https problen in Transparent proxy server

[nandhapswan]

I have configured squid as transparent proxy. But my users can not access the sites having https. Logically I should use iptables to redirect all the traffic.

Firewall and squid in same server.

The quick response will highly appreciated.

--
Regards,
Nantha....

[nplusplus]

You will not be able to do SSL proxying with Squid transparently as Squid relies on clients to utilize the http CONNECT method to connect to an SSL site through a proxy, and clients will not do so unless they are explicitly configured to use a proxy. You might be able to mash something together, but it will not work cleanly.

Anyone, please correct me if I am wrong.
N

[nandhapswan]

HI N++,

I can able to do through in IPTABLES by using masquerade. the squid and firewall in same server. I want to now how to masquerade through Iptables for 443

[Lazydog]

What do your rules look like now for IPTABLES?

[nandhapswan]

Hi Lazy dog,

see the below rule for http. I have to give for https in masqurade.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
-j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state \ --state NEW,ESTABLISHED,RELATED -i eth1
-p tcp \ --dport 3128
iptables -A OUTPUT -j ACCEPT -m state \--state NEW,ESTABLISHED,RELATED -o eth0
-p tcp \ --dport 80
iptables -A INPUT -j ACCEPT -m state \ --state ESTABLISHED,RELATED -i eth0
-p tcp \ --sport 80
iptables -A OUTPUT -j ACCEPT -m state \--state ESTABLISHED,RELATED -o eth1
-p tcp \--sport 80

[Lazydog]

Try adding the following rules to your firewall;

iptables -A FORWARD -i eth1 --dport 443 -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 --sport 443 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

These rules bypass the proxy and allow 443 traffic to pass the firewall.

[nandhapswan]

i am getting this kind of error, reponse quickly

iptables v1.3.5: Unknown arg `--dport'

[Lazydog]

What do the rules look like?

[nandhapswan]

In firewall server and squid server in same machine. eth0 is my private-ip and eth1 is public-ip. I need to allow the https through the server.
your previous answer is not working. I cant able to put the rule.

[Lazydog]

You need to be root in order to add rules