Many administrators do not seem to recognize the true purpose of a proxy. That is to make sure nothing but a certain protocol is used through the proxy. Squid is a HTTP proxy. It makes sure that people use nothing but HTTP through it.
I apologize if I sound rude but from listening to other administrators on IRC (#squid on irc.freenode.net) I learned that they have no idea how to actually use Squid properly. Many people think that Squid is a SOCKS proxy or an anonymous proxy or a firewall or whatever. No, it’s a HTTP proxy – and a damn good one, too.
Mistake 1: Interception caching
Interception caching (also known as transparent proxying) means that your firewall redirects all connections on TCP port 80 to the Squid. The browser believes that it is talking directly to the web server while in fact it is talking to the Squid.
Advantages:
- the users do not need to change their browser settings
Disadvantages:
- you can not use authentication
- all other ports than 80 will not be proxied
I often hear excuses like “I have 400 workstations that I would need to touch to change the proxy settings”. If you really do not have control over your workstations then you have a much more serious security problem than surfing. Interception caching is very convenient. But when you care about security it is not an option.
Mistake 2: Direct accesses are allowed
It also seem to be common (and pretty bad) that network admins set up a Squid proxy while still allowing direct connections from the LAN to the internet. Even if the network admin preconfigures the end users’ workstations to use the proxy it is simple to switch it back off and access the internet directly.
The simple rule should be: there are no direct connections between your local network and the internet. All connections go through securely configured proxy servers.
Solution
Often users on IRC (#squid) ask how they can prevent their users from changing the browser’s proxy settings back. This is the wrong question! The correct solution is to block direct accesses at the firewall and run all connections through the proxy. Your firewall rules should look something like this:
- Accept connections from your LAN to your Squid on port 3128
- Accept connections from your Squid to the Internet
- Deny any other connections
Of course you will have additional rules that allow ICMP or relay emails. But these are the important rules regarding proxy surfing. Now your users will either use the proxy to surf the internet or just get no connections. Combine this with authentication and you finally have control about what the workstations do. This is not only useful to torture your users or lurk what they are surfing but rather keep simple spyware away that either does not know how to use a proxy or does not have the username and password needed to login.
Another advantage of having a proxy setup like this:
You can use private IP addresses (like from 10.0.0.0/8) in your local network. Just the proxy needs to get an IP address that is valid on the internet.
Your method proposed here is certainly an nice try, but you'll admit it is pretty absolute. Then again, it's not as secure as you want to make believe…
To get it out of the way: I strongly disagree with your perception of the purpose of proxying.
The true purpose of a proxy is not and never was to restrict user access to foreign resources. It is to accelerate multi-end data transfers through a slow link by fetching foreign content just once through the slow link and then caching and serving it locally, instead of retransmitting it again through that slow link, greatly reducing network traffic and loading times for popular external sources delivered through the local infrastructure.
Controlling a user's network usage by proxying is problematic in several ways in my opinion.
First and most importantly: it implies that you don't trust your users! If you don't trust your users, then what the hell are they doing in front of your console in the first place?
Additionally in my experience it just doesn't work (on a technical level) to effectively restrict access to outside resources!
Virtually every service nowadays from facebook and instant messaging right down to file sharing and complete layer-2 VPN tunneling can happily work through proxied TCP connections on arbitrary ports. I work at a university where the local administrators enforce such a strict policy of no direct internet access and proxying everything, at least for certain user groups. Even so I have never yet failed to reach a ressource I wanted to have from within that network.
ICQ and MSN work through Port 80\TCP and support proxys, even with login. The Jabber IM protocol was specifically designed to work through TCP proxies, Skype works out of the box with proxies, you don't even have to configure them (don't ask me where it grabs the info from, I have yet to find out). Multiplayer games usually honor global proxy settings for their network services if they have to. Most middle- to upperclass SOHO routers have some kind of VPN tunneling capability, which with little effort can be tuned to listen on 443\TCP for incoming connections and make it easy for just about anyone to route data through their home internet connection to hide the true nature of the traffic.
The only way to filter those out would be to completely deny encrypted connections alltogether, which seems a bit radical, considering even google is offering encrypted access to their search engine to prevent phishing. You would effectively kill all secure connections to supplyer's online stores etc., or you would have to maintain a long list of exceptions for allowed sites, which is hardly feasible for large companies. Besides, a firewall is a better place for whitelists.
Movie streaming from websites requires nothing but a working flash plugin, and as much as I would like to see it happen, just globally denying flash to pass through the proxy is not going to happen any time soon, as it would sadly render about 40% of all commercial websites unusable. For accessing regular websites blocked by the proxy there are thousands of public php proxies out there. (Most of them to be considered "problematic" at best when it comes to private data, but facebook users seem to be pretty tolerant on that issue…)
Pretty much the same is unfortunately true for spyware. Instead of opening a dedicated connection to the outside world, which would be easy to detect, many products hijack the connections of regular programs such as Internet Explorer, Firefox or eMail for their communication. This not only works as camouflage, it is also a very convenient way to adopt to local network and proxy settings.
