How to Configure Squid Proxy Server for HTTPS Filtering

As more and more data is transmitted over the internet, the need for secure connections has never been greater. One way to achieve this is through HTTPS filtering. HTTPS filtering allows you to inspect, monitor, and filter secure web traffic to enhance security and control.

One tool that can help you achieve this is the Squid Proxy Server. Squid is a powerful and flexible proxy server that can be used to improve network performance by caching frequently accessed web content, reducing bandwidth usage, and speeding up response times. But beyond these, Squid also offers features for web traffic filtering, including HTTPS filtering.

In this tutorial, we will guide you through the process of configuring Squid Proxy Server for HTTPS filtering on CentOS. This will allow you to monitor and control secure web traffic, enhancing your network’s security and performance.

Before we proceed, it’s important to note that you should have Squid Proxy Server installed on your CentOS system. If you haven’t done so yet, you can refer to our previous tutorial on how to install and set up Squid Proxy Server.

Step 1: Enable SSL Bumping

The first step in configuring Squid for HTTPS filtering is to enable SSL Bumping. SSL Bumping is a feature in Squid that allows it to peek into the SSL traffic, enabling it to block or allow specific websites based on your rules.

To enable SSL Bumping, open the Squid configuration file:

vi /etc/squid/squid.conf

Then, add the following lines to the configuration file:

http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myCA.pem
ssl_bump peek all
ssl_bump bump all

This will enable SSL Bump on port 3128 with the certificate located at /etc/squid/ssl_cert/myCA.pem.

Step 2: Create SSL Certificate

Next, you need to create an SSL certificate that Squid will use for SSL Bumping. To do this, first, create a directory for the SSL certificate:

mkdir /etc/squid/ssl_cert

Then, navigate to the newly created directory:

cd /etc/squid/ssl_cert

Now, generate the SSL certificate:

openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem

This will create a new SSL certificate named myCA.pem that will be valid for 365 days.

Step 3: Configure Squid for HTTPS Filtering

Now that you have enabled SSL Bumping and created an SSL certificate, you can configure Squid for HTTPS filtering. To do this, open the Squid configuration file:

vi /etc/squid/squid.conf

Then, add the following lines to the configuration file:

acl SSL_ports port 443
acl CONNECT method CONNECT
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all

These lines will configure Squid to filter HTTPS traffic. The ‘acl SSL_ports port 443’ line defines the SSL ports, the ‘acl CONNECT method CONNECT’ line defines the CONNECT method used for SSL connections, and the ‘http_access deny CONNECT !SSL_ports’ line denies any CONNECT requests that are not to SSL ports.

Step 4: Restart Squid

After making these changes, you need to restart Squid for the changes to take effect. You can do this with the following command:

systemctl restart squid

Step 5: Configure Your Browser to Use Squid

Once you’ve set up your Squid proxy server, the next step is to configure your web browser to use it. This process varies depending on the browser you are using. Here are the steps for some of the most popular web browsers:

Google Chrome

1. Open Google Chrome and click on the three-dot menu in the top-right corner.
2. Go to “Settings” and scroll down to the bottom of the page.
3. Click on “Advanced” to expand the advanced settings.
4. Under the “System” section, click on “Open your computer’s proxy settings”.
5. In the “Proxy settings” window, under “Manual proxy setup”, turn on “Use a proxy server”.
6. Enter the IP address of your Squid server in the “Address” field and the port number (usually 3128) in the “Port” field.
7. Click “Save” to apply the changes.

Mozilla Firefox

1. Open Firefox and click on the three-line menu in the top-right corner.
2. Go to “Options” and scroll down to the “Network Settings” section.
3. Click on “Settings” to open the “Connection Settings” window.
4. Select “Manual proxy configuration”.
5. Enter the IP address of your Squid server in the “HTTP Proxy” field and the port number in the “Port” field.
6. Check the box that says “Use this proxy server for all protocols”.
7. Click “OK” to apply the changes.

Safari

1. Open Safari and click on “Safari” in the menu bar, then select “Preferences”.
2. Go to the “Advanced” tab and click on “Change Settings” next to “Proxies”.
3. In the “Proxies” window, check the box for “Web Proxy (HTTP)”.
4. Enter the IP address of your Squid server in the “Web Proxy Server” field and the port number in the field next to it.
5. Click “OK” and then “Apply” to save the changes.

Microsoft Edge

1. Open Microsoft Edge and click on the three-dot menu in the top-right corner.
2. Go to “Settings” and select “System” on the left side.
3. Under “System”, click on “Open your computer’s proxy settings”.
4. In the “Proxy settings” window, under “Manual proxy setup”, turn on “Use a proxy server”.
5. Enter the IP address of your Squid server in the “Address” field and the port number (usually 3128) in the “Port” field.
6. Click “Save” to apply the changes.

Commands Mentioned:

• sudo apt-get install squid – This command is used to install Squid on Ubuntu.
• vi /etc/squid/squid.conf – This command opens the Squid configuration file in a text editor.
• mkdir /etc/squid/ssl_cert – This command creates a new directory for the SSL certificate.
• cd /etc/squid/ssl_cert – This command changes the current directory to the newly created SSL certificate directory.
• openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/squid/ssl/squid.key -out /etc/squid/ssl/squid.crt – This command generates a new self-signed SSL certificate.
• systemctl restart squid – This command restarts the Squid service, applying any changes made to the configuration file.

Conclusion

In this tutorial, we’ve walked through the process of setting up Squid Proxy Server for HTTPS filtering on CentOS. We’ve covered the installation of Squid, the configuration of Squid for HTTPS filtering, the generation of an SSL certificate, and finally, how to configure your browser to use Squid.

By following these steps, you should now have a Squid Proxy Server that’s capable of filtering HTTPS traffic. This setup can significantly enhance your network’s security and performance by allowing you to monitor and control secure web traffic.

Remember, Squid is a versatile tool that can do much more than just HTTPS filtering. It can be used to cache web content, control access to websites, and even improve your network’s performance. To learn more about what Squid can do, check out our other tutorials on Squid: features, functions, and benefits.

I hope you found this tutorial helpful. If you have any questions or run into any issues, feel free to leave a comment below.

Happy browsing!

FAQ

1. What is HTTPS filtering and why is it important?

   HTTPS filtering is a technique used to inspect, monitor, and filter secure web traffic. It involves decrypting, inspecting, and then re-encrypting the traffic. This allows you to see the contents of secure web traffic and apply filtering rules to it. It’s important for network security as it can help block access to certain websites, monitor web usage, and protect against threats hidden in encrypted traffic.

2. Can Squid filter all types of web traffic?

   Yes, Squid can filter both HTTP and HTTPS traffic. However, filtering HTTPS traffic requires additional configuration and the use of the SSL Bump feature.

3. Is it legal to filter HTTPS traffic?

   Yes, it is generally legal to filter HTTPS traffic, as long as you are doing it on a network that you own and manage, and you have the necessary permissions from the users of the network. However, laws can vary by country and region, so it’s always a good idea to check with a legal expert if you’re unsure.

4. How do I stop using the Squid proxy server?

   To stop using the Squid proxy server, you can go back to the proxy settings in your browser and turn off the proxy server option. This will stop your web traffic from being routed through the Squid proxy server.

5. Does Squid work with other operating systems besides CentOS?

   Yes, Squid is a cross-platform software that works with a variety of operating systems, including other Linux distributions, BSD, and Windows. The installation and configuration process may vary depending on the operating system.