Programming

13438 readers

6 users here now

All things programming and coding related. Subcommunity of Technology.

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

Routing all network requests in proxy? Avoid use of the internet outside of proxy (feddit.it)

submitted 4 hours ago by [email protected] to c/[email protected]

3 comments fedilink hide all child comments

Hi! I'm trying to achieve this configuration: essentially all the traffic in the network should pass the content filtering in the proxy, assume I have control over the clients. All not proxied traffic should be blocked by default.

I know not all network traffic can pass through proxy, but I'm not sure I understand how actually all of this work.

My UFW firewall configuration is the following:

To                         Action      From
--                         ------      ----
3128                       ALLOW OUT   Anywhere                  
53                         ALLOW OUT   Anywhere

53 is for DNS requests (that cannot pass through the proxy), even if I use DOH this port needs to be open for bootstrapping.

3128 is Squid proxy port.

I'm assuming the following:

client -> dns request (53) / cannot be handled by the proxy -> dns response client -> proxy (all ports that the proxy can handle) -> http/https/ftp response client -> blocked (all other ports)

But from UFW logs it looks like the client is trying to make requests (eg. https requests) directly through port 443, instead that passing from 3128.. Maybe I'm getting something wrong here on how Proxies work.

Do you have any suggestion?

top 3 comments

sorted by: hot top controversial new old

[–] [email protected] 2 points 4 hours ago (2 children)

If you simply want to block certain sites, why not use Pihole?

[–] [email protected] 2 points 2 hours ago

DNS over HTTPS bypasses pihole, and you have to do some effort to make it work. DNS in general is such a mess.

[–] [email protected] 1 points 3 hours ago* (last edited 3 hours ago)

I need to block IPs and unauthorized connections that are not http/https as well, I know about DNS filtering but it's not what I am trying to achieve.