Is is possibile to use a transparent proxy to filter some domains without a man-in-the-middle approach? I would like to guarantee the certificate verification and user privacy, by other hand, I want to deny connection to some domain.
Is it possibile with a transparent proxy?
Is it possibile with squid3?
Best Answer
A transparent proxy, by definition, sits man-in-the-middle. The client is unaware that the proxy exists and sends its requests to SSL-based sites as TCP SYNs to destination port 443.
If you specify the proxy explicitly the client will use the
CONNECTverb (since it knows there's a proxy being used), which Squid access control lists (ACLs) can act upon.No transparent proxy can reliably apply access control without doing man-in-the-middle. The best you can hope for would be acting upon the destination IP address which, frankly, will just give you headaches because you'll need to constantly maintain the list of IPs.