How to keep your users from bypassing your proxy

Many administrators do not seem to recognize the true purpose of a proxy. That is to make sure nothing but a certain protocol is used through the proxy. Squid is a HTTP proxy. It makes sure that people use nothing but HTTP¹ through it.

I apologize if I sound rude but from listening to other administrators on IRC (#squid on irc.freenode.net) I learned that they have no idea how to actually use Squid properly. Many people think that Squid is a SOCKS proxy or an anonymous proxy or a firewall or whatever. No, it’s a HTTP proxy – and a damn good one, too.

Mistake 1: Interception caching

Interception caching (also known as transparent proxying) means that your firewall redirects all connections on TCP port 80 to the Squid. The browser believes that it is talking directly to the web server while in fact it is talking to the Squid.

Advantages:

• the users do not need to change their browser settings

Disadvantages:

• you can not use authentication (http://www.squid-cache.org/Doc/FAQ/FAQ-17.html#ss17.16)

• all other ports than 80 will not be proxied

I often hear excuses like "I have 400 workstations that I would need to touch to change the proxy settings". If you really do not have control over your workstations then you have a much more serious security problem than surfing. Interception caching is very convenient. But when you care about security it is not an option. 

Mistake 2: Direct accesses are allowed

It also seem to be common (and pretty bad) that network admins set up a Squid proxy while still allowing direct connections from the LAN to the internet. Even if the network admin preconfigures the end users’ workstations to use the proxy it is simple to switch it back off and access the internet directly.

The simple rule should be: there are no direct connections between your local network and the internet. All connections go through securely configured proxy servers. 

Solution

Often users on IRC (#squid) ask how they can prevent their users from changing the browser’s proxy settings back. This is the wrong question! The correct solution is to block direct accesses at the firewall and run all connections through the proxy. Your firewall rules should look something like this:

1. Accept connections from your LAN to your Squid on port 3128
2. Accept connections from your Squid to the Internet
3. Deny any other connections

Of course you will have additional rules that allow ICMP or relay emails. But these are the important rules regarding proxy surfing. Now your users will either use the proxy to surf the internet or just get no connections. Combine this with authentication and you finally have control about what the workstations do. This is not only useful to torture your users or lurk what they are surfing but rather keep simple spyware away that either does not know how to use a proxy or does not have the username and password needed to login.

Another advantage of having a proxy setup like this:

You can use private IP addresses (like from 10.0.0.0/8) in your local network. Just the proxy needs to get an IP address that is valid on the internet.

1. Actually Squid also speaks FTP-over-HTTP and can tunnel HTTPS, too (1)