Re: [squid-users] Implementing SslBump using Bump-Server-First in Transparent mode using squid-3.HEAD-20121231-r12554

Hey,

 From this basic snippet of the email I can tell you:
1. using DNAT is wrong anyway for intercept proxy.
2. specifically for SSL-BUMP it's ^^^ the cause of most of your problems.

Since SSL-BUMP tries to to bump server first it should be able to knwo
what server to bump while using DNAT you replace the dst IP + PORT with
the proxy IP which makes it's impossible to "bump server first".

Use either REDIRECT or TPROXY instead to allow SSL-BUMP + server fisrt.

Eliezer

On 12/31/2012 2:37 PM, Swapneel Patnekar wrote:
> Hello Everyone,
>
> I've successfully managed to configure sslbump with
> squid-3.HEAD-20121231-r12554.
>
> However, I am having troubles in configuring SslBump using
> Bump-Server-First in Transparent mode. Basically I don't think I have
> the correct set of directives/configuration parameters in squid.conf
> to check/test SslBump using Bump-Server-First in Transparent mode. Any
> help on making this work is much appreciated.
>
> Redirecting traffic on port 80 & 443 to squid via iptables,
>
> iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT
> --to 192.168.2.1:3128
> #iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 443 -j DNAT
> --to 192.168.2.1:3129
>
> Squid was compiled using the following flags,
> ./configure --enable-icap --enable-ssl --enable-ssl-crtd
> --enable-delay-pools --with-openssl=/usr/local/openssl-1.0.0g
Received on Mon Dec 31 2012 - 23:34:07 MST