200 766 CONNECT <a href="http://74.125.68.100:443" target="_blank">74.125.68.100:443</a> - ORIGINAL_DST/<a href="http://74.125.68.100" target="_blank">74.125.68.100</a> -</div>
<div>1463481411.940 240038 192.168.0.66 TCP_TUNNEL/200 502 CONNECT <a href="http://216.58.199.141:443" target="_blank">216.58.199.141:443</a> - ORIGINAL_DST/<a href="http://216.58.199.141" target="_blank">216.58.199.141</a> -</div>
<div>1463481415.391 240029 192.168.0.66 TCP_TUNNEL/200 502 CONNECT <a href="http://216.58.220.5:443" target="_blank">216.58.220.5:443</a> - ORIGINAL_DST/<a href="http://216.58.220.5" target="_blank">216.58.220.5</a> -</div>
<div>1463481418.469 240252 192.168.0.66 TCP_TUNNEL/200 518 CONNECT <a href="http://74.125.68.132:443" target="_blank">74.125.68.132:443</a> - ORIGINAL_DST/<a href="http://74.125.68.132" target="_blank">74.125.68.132</a> -</div>
<div>1463481419.003 240197 192.168.0.66 TCP_TUNNEL/200 502 CONNECT <a href="http://74.125.200.138:443" target="_blank">74.125.200.138:443</a> - ORIGINAL_DST/<a href="http://74.125.200.138" target="_blank">74.125.200.138</a> -</div>
<div>1463481421.151 240041 192.168.0.66 TCP_TUNNEL/200 143096 CONNECT <a href="http://216.58.199.131:443" target="_blank">216.58.199.131:443</a> - ORIGINAL_DST/<a href="http://216.58.199.131" target="_blank">216.58.199.131</a> -</div>
<div>1463481421.196 59328 192.168.0.11 TCP_TUNNEL/200 786 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463481421.758 240647 192.168.0.66 TCP_TUNNEL/200 464 CONNECT <a href="http://216.58.199.131:443" target="_blank">216.58.199.131:443</a> - ORIGINAL_DST/<a href="http://216.58.199.131" target="_blank">216.58.199.131</a> -</div>
<div>1463481445.844 282774 192.168.0.188 TCP_TUNNEL/200 1423 CONNECT <a href="http://74.125.130.189:443" target="_blank">74.125.130.189:443</a> - ORIGINAL_DST/<a href="http://74.125.130.189" target="_blank">74.125.130.189</a> -</div>
<div>1463481446.091 282893 192.168.0.188 TCP_TUNNEL/200 2418 CONNECT <a href="http://216.58.199.133:443" target="_blank">216.58.199.133:443</a> - ORIGINAL_DST/<a href="http://216.58.199.133" target="_blank">216.58.199.133</a> -</div>
<div>1463481470.715 59069 192.168.0.11 TCP_TUNNEL/200 1395 CONNECT <a href="http://216.58.199.206:443" target="_blank">216.58.199.206:443</a> - ORIGINAL_DST/<a href="http://216.58.199.206" target="_blank">216.58.199.206</a> -</div>
<div>1463481470.729 58778 192.168.0.11 TCP_TUNNEL/200 7609 CONNECT <a href="http://216.58.199.206:443" target="_blank">216.58.199.206:443</a> - ORIGINAL_DST/<a href="http://216.58.199.206" target="_blank">216.58.199.206</a> -</div>
<div>1463481482.663 62472 192.168.0.11 TCP_TUNNEL/200 3000 CONNECT <a href="http://216.58.199.165:443" target="_blank">216.58.199.165:443</a> - ORIGINAL_DST/<a href="http://216.58.199.165" target="_blank">216.58.199.165</a> -</div>
<div>1463481505.775 334542 192.168.0.66 TCP_TUNNEL/200 59071 CONNECT <a href="http://216.58.199.131:443" target="_blank">216.58.199.131:443</a> - ORIGINAL_DST/<a href="http://216.58.199.131" target="_blank">216.58.199.131</a> -</div>
<div>1463481512.946 240206 192.168.0.66 TCP_TUNNEL/200 470 CONNECT <a href="http://74.125.130.101:443" target="_blank">74.125.130.101:443</a> - ORIGINAL_DST/<a href="http://74.125.130.101" target="_blank">74.125.130.101</a> -</div>