The only way around this would be to make the user approve every single established connection by hand. Since however this is tedious and requires a great deal of knowledge about network protocols and the inner workings of software to make an educated decision the user would very likely just always approve every connection presented, without even looking at the details after a while.
In short: restricting network access through proxying is not the way to go in my opinion. An educated user will always find a way to bypass a proxy restriction, and an uninformed user will often be annoyed by restrictions enforced by the proxy, and is tempted to try workarounds from dubious sources just to update their facebook profile, potentially compromising network security without even knowing it.
You can of course very effectively use a proxy to log the user's network activity, which in my opinion is a legitimate purpose. It is your network, you ought to know what is going on in it. An email from the local administrator to a user, with their supervisor as CC address, telling them to please not download 15GB of porn again like done yesterday at 11:32AM from that website during work is much more effective than any closed port can ever be!
Aside from that, I don't quite understand your comment about local network addresses and only needing one public IP address with a proxy. Isn't this accomplished by Network Address Translation, which is an entirely independent service and has nothing to do with proxying?
Regards,
Jost
Jost,
You do not need NAT if your users should not get directly to Internet, instead, you can activate just the proxy and you do not NAT at all.
That way, users will be completely separated from the Net… I believe that was the point in the HOWTO.
Regards,
Fernando
Better force user browser to use PAC or wpad file, and block ports 80 and 443 at iptables.
Hi
I want to configure a transperant squid proxy server inside any one machine of the LAN say 192.168.1.5. Now i have linksys wrtg router (192.168.1.1) which is connected to ISP and the linksys wrtg router is connected to switch which distribute the traffic all over the internet. Is it possible as in the http://www.crypt.gen.nz/papers/cisco_squid_wccp.html ? Also how can i get a shell for linksys wrtg router so that i can define access-list to direct or WCCP-proxied internet access ?
Thanks
What happen if i block 80 and 443 port on IPTables. It seem force user to using proxy but with some website or domain i dont want squid hit anything and send it to directly to firewall but 80 and 443 port is blocked. How it work now?
You can try to allow HTTP/HTTPS connections to the specific web site and use a proxy.pac (autoconfiguration file) to allow "DIRECT" connections to the internet. However it's been decades since a web site just used one IP address. Many – especially the big ones – use content delivers networks or load their static assets from different sites.
An alternative approach is using the technique I describe using OpenDNS.
I’ve done exactly what you’re asking for with iptables. Contact me if you haven’t a solution yet…
My Router is congigare how to re set & how to re-configare for wirelss router
how can I block android applications with out blocking internet
how can I block anti-proxy programs with out blocking internet
can you display a breif tutorial about firewall and transparent proxy configuration?
i have configured squid 3.5.27 on my windows server 2012 r2. I want to block all direct access to the internet and want all traffic to go through proxy server.but i don’t know how to configure windows firewall to redirect all internet traffic to the firewall.kindly help me.i am stuck here from last month.
i have configured squid on my centOS server 6.5. I want to block all direct access to the internet and want all traffic to go through proxy server only.but i don’t know how to configure filter centos.without proxy setting client should not access internet directly .also I router configuration done in the same purpose. kindly help me.
I Have users with specific IPs but they’re unable to access internet on squid proxy while other users can access the internet. however, i don’t have any internet restriction running on the squid proxy server. please assist me, what do i need to do?
You can enable your access_log in the squid.conf and check if you get requests/accesses from those clients.
Could all open ports be sent to a different pc running zeroshell via portforwarding then install squid? Then implement iptable rules of:
block all incoming
Allow established connections
Set up some dos protection to the firewall
Allow outgoing only by the zeroshell and squid.
Block all incoming forwarded requests other than the zeroshell machine
Set up a honeypot running a honey D config on zeroshell machine.
have the dos protection send anything suspicious to the port you configure the honey pot too ie dos attacks or even port scanners. Would this work for an almost total control? Of course nothing is unbreakable but would it make it more difficult? after all on a home network I don’t want to block my users just unorthorised access plus the fact I know what fun you can have with a proxy server and what else it can be used for.
You can of course very effectively use a proxy to log the user’s network activity, which in my opinion is a legitimate purpose. It is your network, you ought to know what is going on in it…
this is what I’ll be setting up a proxy for is auditing purposes. all it will be used for is a log of traffic. 50 workstations will be going through the proxy and my questions are what resources will I need to install a vm with centos 7
Can any tell me what would help me figure this out in my lab environment before prod ? Also does anyone have any fail-over suggestions?
Whether it’s okay to run a proxy is more of a legal topic. At work we surely must not do that. At home… well…
How large the server should be? If the 50 workstations are just used by common users then any system will do. Even a Raspberry 1.