@JonathanLee said in AAAA records with IPv4 only ISP:
My goal is to have clamav work better as well as have the url filter get more visibility, I do block DoH my own list and a blacklist of blocks.
I don't use Squid/Squidguard since a long time.
So, what I'm going to say may no longer apply.
Clamav, to be useful, needs to check the payload of the packet.
Nowadays everything is HTTPS, this means that you would need to import custom certificates to all users.
So now, you broke HTTPS and that will definitely cause a lot of problems.
When I was using Squid/Squidguard, I opted by using the Splice all method, which only checks the SNI header and decisions are taken based on it, block or not. This is much less problematic.. But Clamav is useless now (it will only be able to check HTTP packets).
Splice all doesn't require the user to import certificates.
Note that a proxy, by nature, will mess with the packet headers, so this method is also problematic.
Even more problematic when speaking about government sites, financial sites, whatsapp, windows update and etc.
Based on my comments above, even using splice all, you would need a bypass list.
If you opt by using transparent proxy, this bypass list would have to have IP ranges and networks, which changes all the time, so a lot of maintenance and work for the IT team.
Devices such as dongles (chromecast and etc), mobile phones, would be in trouble almost instantly.
If you opt by using explicit proxy (the end user knows about the proxy), you would also need a bypass list.
But this list can have domains, regex, and etc, much easier to maintain and less likely to cause problems.
This method is also far from perfect, new domains, new apps, new redirects and everything else that you might need to tweak this bypass list again.
By doing like this, the client will send to the proxy everything that is not in the bypass list.
Destinations that are in the bypass list, the client will connect directly to the destination, thus not breaking the HTTPS.
So, either way, lots of maintenance and tweaking, forever because the Internet is not static.
I would say that an antivirus solution installed at the client side is a much better solution.
And, If you really need to block things, check if you can do it by using DNS using the method I mentioned above, disabling DOT/DOH/QUIC and etc.
This is my experience with using proxy for a long time, and I can say one thing for sure, people will call you everyday because something is "not working".