<div>1463481513.057 240084 192.168.0.66 TCP_TUNNEL/200 886 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463481513.574 240132 192.168.0.66 TCP_TUNNEL/200 1116 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463481514.156 240036 192.168.0.66 TCP_TUNNEL/200 454 CONNECT <a href="http://216.58.199.129:443" target="_blank">216.58.199.129:443</a> - ORIGINAL_DST/<a href="http://216.58.199.129" target="_blank">216.58.199.129</a> -</div>
<div>1463481542.096 5675 192.168.0.11 TCP_TUNNEL/200 686 CONNECT <a href="http://162.213.33.48:443" target="_blank">162.213.33.48:443</a> - ORIGINAL_DST/<a href="http://162.213.33.48" target="_blank">162.213.33.48</a> -</div>
<div>1463481546.586 59549 192.168.0.11 TCP_TUNNEL/200 493 CONNECT <a href="http://216.58.199.131:443" target="_blank">216.58.199.131:443</a> - ORIGINAL_DST/<a href="http://216.58.199.131" target="_blank">216.58.199.131</a> -</div>
<div>1463481569.729 398494 192.168.0.66 TCP_TUNNEL/200 2523 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463481574.930 240032 192.168.0.66 TCP_TUNNEL/200 464 CONNECT <a href="http://216.58.220.3:443" target="_blank">216.58.220.3:443</a> - ORIGINAL_DST/<a href="http://216.58.220.3" target="_blank">216.58.220.3</a> -</div>
<div>1463481578.959 240248 192.168.0.66 TCP_TUNNEL/200 1220 CONNECT <a href="http://74.125.130.94:443" target="_blank">74.125.130.94:443</a> - ORIGINAL_DST/<a href="http://74.125.130.94" target="_blank">74.125.130.94</a> -</div>
<div>1463481614.460 444470 192.168.0.66 TCP_TUNNEL/200 13976 CONNECT <a href="http://216.58.199.133:443" target="_blank">216.58.199.133:443</a> - ORIGINAL_DST/<a href="http://216.58.199.133" target="_blank">216.58.199.133</a> -</div>
<div>1463481631.174 460024 192.168.0.66 TCP_TUNNEL/200 5641 CONNECT <a href="http://74.125.200.189:443" target="_blank">74.125.200.189:443</a> - ORIGINAL_DST/<a href="http://74.125.200.189" target="_blank">74.125.200.189</a> -</div>
<div>1463481753.303 303648 192.168.0.11 TCP_TUNNEL/200 2801 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463481759.694 240237 192.168.0.11 TCP_TUNNEL/200 829 CONNECT <a href="http://216.58.199.206:443" target="_blank">216.58.199.206:443</a> - ORIGINAL_DST/<a href="http://216.58.199.206" target="_blank">216.58.199.206</a> -</div>
<div>1463481761.126 261752 192.168.0.11 TCP_TUNNEL/200 205262 CONNECT <a href="http://216.58.199.129:443" target="_blank">216.58.199.129:443</a> - ORIGINAL_DST/<a href="http://216.58.199.129" target="_blank">216.58.199.129</a> -</div>
<div>1463481762.066 269470 192.168.0.11 TCP_TUNNEL/200 177618 CONNECT <a href="http://216.58.199.129:443" target="_blank">216.58.199.129:443</a> - ORIGINAL_DST/<a href="http://216.58.199.129" target="_blank">216.58.199.129</a> -</div>
<div>1463481762.241 276758 192.168.0.11 TCP_TUNNEL/200 1451680 CONNECT <a href="http://216.58.199.165:443" target="_blank">216.58.199.165:443</a> - ORIGINAL_DST/<a href="http://216.58.199.16" target="_blank">216.58.199.16</a></div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, May 17, 2016 at 3:33 PM, Reet Vyas <span><<a href="mailto:reet.vyas28@gmail.com" target="_blank">reet.vyas28@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Here is my txt file, as of now its working but I am getting secure connection failed, I want to know if we can customize error message like Access Denied .
