Also, if I setup a browser to use the proxy server directly (non-transparent) it works just fine. My iptables looks like: Iptables -A INPUT -I gre1 -j ACCEPT Iptables -t nat -A PREROUTING -I gre1 -d 0/0 -p tcp --dport 80 -j DNAT --to-destination 10.50.40.100:3128 GRE tunnel is: Auto gre1 Iface gre1 inet static Address 127.0.0.2 Netmask 255.255.255.255 Pre-up ip tunnel add gre1 mode gre remote 10.50.1.1 local 10.50.40.100 dev eth0 Post-down ip tunnel del gre1 On the cisco router ip wccp web-cache ip cef interface Loopback0 ip address 10.50.1.1 255.255.255.0 interface GigabitEthernet0/0.100 encapsulation dot1Q 10 ip address 10.50.100.1 255.255.255.0 ip wccp web-cache redirect out ip wccp web-cache redirect in -----Original Message----- From: John Czerwinski [mailto:JohnCzerwinski@xxxxxxxxxxxxx] Sent: Wednesday, November 11, 2009 10:03 AM To: Amos Jeffries Cc: squid-users@xxxxxxxxxxxxxxx Subject: RE: Squid3-Debian Lenny Transparent proxy not working with HTTPS Amos, Thank you for the reply. On your comment: Open port 443 on the firewall to let HTTPS out. Do you mean the iptables firewall on my Squid server? I already have 443 open on the perimeter firewall, and it does work if I turn-off wccp on the Cisco Router. My setup is: <INTERNET> | <Cisco ASA> | <Cisco 2821> | <USER NETWORK> Thanks, John -----Original Message----- From: Amos Jeffries [mailto:squid3@xxxxxxxxxxxxx] Sent: Tuesday, November 10, 2009 5:33 PM To: squid-users@xxxxxxxxxxxxxxx Subject: Re: Squid3-Debian Lenny Transparent proxy not working with HTTPS On Tue, 10 Nov 2009 10:21:04 -0500, "John Czerwinski" <JohnCzerwinski@xxxxxxxxxxxxx> wrote: > I have configured a Squid3 proxy server on Debian using WCCP to a Cisco > 2821 router (via GRE tunnel). Regular HTTP traffic works just fine. > Anytime I try to connect to HTTPS, it times out. Open port 443 on the firewall to let HTTPS out. HTTPS cannot be intercepted. It was created as a security protocol explicitly to prevent interception attacks on network traffic (aka WCCP, NAT interception, wire tapping, etc). > > I've compiled Squid with --enable-ssl. This merely lets Squid use SSL operations when clients explicitly configured to use the proxy request it to make https:// connections. It also enables TLS in some auth helpers. It's of very little use in a purely intercepting proxy. > > The squid configuration is as follows: > > > #################################################################### > # Squid3 Configuration > # > # > # > # Cisco Router at 10.50.40.1 > # GRE tunnel to Ciso Router at 10.50.1.1 > # > # Local Squid3 server > # name: wwifi-atl-squid1 > # IP: 10.50.40.100 > # WCCPv2 (Transparent mode) > # > #################################################################### > visible_hostname wwifi-atl-squid1 > # cache_effective_user squid squid > http_port 10.50.40.100:3128 transparent Not a good idea. It's better security to have the port number being something random that only you, Squid and the Squid box firewall know. The private port may also be firewalled in the mangle table INPUT chain to prevent people connecting directly to it from outside. > acl QUERY urlpath_regex cgi-bin \? > cache deny QUERY Drop the above. > acl apache rep_header Server ^Apache > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 Add here: refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > > > > > > # Access Control List Definitions > acl localnet src 10.50.10.0/24 10.50.20.0/24 10.50.30.0/24 10.50.40.0/24 > 10.50.100.0/24 10.50.201.0/24 > > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl to_localhost dst 127.0.0.0/8 Add here: acl to_localhost dst 0.0.0.0/8 > acl SSL_ports port 443 563 # https, snews > acl SSL_ports port 873 # rsync > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 563 # https, snews > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl Safe_ports port 631 # cups > acl Safe_ports port 873 # rsync > acl Safe_ports port 901 # SWAT > acl purge method PURGE Unless you are actually using PURGE its best not to define it. Simply doing the above turns on all the PURGE handling components and makes Squid hold extra cache indexes etc, wasting a lot of memory. > acl CONNECT method CONNECT > > # http allows/denies > always_direct allow all > http_access allow manager localhost > http_access deny manager > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow localhost > http_access allow localnet > http_reply_access allow all > icp_access allow all > Amos
