I want to redirect all HTTP and HTTPS traffic to squid acting as a transparent proxy. This traffic will then be blocked or authorized (in bulk) during certain hours. Specifically I do not want to decrypt/reencrypt HTTPS traffic but push it as it.
The HTTP part works, a REDIRECT rule in shorewall transfers all traffic intended for destination port 80 to the listening 3128 squid port in transparent mode.
The same trick for port 443 does not work.
There are tutorials on how to set up transparent proxy for HTTPS traffic, but all the ones I found describe the creation of a certifcate pair to decrypt/reencrypt the traffic – something I do not want to do.
The squid wiki mentions CONNECT as a way to tunnel HTTPS traffic, but adding http_access allow CONNECT all to the configuration (and disabling the default deny) does not change anything.
Then some previous answers suggest that transparent HTTPS traffing is not possible without breaking the TLS tunnel.
Therefore: is there a way to configure squid so that HTTPS traffic rerouted to it via iptables is then transparently transferred, without any modification?
(I would just eventually block when some time rules are met (this is to say the the block is not going to be based on anything within the HTTPS stream itself))
Best Answer
What you are asking for simply isn't possible because of how the https protocol works. Your options are:
You can with the correct iptables modules filter based on the time of day. Perhaps you should just handle the time of day filtering in your firewall?