<div> </div>
<div>In logs I am not getting full URL PFA logs for same. What I have to change in peek and splice ssl bump to get full URL ?</div>
</div>
<div>
<div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, May 17, 2016 at 3:21 PM, admin <span><<a href="mailto:admin@tisiz72.ru" target="_blank">admin@tisiz72.ru</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-size:10pt;font-family:Verdana,Geneva,sans-serif">
<p> </p>
<p>get your blocked_https.txt</p>
<p> </p>
<div> </div>
<p>Reet Vyas писал 2016-05-17 14:47:</p>
<div>
<div>
<blockquote style="padding:0 0.4em;border-left:#1010ff 2px solid;margin:0">
<div dir="ltr">Hi
<div> </div>
<div>Below is my squid configuration </div>
<div>
<div><br>Squid : 3.5.13</div>
<div>OS ubuntu 14.04</div>
</div>
<div> </div>
<div> </div>
<div>
<div>http_port 3128</div>
<div>http_port 3127 intercept</div>
<div>https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_certs/squid.crt key=/etc/squid/ssl_certs/squid.key cipher=ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH</div>
<div> </div>
<div>always_direct allow all</div>
<div>sslproxy_cert_error allow all</div>
<div>sslproxy_flags DONT_VERIFY_PEER</div>
<div>acl blocked ssl::server_name "/etc/squid/blocked_https.txt"</div>
<div>acl step1 at_step SslBump1</div>
<div>ssl_bump peek step1</div>
<div>ssl_bump terminate blocked</div>
<div>ssl_bump splice all</div>
<div>sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/squid/ssl_db -M 4MB</div>
<div>sslcrtd_children 16 startup=1 idle=1</div>
<div>sslproxy_capath /etc/ssl/certs</div>
<div>sslproxy_cert_error allow all</div>
<div>ssl_unclean_shutdown on</div>
</div>
<div> </div>
<div>I want to block <a href="http://facebook.com" target="_blank">facebook.com</a> so I have added url in .txt file.</div>
<div> </div>
<div>Its not blocking anything.</div>
<div> </div>
<div>Please let me know what I have to change in this configuration</div>
<div> </div>
<div>I getting below logs in squid</div>
<div> </div>
<div> </div>
<div>
<div>1463478160.585 551 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478160.585 550 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478161.147 562 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478161.147 561 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478163.982 553 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478163.982 552 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478163.994 565 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478163.994 564 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478184.338 182900 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://106.10.137.175:443" target="_blank">106.10.137.175:443</a> - HIER_NONE/- -</div>
<div>1463478184.338 182898 192.168.0.66 TCP_TUNNEL/200 6040 CONNECT <a href="http://geo.query.yahoo.com:443" target="_blank">geo.query.yahoo.com:443</a> - ORIGINAL_DST/<a href="http://106.10.137.175" target="_blank">106.10.137.175</a> -</div>
<div> </div>
<div> </div>
<div>1463478194.373 61 192.168.0.66 TCP_MISS/204 233 GET <a href="http://www.gstatic.com/generate_204" target="_blank">http://www.gstatic.com/generate_204</a> - ORIGINAL_DST/<a href="http://216.58.199.163" target="_blank">216.58.199.163</a> -</div>
<div>1463478209.166 240232 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://74.125.200.239:443" target="_blank">74.125.200.239:443</a> - HIER_NONE/- -</div>
<div>1463478209.166 240231 192.168.0.66 TCP_TUNNEL/200 5603 CONNECT <a href="http://translate.googleapis.com:443" target="_blank">translate.googleapis.com:443</a> - ORIGINAL_DST/<a href="http://74.125.200.239" target="_blank">74.125.200.239</a> -</div>
<div>1463478209.200 240267 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - HIER_NONE/- -</div>
<div>1463478209.200 240266 192.168.0.66 TCP_TUNNEL/200 4962 CONNECT <a href="http://clients4.google.com:443" target="_blank">clients4.google.com:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463478213.443 181611 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://31.13.79.246:443" target="_blank">31.13.79.246:443</a> - HIER_NONE/- -</div>
<div>1463478213.443 181611 192.168.0.66 TCP_TUNNEL/200 8547 CONNECT <a href="http://graph.facebook.com:443" target="_blank">graph.facebook.com:443</a> - ORIGINAL_DST/<a href="http://31.13.79.246" target="_blank">31.13.79.246</a> -</div>
<div>1463478224.432 33 192.168.0.66 TCP_MISS/204 233 GET <a href="http://www.gstatic.com/generate_204" target="_blank">http://www.gstatic.com/generate_204</a> - ORIGINAL_DST/<a href="http://216.58.199.131" target="_blank">216.58.199.131</a> -</div>
<div>1463478231.727 555 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478231.727 555 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478232.311 572 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://107.170.47.181:443" target="_blank">107.170.47.181:443</a> - HIER_NONE/- -</div>
<div>1463478232.311 571 192.168.0.66 TAG_NONE/503 0 CONNECT <a href="http://freevideodownloader.co:443" target="_blank">freevideodownloader.co:443</a> - HIER_NONE/- -</div>
<div>1463478246.369 13073 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://74.125.200.189:443" target="_blank">74.125.200.189:443</a> - HIER_NONE/- -</div>
