[squid-users] Behind enemy lines (squid behind proxy)

Wed, 05 Nov 2014 17:33:56 -0800

I've searched through the internets and tried various things... to no avail. Hopefully someone here can point me in the right direction.
 
I am sitting behind a proxy, which accepts http/https. Everything else is blocked. If I instruct my browser to use this proxy,
everything works dandy. Both http and https.
 
The problem is, I have a few apps that don't have an option to set proxy. So, my idea was to set up squid on the local machine
that would transparently redirect http/https to the proxy. Eg something like this:
 
[ local_box: app (http or https) ---> squid ]   ----->   [ the_proxy ]   ----->   ...   ----->   [ internets ]
 
I have no control of the proxy, nor do I know what goes on after it.
 
I have the following iptables rules:
*nat
:PREROUTING ACCEPT [1:89]
:INPUT ACCEPT [1:89]
:OUTPUT ACCEPT [549:34321]
:POSTROUTING ACCEPT [624:38821]
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
-A OUTPUT -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3130
COMMIT
 
And my squid.conf is mostly garden variety:
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 901         # SWAT
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
coredump_dir /var/cache/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320
 
cache deny all
 
cache_peer proxy parent 3128 0 no-query no-digest default
never_direct allow all
 
http_port 3128
http_port 3129 intercept
https_port 3130 intercept ssl-bump generate-host-certificates=on cert=/etc/ssl/squid/cert.pem key=/etc/ssl/squid/key.pem
 
I've generated the certs and ran ssl_crtd to init ssl db dirs.
 
To verify squid is working, I've changed my browser proxy settings to 127.0.0.1:3128 for http and https.
Everything works like a charm.
 
This is where the "fun" begins:
 
==========
Without the proxy settings http also works just fine -- in both the browser and wget command. Https on the other hand is fubar.
In the browser I get "Unsupported Request Method and Protocol" error (after accepting the "invalid" certificate).
With wget I get:
local_box [~] wget https://google.com --no-check-certificate
--2014-11-05 20:21:12--  https://google.com/
Resolving google.com... 74.125.196.138, 74.125.196.139, 74.125.196.101, ...
Connecting to google.com|74.125.196.138|:443... connected.
WARNING: cannot verify google.com's certificate, issued by ‘/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd’:
  Self-signed certificate encountered.
    WARNING: certificate common name ‘’ doesn't match requested host name ‘google.com’.
HTTP request sent, awaiting response... 501 Not Implemented
2014-11-05 20:21:12 ERROR 501: Not Implemented.
 
access.log says:
1415236731.852     19 10.0.0.13 TCP_MISS/501 4255 GET https://www.google.com/ - FIRSTUP_PARENT/10.64.252.14 text/html
 
==========
If I add 'ssl_bump server-first all' to squid.conf. Whenever I try to pull up an https page, it barfs with:
2014/11/05 20:22:28| assertion failed: forward.cc:785: "peer->use_ssl"
Aborted
 
==========
If I change it to 'ssl_bump client-first all', I get "Unable to forward this request at this time" in the browser.
And wget says:
local_box [~] wget https://google.com --no-check-certificate
--2014-11-05 20:26:53--  https://google.com/
Resolving google.com... 74.125.196.101, 74.125.196.100, 74.125.196.139, ...
Connecting to google.com|74.125.196.101|:443... connected.
WARNING: cannot verify google.com's certificate, issued by ‘/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd’:
  Self-signed certificate encountered.
    WARNING: certificate common name ‘74.125.196.101’ doesn't match requested host name ‘google.com’.
HTTP request sent, awaiting response... 503 Service Unavailable
2014-11-05 20:26:53 ERROR 503: Service Unavailable.
 
access.log says:
1415237271.133      0 10.0.0.13 TCP_MISS/503 3840 GET https://google.com/ - FIRSTUP_PARENT/10.64.252.14 text/html
 
==========
And so after endless searching and searching and trying various things I came here. Could please help me figure out why it is not working?
 
Thank you.
 
-D
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users

Reply via email to