HTTPS is not working in transparent proxy with Squid

Question

I am using Squid proxy 3.1, all systems in the LAN connects to the internet through proxy. Direct connection is blocked using the iptables from the gateway server.

There are some devices which does not have options for auto proxy or manual proxy and can only connect to the internet directly. So I enabled transparent proxy in Squid and redirected packets for port 80 and 443 to Squid proxy using iptables.

Now the problem is it is working fine for HTTP port but HTTPS is not working. It is throwing "ssl_error_rx_record_too_long" error.

If it is not possible through transparent proxy can you please suggest me another solution.

Warm Regards

Supratik

Solution

HTTPS traffic can not be redirected transparently to a proxy. You need to find a way to configure the proxy settings on your devices. If it is not feasible, you have to forward HTTPS traffic directly to the Internet.

Comments

[Supratik]

If I allow direct connection to those devices I need to restrict their bandwidth also. Is there any way to limit bandwidth through iptables?

[Javier]

@Supratik: to handle bandwidth you use tc. it's all explained in lartc.org (linux advanced routing and traffic control). set aside a couple of days to read it all.

[Khaled]

Yes, of course. Have a look at tc. tldp.org/HOWTO/Adv-Routing-HOWTO.

[Supratik]

Thanks guys for all the information. I googled on this topic for some more time and found a link (rahulpahade.com/content/squid-transparent-proxy-over-ssl-ht‌​tps), this explains how you can allow HTTPS through transparent proxy and it really works. Only the issue here is if you use the normal openssl certificate it will always prompt you to add it to your certification exception list. Since I don't want to purchase a certificate now I decided to go with tc.