<div>1463478246.369 13072 192.168.0.66 TCP_TUNNEL/200 4546 CONNECT <a href="http://0.client-channel.google.com:443" target="_blank">0.client-channel.google.com:443</a> - ORIGINAL_DST/<a href="http://74.125.200.189" target="_blank">74.125.200.189</a> -</div>
<div>1463478246.369 13806 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://216.58.199.142:443" target="_blank">216.58.199.142:443</a> - HIER_NONE/- -</div>
<div>1463478246.369 13805 192.168.0.66 TCP_TUNNEL/200 4604 CONNECT <a href="http://clients5.google.com:443" target="_blank">clients5.google.com:443</a> - ORIGINAL_DST/<a href="http://216.58.199.142" target="_blank">216.58.199.142</a> -</div>
<div>1463478265.935 119576 192.168.0.66 TAG_NONE/200 0 CONNECT <a href="http://106.10.199.11:443" target="_blank">106.10.199.11:443</a> - HIER_NONE/- -</div>
<div>1463478265.935 119576 192.168.0.66 TCP_TUNNEL/200 8586 CONNECT <a href="http://geo.yahoo.com:443" target="_blank">geo.yahoo.com:443</a> - ORIGINAL_DST/<a href="http://106.10.199.11" target="_blank">106.10.199.11</a> -</div>
<div>1463478327.555 41 192.168.0.66 TCP_MISS/200 2323 GET <a href="http://www.gstatic.com/chrome/crlset/3006/crl-set-delta-3005-260733898557562236.crx.data" target="_blank">http://www.gstatic.com/chrome/crlset/3006/crl-set-delta-3005-260733898557562236.crx.data</a> - ORIGINAL_DST/<a href="http://216.58.220.3" target="_blank">216.58.220.3</a> text/html</div>
</div>
<div> </div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, May 13, 2016 at 4:37 PM, Amos Jeffries <span><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 13/05/2016 5:58 p.m., Reet Vyas wrote:<br> > Hi Amos/Yuri,<br> ><br> > Currently my squid is configured with ssl bump, now I want to use peek and<br> > splice. I read in some forum that we don't need to install certificate on<br> > client's machine.<br> ><br><br></span>Splice does not require it. But what you want to do with Squid may<br> prevent splice being used. So "it depends" ...<br><span><br><br> > As I have already asked before in mailing list to install SSL certificate<br> > on Android devices, which is not working.<br> ><br> > So my question is If I want to use peek and splice for example I want https<br> > filtering for<br><br></span> ... on how you define "filter".<br><br> > proxy websites<br><br> Not sure what you mean by that term.<br><span><br> > and I dont want ssl for bank websites and<br> > facebook youtube and gmail. how will it work? Do i need to install SSL<br> > certifcate on client or not, I am bit confused with peek and splice thing.<br><br></span>When you intercept port 443 normally only the raw-IP is available from<br> TCP. Peek allows Squid to get the server name the client was trying to<br> connect to out of the TLS. So that Squid can handle the intercepted<br> connection as if it had received a CONNECT message (which usually have<br> server/domain names).<br><br> Splicing can be thought of as handling a intercepted port 443 connection<br> as if it were a CONNECT message, with no decryption. It is treated as a<br> single "thing", with some limited control possibilities.<br><br><br> So...<br><br> In order to bump (decrypt) some traffic and splice (not decrypt) other<br> traffic you need to have a way to decide which type is being dealt with.<br> That is the peek or stare actions - to get data out of the TLS handshake<br> for you to use in ACL decisions.<br><br> You might now want to re-read the SslPeekAndSplice documentation again<br> to see if you understand it better. I skipped a lot of important details<br> to make the description clear.<br><span><br><br> ><br> > Please let me know is that possible to configure squid 3.5.19 in such a way<br> > so that it will bump only proxy websites not FB youtube etc.<br> ><br><br></span>Ah. So what are these "proxy websites" you speak of ?<br><br> One thing you need to be clear about is that once the TCP packets enter<br> Squid they *have* to be "proxied". There is no way to undo TCP accept()<br> and read() operations. But there are many ways of handling them that<br> Squid can do.<br><br> PS. you could post your existing config so we can suggest alterations to<br> it that will lead to it doing your new policy. That can be another way<br> to learn how the relevant-to-you part of the features work without<br> diving into the full complexity of what *might* be doable.<br><br> Amos<br><br> _______________________________________________<br> squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a></blockquote>
</div>
</div>
<br>
<div style="margin:0;padding:0;font-family:monospace">_______________________________________________<br> squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a></div>
</blockquote>
</div>
</div>
</div>
<br>_______________________________________________<br> squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br><br></blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<br>
<div style="margin:0;padding:0;font-family:monospace">_______________________________________________<br> squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a></div>
</blockquote>
</div></div></div>
<br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><br></div>