<html><body><div id="nine_body_n19103a-68fb8" class="nine_body mceEditable" dir="auto" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12.0pt; line-height: 1.3; color: #000000;"><div class="nine-pg" dir="auto"><p style="color: #0c0d0e; background-color: #ffffff; font-weight: 400; border: 0px; padding: 0px; margin: 0px 0px 1.1em;">I have a external proxy server connected by VPN (IPSEC) to my main branch, and i'm trying to redirect all users HTTP / HTTPS traffic to this proxy.</p><div class="nine-pg" dir="auto">Scenario Users -> Gateway (Main Branch) -> IPSEC -> Squid Proxy (transparent mode)</div><p style="color: #0c0d0e; background-color: #ffffff; font-weight: 400; border: 0px; padding: 0px; margin: 0px 0px 1.1em;">In my Gateway (Main Branch) I have this test iptables rule, that is forwarding all the TPC / UDP traffic to the Proxy server.</p><pre style="color: #0c0d0e; background-color: var(--highlight-bg); font-weight: 400; border: 0px; padding: var(--su12); margin: 0px 0px calc(1.5em); width: auto; max-height: 600px;"><code style="color: var(--black-600); background-color: transparent; font-weight: inherit; border: 0px; padding: 0px; margin: 0px;">iptables -t nat -I PREROUTING -s 192.168.60.90 -p tcp -j DNAT --to-destination 172.31.0.1
iptables -t nat -I PREROUTING -s 192.168.60.90 -p udp -j DNAT --to-destination 172.31.0.1
</code></pre><div class="nine-pg" dir="auto">In Squidd Proxy server I have the followed rules</div><pre style="color: #0c0d0e; background-color: var(--highlight-bg); font-weight: 400; border: 0px; padding: var(--su12); margin: 0px 0px calc(1.5em); width: auto; max-height: 600px;"><code style="color: var(--black-600); background-color: transparent; font-weight: inherit; border: 0px; padding: 0px; margin: 0px;">iptables -t nat -I PREROUTING -s 192.168.60.90/32 -p tcp -m tcp --dport 443 -m comment --comment ArticaSquidTransparent -j REDIRECT --to-ports 8081
iptables -t nat -I PREROUTING -s 192.168.60.90/32 -p tcp -m tcp --dport 80 -m comment --comment ArticaSquidTransparent -j REDIRECT --to-ports 8080
</code></pre><div class="nine-pg" dir="auto">Everything is working correctly, HTTP traffic is ok, DNS are also working, the only exeption is the HTTPS traffic, I can see the HTTPS traffic inside the squid access.log but on client side I got a timeout</div><pre style="color: #0c0d0e; background-color: var(--highlight-bg); font-weight: 400; border: 0px; padding: var(--su12); margin: 0px 0px calc(1.5em); width: auto; max-height: 600px;"><code style="color: var(--black-600); background-color: transparent; font-weight: inherit; border: 0px; padding: 0px; margin: 0px;">1722265740.867 1 192.168.60.90 TCP_TUNNEL/200 0 CONNECT cnn.com:443 - HIER_DIRECT/51.210.183.2:443 - mac="00:00:00:00:00:00" webfilterpolicy:%200%0D%0A exterr="-|-"
</code></pre><div class="nine-pg" dir="auto">Anyone can help me to understant if I'm missing so iptable rule to handle the HTTPS traffic?</div></div><div class="nine-pg blank sign" dir="auto"><br /></div><div id="nine-sign-n19103a-68fb8" class="nine_signature" dir="auto"><div class="nine-pg" dir="auto">Sent from <a style="text-decoration: none; color: #009bdf;" href="http://www.9folders.com/">Nine</a></div></div></div></body></html>