<div dir="ltr">skype was blocking every raw-ip:443 instead of just its own IPs, a bit too restricted, though it can have a list of its own IPs and dst might just work.<div><br></div><div>I'm trying to see if some chat can be blocked as they uses raw-IP without DNS at all(similar to what skype did)</div><div><br></div><div>yes I know ssl-bump uses IP from TCP-SYN to do fake-CONNECT (intercept mode), that is still different from a raw-IP with 443/ssl, the latter will warn because rarely any ssl certificate will have CN in IP format.</div><div><br></div><div>there might be some vpn over 443 port that uses raw-IP that I hope to block, if any.</div><div><br></div><div>Thanks,</div><div>Gordon<br><br><div class="gmail_quote"><div dir="ltr">On Sun, Jul 29, 2018 at 7:00 AM <<a href="mailto:squid-users-request@lists.squid-cache.org">squid-users-request@lists.squid-cache.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send squid-users mailing list submissions to<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:squid-users-request@lists.squid-cache.org" target="_blank">squid-users-request@lists.squid-cache.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:squid-users-owner@lists.squid-cache.org" target="_blank">squid-users-owner@lists.squid-cache.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of squid-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. block visit 80/443 browsing via IP(no domain name) (Gordon Hsiao)<br>
2. Re: block visit 80/443 browsing via IP(no domain name)<br>
(Amos Jeffries)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Sat, 28 Jul 2018 23:11:43 -0500<br>
From: Gordon Hsiao <<a href="mailto:capcoding@gmail.com" target="_blank">capcoding@gmail.com</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: [squid-users] block visit 80/443 browsing via IP(no domain<br>
name)<br>
Message-ID:<br>
<<a href="mailto:CAK0iFYzxwt2gQ-%2BwM9bsrnJF3uLAhhRtpE4pU0Wb4O1qgp3yOA@mail.gmail.com" target="_blank">CAK0iFYzxwt2gQ-+wM9bsrnJF3uLAhhRtpE4pU0Wb4O1qgp3yOA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
is there a way to block any attempt to visit http/https by _any_ IP<br>
directly, i.e.<br>
<br>
<a href="http://my-IP" rel="noreferrer" target="_blank">http://my-IP</a> or <a href="https://my-IP" rel="noreferrer" target="_blank">https://my-IP</a> (yes this will give a warning for SSL most<br>
likely). here my-IP could be any IPv4 address, for example.<br>
<br>
Basically I want to have Squid to enforce all 80/443 access should be done<br>
via a FQDN instead of an IP, is this possible? or should this be handled in<br>
a redirector instead?<br>
<br>
Thanks,<br>
Gordon<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.squid-cache.org/pipermail/squid-users/attachments/20180728/a65bf67a/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-users/attachments/20180728/a65bf67a/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Sun, 29 Jul 2018 18:32:45 +1200<br>
From: Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] block visit 80/443 browsing via IP(no<br>
domain name)<br>
Message-ID: <<a href="mailto:8883cf05-af98-6788-b42d-c1edd764a116@treenet.co.nz" target="_blank">8883cf05-af98-6788-b42d-c1edd764a116@treenet.co.nz</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 29/07/18 16:11, Gordon Hsiao wrote:<br>
> is there a way to block any attempt to visit http/https by _any_ IP<br>
> directly, i.e. <br>
> <br>
> <a href="http://my-IP" rel="noreferrer" target="_blank">http://my-IP</a> or <a href="https://my-IP" rel="noreferrer" target="_blank">https://my-IP</a> (yes this will give a warning for SSL most<br>
> likely<br>
<br>
Er, what makes you think that? Squid intercepting HTTPS has to already<br>
be decrypting the TLS in order to see any https:// from the client.<br>
<br>
<br>
> ). here my-IP could be any IPv4 address, for example.<br>
<br>
To match transactions with raw-IP in their HTTP request-line URL use a<br>
dstdom_regex ACL with -n parameter and regex that matches raw-IP.<br>
<<a href="http://www.squid-cache.org/Doc/config/acl/" rel="noreferrer" target="_blank" class="clutterFree_existingDuplicate clutterFree_noIcon">http://www.squid-cache.org/Doc/config/acl/</a>><br>
<br>
You should use a regex that matches both IPv4 and IPv6 because they<br>
*will* both be presented at times regardless of whether your systems are<br>
IPv4-only.<br>
<br>
You can find an example of a regex and how to use it in this page:<br>
<<a href="https://wiki.squid-cache.org/ConfigExamples/Chat/Skype" rel="noreferrer" target="_blank" class="gmail-clutterFree_existingDuplicate gmail-clutterFree_noIcon">https://wiki.squid-cache.org/ConfigExamples/Chat/Skype</a>>. Though note<br>
that Skype regex includes the port number ":443" at the end of the<br>
pattern which you may not want.<br>
<br>
Also, be aware that intercepted traffic does not operate with domain<br>
names. It often only has access to the IP:port details from TCP SYN<br>
packets. That especially includes intercepted port 443 traffic at the<br>
early stages of SSL-Bump processing.<br>
<br>
Is there something in particular you want to achieve with this blocking?<br>
<br>
Amos<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of squid-users Digest, Vol 47, Issue 58<br>
*******************************************<br>
</blockquote></div></div></div>