Use proxy like an /etc/hosts file

hostsPROXYsquid

I want a forward proxy that basically overrides DNS like /etc/hosts would on a client machine. So when People go to Google.com (for example) the proxy sends the request to a specified IP address. I assume this can be done with Squid, can someone point me in the right direction? It is only a handful of URLs that I need to manage, everything else should be passed through to the actual server.

The purpose of this is to point some groups to a UAT environment so they can test some migrated web sites, it seems easier than managing all of their hosts files. Clients are Mac, Servers are RHEL 6

Best Answer

Normally the proxy server does the resolving (at least for plain HTTP, although I'm not 100% sure about HTTPS) so you simply point your proxy to a customized DNS server. In Squid with the configuration directive dns_nameservers.

The clients need to be explicitly configured to use the proxy.

DNSmasq is relatively light weight DNS server that can use a hosts file as the configuration syntax so you do not need to configure a complete zone for each domain you'll be spoofing.

Related Solutions

Linux – Is it possible to use proxy-arp back to the same interface

What you want is actually possible, but requires a pretty recent Linux kernel (>= 2.6.34, or a backport).

The option you need is /proc/sys/net/ipv4/conf/*/proxy_arp_pvlan:

proxy_arp_pvlan - BOOLEAN
    Private VLAN proxy arp.
    Basically allow proxy arp replies back to the same interface
    (from which the ARP request/solicitation was received).

    This is done to support (ethernet) switch features, like RFC
    3069, where the individual ports are NOT allowed to
    communicate with each other, but they are allowed to talk to
    the upstream router.  As described in RFC 3069, it is possible
    to allow these hosts to communicate through the upstream
    router by proxy_arp'ing. Don't need to be used together with
    proxy_arp.

    This technology is known by different names:
      In RFC 3069 it is called VLAN Aggregation.
      Cisco and Allied Telesyn call it Private VLAN.
      Hewlett-Packard call it Source-Port filtering or port-isolation.
      Ericsson call it MAC-Forced Forwarding (RFC Draft).

The upstream commit adding this support is 65324144b50bc7022cc9b6ca8f4a536a957019e3.

Selective proxy by DNS using Squid and BIND

Your first, DNS approach seems to be the best of two. To configure this, you should configure your bind as an authoritative server for zone example.com. A piece of BIND config should look nearly so:

zone "example.com" in{
    type master;
    file "pri.example.com";
};

pri.example.com in this example should contain address records for all subdomains of example.com, you want to redirect. Of course, IP address in these records should point to your proxy server.

I'm not absolutely shure, but you may need to configure your squid in "transparent" mode. There are many examples over Internet.

Squid is HTTP, HTTPS, FTP proxy server. But HTTPS is handled with CONNECT http method used. This is why you may use programs like Corkscrew or Proxytunnel These programs utilize CONNECT method for tunneling. There is a problem with CONNECT timeouts - it is described on ProxyTunnel page. The other approach to handling different protocols is redirecting data with iptables. In this case, handling is done on the 3-rd and 4-th OSI levels (address and transport protocols) and level 7 (application layer) isn't touched.

Hope, my answer will direct you to the right decision.

Best Answer

Related Solutions

Linux – Is it possible to use proxy-arp back to the same interface

Selective proxy by DNS using Squid and BIND

Related Topic