<div dir="ltr">Sorry for my bad english,<div><br></div><div>I want to make a anonymous https & http proxy that pass through any requests without decrypting or change them,</div><div>only change ip address from client ip to my server ip address and define ip address of my websites that i want to access them from my client in /etc/hosts,</div><div>so i try to install squid on my server and i have good experience when i set proxy in client with server ip and port 3128 and i can access http & https behind this proxy,</div><div>but when i try to using /etc/hosts i cannot access to https websites. i try to install squid lot of time with any install instructions that i found from googling.</div><div>I have server with CentOS 7 with one valid internet ip address.<br></div><div><br></div><div>For more explain of what i want to do, i need my squid to work like this ip <a href="http://173.161.0.227/" rel="noreferrer" target="_blank">173.161.0.227</a></div><div>When i add <u>173.161.0.227 <a href="http://www.iplocation.net">www.iplocation.net</a></u> to my client /etc/hosts</div><div>I can browse <a href="https://www.iplocation.net">https://www.iplocation.net</a> that tell me my client ip address is <a href="http://173.161.0.227/" rel="noreferrer" target="_blank">173.161.0.227</a></div>
<div>I want do my proxy server same as <a href="http://173.161.0.227/" rel="noreferrer" target="_blank">173.161.0.227</a></div><div><u><font color="#ff00ff"><br></font></u></div><div><font color="#ff00ff"><u>My problem is now with below config is:</u></font></div><div><font color="#ff00ff"><u><br></u></font></div>when i define <u>216.55.x.x <a href="http://www.iplocation.net">www.iplocation.net</a></u> to /etc/hosts in my client i cannot access to <a href="https://www.iplocation.net/">https://www.iplocation.net</a> and hang on connecting and then give me timeout error,<div>I`m appreciate for help me to resolve this problem.</div><div>I ask it before in <a href="http://serverfault.com/questions/805413/squid-with-iptables-bypass-https">http://serverfault.com/questions/805413/squid-with-iptables-bypass-https </a> but i cannot resolve it</div><div><div><div><u><font color="#ff00ff"><br></font></u></div><div><u><font color="#ff00ff">My Iptables config is:</font></u></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><p class="gmail-p1"><span class="gmail-s1"><font color="#0000ff">iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3130</font></span></p></div></blockquote><div><u><font color="#ff00ff">My squid config is:</font></u><br></div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><font color="#0000ff">acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network<br>acl localnet src fc00::/7 # RFC 4193 local private network range<br>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines<br>acl localnet src 127.0.0.1<br><br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br><br>acl CONNECT method CONNECT<br><br>http_access allow !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access allow localhost manager<br>http_access allow manager<br>http_access allow localnet<br>http_access allow localhost<br>http_access allow all<br><br>http_port 3128<br>http_port 80<br>http_port <a href="http://0.0.0.0:3129">0.0.0.0:3129</a> ssl-bump cert=/etc/squid/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br>https_port <a href="http://0.0.0.0:3130">0.0.0.0:3130</a> ssl-bump intercept cert=/etc/squid/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br><br>sslproxy_cert_error allow all<br>sslproxy_flags DONT_VERIFY_PEER<br><br>cache_dir ufs /var/cache/squid 100 16 256<br><br>coredump_dir /var/cache/squid<br><br>sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/squid/ssl_db -M 4MB<br>sslcrtd_children 50 startup=1 idle=1<br><br>sslproxy_cert_error allow all<br>sslproxy_flags DONT_VERIFY_PEER<br><br>ssl_bump peek all<br>ssl_bump splice all<br>ssl_bump bump all<br><br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320forwarded_for delete<br><br><br></font></blockquote><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 4, 2016 at 4:44 PM, Antony Stone <span dir="ltr"><<a href="mailto:Antony.Stone@squid.open.source.it" target="_blank">Antony.Stone@squid.open.source.it</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">On Tuesday 04 October 2016 at 14:51:13, Mehdi Yeganeh wrote:<br>
<br>
> Thanks for quick replay,<br>
> I need to use my server, i configure my ip address in some software like<br>
> antivirus and ...<br>
<br>
</span>... and what?<br>
<br>
I do not understand what antivirus software has to do with our discussion.<br>
Please give details, don't just write "...".<br>
<span class="gmail-"><br>
> So, I want all of that working<br>
<br>
</span>All of what?<br>
<span class="gmail-"><br>
> with my server ip address and for this reason I cannot use torproxy or<br>
> torproject. I need a proxy server (squid) on my server<br>
<br>
</span>In that case install Squid on your server. What is the problem?<br>
<span class="gmail-"><br>
> More details about <a href="http://173.161.0.227" rel="noreferrer" target="_blank">173.161.0.227</a>:<br>
> Its sophos web appliance that use squid on debian and using some other<br>
> proxy software (Astaro HttpProxy) with squid and<br>
> iptables for forwarding ports. but i can`t find the other proxy software<br>
> for download. so, i just have squid alone (although iptables is present)<br>
<br>
</span>Okay, so I understand that the machine on that IP address (which appears to be<br>
serving Pennoyer School in Illinois, with connectivity provided by Comcast) is<br>
a "Sophos web appliance" - some sort of combined firewall / proxy / port<br>
forwarder.<br>
<br>
What is the relevance of that machine to your question?<br>
<span class="gmail-"><br>
> Please tell me that should i use other tools or squid can do it?<br>
<br>
</span>Do what?<br>
<br>
Please explain exactly what it is you are trying to achieve, and hoping that<br>
Squid is a solution for.<br>
<br>
<br>
Regards,<br>
<br>
<br>
Antony.<br>
<span class="gmail-HOEnZb"><font color="#888888"><br>
--<br>
Police have found a cartoonist dead in his house. They say that details are<br>
currently sketchy.<br>
</font></span><div class="gmail-HOEnZb"><div class="gmail-h5"><br>
Please reply to the list;<br>
please *don't* CC me.<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
</div></div></blockquote></div><br></div></div></div></div>